Skip to main content

Privacy Policy

How RH Sales Hunters SL collects, uses, and protects your personal data.

Last Updated: 12 February 2026

1. Introduction & Controller Identity

This Privacy Policy explains how RH Sales Hunters SL ("we", "us", "our") collects, uses, and protects your personal data when you visit rhsaleshunters.es (the "Website") or interact with our barber-training services in Madrid, Spain. We are committed to handling your information responsibly and in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Spain's Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales ("LOPDGDD").

Data Controller:
RH Sales Hunters SL
Calle Corazón de María 70
28002 Madrid, Spain
Email: [email protected]
Phone: +34 917 684 230

This Privacy Policy is effective as of 12 February 2026 and applies to all personal data processed through this Website.

2. Personal Data We Collect

Depending on how you interact with our Website, we may collect the following categories of personal data:

  • Identity & contact data: full name, email address, phone number — provided when you complete our enrolment or contact form.
  • Form content: messages, course preferences, experience level, and any additional information you choose to share in free-text fields.
  • Technical data: IP address, browser type and version, device type and operating system, screen resolution, preferred language, time zone.
  • Usage data: pages visited, time spent on each page, referral URLs, click paths, scroll depth, and interaction events.
  • Cookies & identifiers: cookie IDs, advertising identifiers, pixel data, and session tokens — detailed in Section 4 and in our Cookie Policy.
  • Conversion events: form submissions, button clicks on call-to-action elements, and course-enquiry completions.

We do not collect special-category data (health, religion, political views, biometric data), financial account details, or government-issued identification numbers unless a specific course-registration requirement explicitly mandates it in the future, in which case we will seek your explicit consent beforehand.

3. Why We Process & Legal Basis

Under GDPR Article 6, we process your personal data on the following legal bases:

  • Contact and enrolment forms: Art. 6(1)(b) — processing is necessary for the performance of a contract or pre-contractual measures at your request (e.g. responding to your enquiry about a barber course, reserving a training spot). Where consent is explicitly requested via the checkbox, Art. 6(1)(a) also applies.
  • Analytics: Art. 6(1)(a) — your consent, collected through our cookie banner before any analytics tracking activates.
  • Marketing and remarketing: Art. 6(1)(a) — your consent, collected before any marketing cookies or pixels are loaded.
  • Security and fraud prevention: Art. 6(1)(f) — our legitimate interest in protecting the Website, our infrastructure, and our users from malicious activity, bot attacks, and unauthorised access.
  • Legal and tax compliance: Art. 6(1)(c) — compliance with a legal obligation, such as maintaining business records required by Spanish tax law (Ley General Tributaria).

Automated Decision-Making (Art. 22): We do not engage in automated decision-making or profiling that produces legal or similarly significant effects on you.

4. Cookies & Tracking

Our Website uses cookies and similar technologies, categorised as follows. A full table of individual cookies, their purposes, and lifespans is available in our Cookie Policy.

Essential Cookies (no consent required, always active):

  • _site_session — maintains your browsing session. Retention: session.
  • cookie_consent — stores your cookie-consent choice. Retention: 12 months.

Analytics Cookies (consent required):

  • Google Analytics 4 with IP anonymisation enabled. Data retention: 14 months.
  • _ga — GA4 user identifier. Retention: 2 years.
  • _ga_XXXXXXXXXX — GA4 session state (10-character measurement ID). Retention: 2 years.

Marketing Cookies (consent required):

  • _gcl_au — Google Ads conversion linker. Retention: 90 days.
  • _fbp — Meta Pixel browser identifier. Retention: 90 days.
  • _fbc — Meta Pixel click identifier (set when a click ID is present). Retention: 90 days.

Beyond cookies, we may use pixel tags (gtag.js, Meta Pixel) and server-side event transmission via Meta Conversion API or Google server-side Google Tag Manager. Hashed identifiers may be transmitted for conversion-matching purposes.

5. Consent (EEA/UK)

Users in the European Economic Area and the United Kingdom receive a consent notice under GDPR and UK GDPR respectively. Marketing and analytics cookies activate only after explicit, informed, freely given consent (Art. 6(1)(a)). Consent is recorded in the cookie_consent browser cookie, which persists for 12 months.

You may withdraw your consent at any time by clicking "Manage Cookie Preferences" in the footer of any page, or by clearing your browser cookies. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.

6. Sharing With Advertising & Service Partners

We may share certain personal data with the following categories of third-party service providers, solely for the purposes described:

  • Google LLC (Google Analytics 4, Google Ads, Google Tag Manager, Remarketing): cookie IDs, usage data, conversion events, remarketing lists. Google's privacy policy: policies.google.com/privacy
  • Meta Platforms, Inc. (Meta Pixel, Custom Audiences, Lookalike Audiences, Conversion API): page views, conversion events, audience membership, hashed identifiers. Meta's privacy policy: facebook.com/privacy/policy
  • Cloudflare, Inc. (CDN and security services): IP-based threat detection and DDoS mitigation. Cloudflare's privacy policy: cloudflare.com/privacypolicy/

We do not sell personal data. These providers may not use data received from our Website for their own independent commercial purposes beyond the services they deliver to us.

