Privacy & Aviso Legal
Last updated: 2026. This page covers both the GDPR privacy notice and the Spanish LSSI-CE legal notice (aviso legal).
Who runs this site
This website is operated by Andy Brooke, a self-employed professional (autónomo) registered in Spain. Andy's personal name is the legal entity that owns and operates the site.
- Name: Andy Brooke
- NIE: X9335313G
- Studio: Torres Torres, Valencia, Spain.
- Calpe residency: Biking Luca, Av. Diputación 66, 03710 Calp, Alicante, Spain.
- Email: andy@andy-brooke.com
- Website: andy-brooke.com
What data this site collects
This site is deliberately low-data. In normal operation it collects only what is needed to serve pages, book appointments, and answer emails.
Automatically collected
- Server logs from the hosting provider (IP address, timestamp, URL requested, user agent). Retained for up to 30 days for security and diagnostic purposes.
- Google Analytics 4, but only if you accept it. If you accept, Google Analytics records the pages you view, how you reached the site, your approximate location, and your device and browser type. It stores cookies named
_gaand_ga_W39SKQPC15on your device. If you decline, or if you have not answered yet, no analytics script loads and no analytics cookie is set.
Collected when you contact me or book a fit
- Email correspondence you send to andy@andy-brooke.com: the contents of your email and any attachments.
- Form submissions sent through forms on this site, such as the course interest and mentoring forms: your name, email address and the answers you give. Submissions are received and stored by the hosting provider (Netlify) and forwarded to my inbox. If you tick the box asking to hear about future courses, I'll email you when new dates are announced; you can ask me to stop at any time.
- Booking data submitted through the AIDOS booking widget on the Bike fitting page: name, contact details, and the information you provide to prepare for your fit. AIDOS is the data processor for this flow and stores booking data on its own systems. See the AIDOS privacy policy at aidos.fit for details.
Why this data is processed
- To provide the service you asked for (answering enquiries, scheduling fits, delivering consultations) — legal basis: contract or pre-contractual measures (GDPR Art. 6(1)(b)).
- To tell you about future courses, only if you tick the box asking me to — legal basis: your consent (GDPR Art. 6(1)(a)).
- To run the site securely (server logs) — legal basis: legitimate interest (GDPR Art. 6(1)(f)).
- To understand how the site is used (Google Analytics) — legal basis: your consent (GDPR Art. 6(1)(a)). You can withdraw consent at any time using the control below, and withdrawing is as easy as giving it.
- To comply with legal and tax obligations (retaining invoices, responding to lawful requests) — legal basis: legal obligation (GDPR Art. 6(1)(c)).
Who the data is shared with
The third-party processors involved in running this site are:
- Hosting provider (Netlify) — serves the site, keeps short-term server logs and receives form submissions.
- AIDOS (aidos.fit) — booking widget and fit-record platform, operated by the same legal entity (Andy Brooke). Booking data you submit through the widget is processed by AIDOS.
- Google Analytics (Google Ireland Limited) — web analytics, used only with your consent. Google acts as a data processor and may transfer data to the United States. See the Google privacy policy.
- Email provider — handles the andy@andy-brooke.com mailbox.
No data is sold, rented, or shared with advertising networks.
International transfers
The site preferentially uses EU-resident providers. Where a provider is based outside the EU, it operates under the European Commission's Standard Contractual Clauses or an equivalent safeguard. If you accept analytics cookies, Google may transfer your data to the United States under the EU-US Data Privacy Framework.
How long data is kept
- Server logs: up to 30 days.
- Form submissions: as long as needed to deal with your enquiry. If you've asked to hear about future courses, until you ask me to stop.
- Email correspondence: as long as reasonably necessary to continue the conversation or comply with a legal obligation.
- Booking records: as required by Spanish tax law (typically 6 years) or as set out in the AIDOS privacy policy.
Your rights under GDPR
If you are in the EU/EEA you have the right to:
- Access the data held about you.
- Correct inaccurate or incomplete data.
- Ask for data to be erased where legally possible.
- Restrict or object to certain processing.
- Request portability of data you have provided.
- Lodge a complaint with the Spanish data protection authority (Agencia Española de Protección de Datos) if you believe your rights have been breached.
To exercise any of these rights, email andy@andy-brooke.com. You'll receive a reply within 30 days.
Cookies
This site sets no cookies until you agree to them. It uses no advertising or cross-site tracking cookies at all.
The only optional cookies are the Google Analytics cookies described above. On your first visit a bar appears at the bottom of the page asking whether you accept them. Until you choose, the analytics script is never requested, so nothing is stored on your device and nothing is sent to Google. Your answer is stored in your browser's local storage, not in a cookie.
Blocking removes any analytics cookies already stored. If the embedded AIDOS booking widget or any future tool introduces cookies, that use will be disclosed here and consent will be requested before the cookies are set.
Aviso legal (Spanish LSSI-CE)
Under Spain's Ley 34/2002, de 11 de julio, de Servicios de la Sociedad de la Información y de Comercio Electrónico (LSSI-CE), the following information is published:
- Titular: Andy Brooke, autónomo.
- NIE: X9335313G.
- Domicilio profesional: Torres Torres, Valencia, Spain.
- Consulta en Calpe: Biking Luca, Av. Diputación 66, 03710 Calp, Alicante, Spain.
- Contacto: andy@andy-brooke.com.
- Actividad: applied cycling biomechanics — bike fitting, consulting, mentoring, and writing.
Changes to this policy
If this policy changes materially (for example, a new processor is added, or the newsletter launches), the update is summarised at the top of the page and the "last updated" date is revised.