Privacy Policy

Effective Date: 2024-05-08
Last Updated: 2026-09-08

1. Introduction

Salah Nomad (“we,” “us,” “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit salahnomad.com (“the Site”), purchase our digital products, engage our private services, or interact with us.

This Policy complies with:

• EU General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679
• California Consumer Privacy Act (CCPA) as amended by CPRA
• Spanish Ley Orgánica 3/2018 (LOPDGDD)

1.1. Data Controller

• Controller: Salah Nomad
• Contact: Contact Page
• Data Protection Contact: Contact Page – subject “Data Protection”
• EU Representative: To be appointed Q1 2027

2. Data We Collect

2.1. Data You Provide Voluntarily

2.2. Special Category Data (GDPR Article 9)

We collect nationality and tax residency for private service inquiries. These are considered special category data under GDPR.

Legal Basis: Necessary for pre-contractual steps at your request (GDPR Article 6(1)(b)) and your explicit consent (GDPR Article 9(2)(a)).

Purpose:

• Assess cross-border tax implications (IRPF vs IRNR)
• Determine applicable visa pathways
• Identify relevant double-taxation treaties

Retention: Deleted if no engagement is signed within 90 days of inquiry.

2.3. Data Collected Automatically

2.4. Data from Purchases

Note: We never see or store your credit card details, bank account information, or private keys. All payment processing is handled by NOWPayments.

2.5. Data from Comments (Giscus)

If you leave comments on our articles, Giscus (powered by GitHub Discussions) collects:

• Your GitHub username
• Comment content
• Timestamps

This data is subject to GitHub’s Privacy Policy.

3. How We Use Your Data

3.1. Legal Bases for Processing (GDPR Article 6)

3.2. Automated Decision-Making & Profiling (GDPR Article 22)

When you submit a private service inquiry, we use automated scoring (0-100 points) based on:

• Budget range (weight: 30%)
• Timeline (weight: 25%)
• Financing structure (weight: 20%)
• NDA consent (weight: 15%)
• Zone of interest (weight: 10%)

Purpose: Prioritize responses and allocate limited capacity (4 engagements per month).

Logic: Higher scores indicate alignment with our service scope and capacity.

• Scores ≥70: Priority response (24 hours)
• Scores 50-69: Standard response (48 hours)
• Scores <50: Automated rejection with guide recommendations

Your Rights: You may object to automated scoring by using our Contact Page and selecting subject “Manual Review Request”. We will review your inquiry manually within 72 hours.

No Solely Automated Decisions: All engagement decisions involve human review after initial scoring.

4. Cookies & Tracking Technologies

4.1. Cookies We Use

4.2. Cookies We Do NOT Use

• ❌ No advertising cookies (Google Ads, Facebook Pixel, etc.)
• ❌ No affiliate cookies (we have no affiliate links)
• ❌ No cross-site tracking (Google Analytics, etc.)

4.3. Managing Cookies

You can manage cookies through your browser settings. Disabling essential cookies may impair Site functionality (e.g., security verification, theme preference).

5. Data Sharing & Third Parties

5.1. Data Processors

We share data with the following processors, all bound by Data Processing Agreements (DPAs):

5.2. International Data Transfers (GDPR Chapter V)

Some processors operate outside the EU/EEA. We rely on the following legal mechanisms:

EU-US Data Privacy Framework: Adequacy decision adopted July 10, 2023 by the European Commission.

Fallback: If a processor loses DPF certification, we will use EU Standard Contractual Clauses (SCCs) as fallback.

Your Rights: Request a copy of DPAs or DPF certification via our Contact Page.

