Privacy and cookies policy
Last updated: 22 October 2026
This policy explains how I collect and use personal data when you visit this website, get in touch, or work with me. It follows the EU General Data Protection Regulation (GDPR), Spain's Organic Law 3/2018 (LOPDGDD) and, where it applies, the UK GDPR.
1. Who is responsible for your data
- Controller: Helen May Taylor, trading as Helen May Online
- NIF: Y3923312D
- Address: San Martín de Gurullés 4, 33829 Grado, Asturias, Spain
- Email:
This email address is being protected from spambots. You need JavaScript enabled to view it.
I'm a sole trader and haven't appointed a Data Protection Officer, as the law doesn't require one for a business of this size. Please send any privacy questions to the email above.
2. What I use your data for, and why
| Purpose | Data | Legal basis | How long I keep it |
|---|---|---|---|
| Answering enquiries from the contact form or email | Name, email, company, website, start date, your message | Steps you ask for before a contract; my legitimate interest in replying | Up to 12 months after our last contact, unless we start working together |
| Providing services to clients and managing the relationship | Contact details of you and your team, communications, information needed for the work | Performance of a contract | For the length of the contract, then as long as needed for claims (usually up to 5 years) |
| Invoicing, accounting and tax | Name, business details, tax ID, invoices, payments | Legal obligation | At least 6 years (Spanish commercial and tax rules) |
| Occasional emails about my services (only if you opt in) | Name, email | Your consent | Until you unsubscribe |
| Keeping the website running and secure | IP address, browser and device data in server logs | Legitimate interest in security | As set by the hosting provider, kept for a limited period |
I don't use your data for automated decision-making or profiling, and I don't sell it.
If you give me data about other people (for example your team members), please make sure they know you've shared it.
3. When I work on your data for you
If you're a client and I handle personal data on your behalf (for example your customers' or staff details), I do so as your processor, following your instructions under a separate data processing agreement. This policy covers only the data I handle as controller.
4. Who I share your data with
I share data only where needed, with:
- Service providers that support my business, under data processing agreements: website design and hosting (Bladgoud Webdesign, on TransIP servers in the Netherlands), email and file storage (Google Workspace), project management (ClickUp), and design and AI tools (Canva; Claude, by Anthropic) when I use them for client work
- My accountant / gestoría, for bookkeeping and tax
- Public authorities, such as the Spanish Tax Agency (AEAT) or Social Security, where the law requires it
5. International transfers
Some providers may process data outside the European Economic Area, for example in the United States, the United Kingdom or Australia. Where this happens, transfers are protected by an EU adequacy decision (such as for the UK, or for US companies certified under the EU–US Data Privacy Framework) or by the European Commission's standard contractual clauses.
6. Your rights
You can ask me to:
- give you a copy of your data (access)
- correct inaccurate data (rectification)
- delete your data (erasure)
- limit how I use it (restriction)
- stop using it, including for marketing (objection)
- send your data to you or another provider (portability)
Where I rely on your consent, you can withdraw it at any time. This won't affect anything done before you withdrew it.
To use any of these rights, email
Complaints: if you're unhappy with how I've handled your data, you can complain to the Spanish Data Protection Agency (AEPD) at www.aepd.es. If you're in the UK, you can also contact the Information Commissioner's Office (ICO) at ico.org.uk. I'd appreciate the chance to sort it out first.
7. Security
I use appropriate technical and organisational measures to protect your data, including secure, password-protected accounts with two-factor authentication, and access limited to what's needed for the work.
8. Children
My services are for businesses. This website isn't intended for anyone under 14, and I don't knowingly collect their data.
9. Changes
I may update this policy. The date at the top shows the latest version, and I'll tell clients about any important changes.
10. Cookies
This website uses only a technical session cookie, which keeps the site working and protects the contact form from misuse. It is deleted when you close your browser. Under Spanish Law 34/2002 (LSSI-CE) this kind of cookie doesn't need your consent. I don't use analytics, advertising or tracking cookies. If that changes, I'll update this policy and ask for your consent first.