7. International Transfers

Some of our service providers (Google, Meta, Cloudflare) are headquartered in the United States, which the European Commission has not universally deemed adequate for data protection. To safeguard your data during these transfers, we rely on the following mechanisms:

  • EU-US Data Privacy Framework (DPF), effective since July 2023 — our primary transfer mechanism for certified US companies.
  • UK Extension to the DPF for transfers subject to UK GDPR.
  • Swiss-US DPF where applicable.
  • Standard Contractual Clauses (EU Commission Implementing Decision 2021/914) as a fallback mechanism.
  • UK International Data Transfer Agreement (IDTA) as a fallback for UK GDPR transfers.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected:

  • Contact and enrolment submissions: 2 years from your last interaction with us.
  • Analytics data: 14 months (Google Analytics 4 configuration).
  • Marketing cookies: as per individual cookie lifetimes (see Section 4).
  • Email correspondence: duration of the business relationship plus 1 year.
  • Server logs: 90 days.
  • Cookie consent records: 3 years (for audit and compliance purposes).
  • Legal and tax records: as required by Spanish law, typically 6 years for accounting records (Código de Comercio Art. 30) and up to 10 years for tax documentation.

9. Your Rights Under GDPR & UK GDPR

You have the following rights regarding your personal data. To exercise any of these rights, email us at [email protected]. We will respond within 30 days (extendable by 60 days for complex requests, with notice).

  • Right of Access (Art. 15): obtain confirmation of whether we process your data and, if so, receive a copy.
  • Right to Rectification (Art. 16): correct inaccurate or incomplete data.
  • Right to Erasure (Art. 17): request deletion of your data when it is no longer necessary for the purposes for which it was collected, or when you withdraw consent.
  • Right to Restriction (Art. 18): request that we limit the processing of your data in certain circumstances.
  • Right to Data Portability (Art. 20): receive your data in a structured, commonly used, machine-readable format and transmit it to another controller.
  • Right to Object (Art. 21): object to processing based on legitimate interests, including profiling.
  • Right to Withdraw Consent (Art. 7(3)): withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
  • Right to Lodge a Complaint (Art. 77): file a complaint with a supervisory authority. For Spain, the lead supervisory authority is the Agencia Española de Protección de Datos (AEPD) — aepd.es.

10. Children

This Website is not directed at individuals under 16 years of age. We do not knowingly collect personal data from minors. If we discover that we have inadvertently collected data from a child under 16 without verifiable parental consent, we will delete it promptly. If you believe a minor has submitted personal data to us, please contact us immediately at [email protected].

11. Do Not Track

This Website does not respond to "Do Not Track" (DNT) browser signals. Third-party providers may have their own DNT handling; please refer to their individual privacy policies for details.

12. Account & Data Deletion

To request the deletion of all personal data we hold about you, send an email to [email protected] with the subject line "Data Deletion Request". We will complete the deletion within 30 days of verifying your identity. Limited retention may continue only where required by law (e.g. tax records under Spanish legislation).

13. Business Transfers

In the event of a merger, acquisition, asset sale, financing, or insolvency, personal data may be transferred to a successor entity as part of the transaction. We will notify users via a prominent notice on the Website if such a transfer materially changes how your data is used. Any successor entity will be bound by the terms of this Privacy Policy until a revised policy is published and communicated.

14. California Residents (CCPA / CPRA)

If you are a California resident, the following disclosures apply under the California Consumer Privacy Act as amended by the California Privacy Rights Act.

Categories of personal information disclosed in the preceding 12 months:

  • Identifiers (name, email, IP address, device IDs) → disclosed to service providers and advertising partners.
  • Internet or other electronic network activity information (pages visited, click paths, referral data) → disclosed to analytics and advertising providers.
  • Inferences (interests, preferences derived from usage) → disclosed to advertising partners for audience targeting.

We do not sell personal information as defined by the CCPA. We do share personal information for cross-context behavioural advertising; California residents may opt out of this sharing via our cookie preferences panel available in the footer of every page.

Your California rights: Right to Know, Right to Delete, Right to Correct, Right to Opt-Out of sale or sharing, Right to Non-Discrimination. To submit a request, email us at [email protected] with the subject "California Privacy Request". Identity verification is required. Authorised agents must provide written proof of authorisation.

15. Virginia Residents (VCDPA)

If you are a Virginia resident, you have the following rights under the Virginia Consumer Data Protection Act: Right to Access, Right to Correct, Right to Delete, Right to Data Portability, and Right to Opt-Out of targeted advertising. To submit a request, email us with the subject "Virginia Privacy Request".

We do not sell personal data or engage in profiling that produces legal or similarly significant effects. If your privacy request is refused, you may appeal by emailing us with the subject "Appeal of Refusal — Privacy Request". We will respond within 60 days. If the matter remains unresolved, you may contact the Virginia Attorney General.

16. Nevada Residents

Nevada residents may submit a verified opt-out request by emailing us at [email protected] with the subject "Nevada Do Not Sell Request". We do not currently sell personal information as defined under Nevada Revised Statutes Chapter 603A.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or business operations. Material changes will be announced via a banner on the Website at least 14 days before they take effect. The "Last Updated" date at the top of this page will be refreshed with every revision. We encourage you to review this page periodically.

18. Contact Us

If you have any questions about this Privacy Policy, your personal data, or wish to exercise any of your rights, please contact us:

RH Sales Hunters SL
Calle Corazón de María 70
28002 Madrid, Spain
Email: [email protected]
Phone: +34 917 684 230