5.3. Data We Never Share

• ❌ We never sell your personal data
• ❌ We never share your data with advertisers
• ❌ We never share your data with affiliates (we have no affiliate program)
• ❌ We never share your email with third parties for marketing

6. Data Retention

7. Data Security

7.1. Technical Measures

We implement appropriate technical measures to protect your data:

• HTTPS/TLS encryption for all data in transit
• Encrypted storage for sensitive data at rest
• Access controls (role-based, principle of least privilege)
• Regular security updates for all systems
• DDoS protection via Cloudflare
• Bot protection via Cloudflare Turnstile

7.2. Organizational Measures

• Employee training on data protection
• Incident response plan for data breaches
• Regular security audits (annual)
• Vendor due diligence for all processors

7.3. Data Breach Notification (GDPR Articles 33-34)

In case of a personal data breach likely to result in risk to your rights:

• We will notify the Spanish Data Protection Agency (AEPD) within 72 hours
• We will notify you without undue delay if the breach poses high risk (e.g., exposure of tax residency, financial data)
• Notification will include:
  • Nature of the breach
  • Likely consequences
  • Measures taken
  • Contact point for more information

Contact for breach inquiries: Use our Contact Page with subject “Data Breach”.

8. Your Rights

8.1. EU Residents (GDPR)

You have the right to:

• Access (Art. 15): Obtain a copy of your personal data
• Rectification (Art. 16): Correct inaccurate data
• Erasure (Art. 17): Delete your data (“right to be forgotten”)
• Restriction (Art. 18): Limit processing in certain circumstances
• Portability (Art. 20): Receive your data in a machine-readable format
• Object (Art. 21): Object to processing based on legitimate interest
• Withdraw consent (Art. 7): Withdraw consent at any time (for consent-based processing)
• Object to automated decision-making (Art. 22): Request human review

8.2. California Residents (CCPA/CPRA)

You have the right to:

• Know: Request disclosure of data collected, used, and shared
• Delete: Request deletion of your personal data
• Correct: Request correction of inaccurate data
• Opt-out: Opt-out of “sale” or “sharing” of personal data
• Non-discrimination: Not be discriminated against for exercising your rights
• Limit use of sensitive data: Limit use of sensitive personal information

8.3. California: Do Not Sell or Share

We do not sell personal information as defined by CCPA/CPRA. We have not sold personal information in the preceding 12 months.

If we ever begin selling data, we will:

• Add a “Do Not Sell or Share My Personal Information” link in the footer
• Honor opt-out requests within 15 business days
• Not discriminate against you for exercising this right

Current status: No sale of personal information.

8.4. Exercising Your Rights

To exercise your rights:

• Use: Our Contact Page and select subject “Data Rights Request”
• Include: Your name, email, and specific right you wish to exercise
• Verification: We may ask for additional information to verify your identity

Response time: We will respond within 30 days (GDPR) or 45 days (CCPA).

Complaints: If you are not satisfied with our response:

• EU: File a complaint with the Spanish Data Protection Agency (AEPD) — www.aepd.es
• California: File a complaint with the California Privacy Protection Agency (CPPA)

9. Children’s Privacy

The Site is not intended for children under:

• 14 years (Spain, per LOPDGDD)
• 16 years (other EU countries, per GDPR)
• 13 years (US, per COPPA)

We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us via the Contact Page and we will delete it.

10. Data Protection Impact Assessment (DPIA)

We conduct DPIAs for high-risk processing, including:

• Automated scoring of private service inquiries
• Processing of special category data (nationality, tax residency)

DPIAs are available on request via our Contact Page.

11. Record of Processing Activities (GDPR Article 30)

We maintain a record of processing activities. Summary of main operations:

Full record available on request via our Contact Page.

12. Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity. We will notify you via email and provide an opportunity to opt-out or request deletion.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes are effective immediately upon posting, with an updated “Last Updated” date.

Material changes (affecting data use, sharing, or rights) will be announced via newsletter at least 7 days before taking effect.

14. Contact

For privacy-related inquiries or to exercise your rights, use our contact page and specify the subject of your request (e.g., “GDPR access request”, “Data breach report”, “Objection to automated scoring”).

We will process your request within the legal deadlines.

This Privacy Policy was last reviewed on 2026-09-08. While crafted with care to comply with GDPR, CCPA/CPRA, and Spanish law, it has not been reviewed by legal counsel. For full compliance assurance, consult a qualified Spanish data protection attorney.