Rohan Saraf RS monogram
ENES

Privacy

Privacy policy

Last updated:

This page explains, in plain language, what personal data rohansaraf.com collects, why, who sees it and what your rights are. It follows the EU General Data Protection Regulation (GDPR) and the Spanish Organic Law 3/2018 (LOPDGDD).

1. Who is responsible

The controller of your personal data is Rohan Saraf, an independent marketing consultant based in Barcelona, Spain. You can reach him about anything in this policy at rohan.c2@gmail.com.

2. What data we collect, why and on what basis

  • Contact and registration form (/contact). Data: your name, email, company (optional), what you are interested in, your message, the site language and the page you sent it from. Purpose: to reply to you and, if you ask, to register you for an event or answer a question about the Bootcamp or the Complimentary ROAS Audit. Basis: steps taken at your request before a contract (Art. 6(1)(b) GDPR) and, for general enquiries, our legitimate interest in answering the people who write to us (Art. 6(1)(f)).
  • Complimentary ROAS Audit request form (a Google Form embedded on the home page). Data: whatever you type into it. Purpose: to review your request and get back to you. Basis: steps at your request before a contract (Art. 6(1)(b)). Google operates the form, see section 4.
  • Emails, WhatsApp, SMS or calls you start with Rohan. Data: your contact details and what you tell us. Purpose: to answer you. Basis: legitimate interest (Art. 6(1)(f)) or, once you ask about working together, steps before a contract (Art. 6(1)(b)).
  • Paid events. If you pay through the secure payment link (Stripe), Stripe handles your card details; Rohan does not see them and receives only the payment confirmation (such as name, email and amount). Basis: performing the contract (Art. 6(1)(b)) and legal accounting and tax obligations (Art. 6(1)(c)).
  • Clients. If you become a client, we process the data needed to perform and invoice the work. Basis: contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c)).
  • Security and anti-spam. Our hosting provider records technical request data (your IP address, browser type, the page requested and the time) in server logs, and the contact form has a hidden field that only bots fill in, so that spam can be dropped. Purpose: to keep the site secure, available and protected from abuse. Basis: legitimate interest (Art. 6(1)(f)).

Giving us your data is voluntary, but we cannot reply to a request, send you anything or register you for an event without the details that the relevant form marks as required.

3. Cookies and local storage

This site does not use analytics, advertising, tracking or social-media cookies or pixels, and it does not profile visitors. Because of that, there is no cookie banner.

  • Theme preference. If you switch between the light and dark theme, your browser stores your choice (theme) in its local storage so the site remembers it. It stays on your device, is not sent to us and you can clear it at any time in your browser settings.
  • Third-party content. The only third-party content embedded in the site is the Google Form on the home page. When it loads, Google receives your IP address and may set its own cookies under its own privacy policy. Links to other sites (LinkedIn, WhatsApp, Stripe and others) only send data to those sites if you click them. Fonts and images are served from this site itself.

4. Who we share data with

We do not sell your data and we do not share it for advertising. We use a small number of service providers (processors) that handle data on our behalf:

  • Vercel Inc.: website hosting and server logs.
  • FormSubmit (formsubmit.co): relays the contact form to Rohan's email inbox.
  • Google: Gmail, which receives the contact form emails and the emails you send to Rohan, and Google Forms, which runs the audit request form.
  • Stripe: payments for paid events, if you choose to pay (Stripe is responsible for its own payment processing).

We may also disclose data where the law requires it, for example to tax or judicial authorities.

5. International transfers

Some of these providers are based in, or process data in, the United States or other countries outside the European Economic Area. Where that happens, the transfer relies on an adequacy decision (such as the EU–US Data Privacy Framework, for providers certified under it) or on the European Commission's Standard Contractual Clauses. You can ask us for details of the safeguards at rohan.c2@gmail.com.

6. How long we keep data

  • Enquiries and leads (contact form, audit request and emails): up to 24 months from your last contact or ask us to delete them, whichever comes first. After that they are deleted.
  • Client, payment and invoicing records: for as long as tax, accounting and commercial law require.
  • Server logs: a limited period set by our hosting provider.
  • Theme preference: until you clear your browser storage.

7. Your rights

You have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected (rectification);
  • have your data deleted (erasure, or the right to be forgotten);
  • restrict how we use it;
  • receive it in a portable, machine-readable format;
  • object to processing based on legitimate interest;
  • withdraw your consent at any time, where processing is based on consent. Withdrawing does not affect the lawfulness of what we did before.

To exercise any of these rights, email rohan.c2@gmail.com and say what you would like. We will reply within one month, at no cost to you. We may need to confirm your identity before we act on a request.

8. Complaints

If you think we have handled your data unlawfully, please tell us first so we can put it right. You also have the right to lodge a complaint with the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), at www.aepd.es, or with the authority in your own EU country.

9. Automated decisions, age and security

  • No automated decision-making. We do not make decisions about you based solely on automated processing or profiling.
  • Minimum age. This site and its forms are for people aged 16 or over. If you are under 16, please do not send us your data. If we learn that we hold the data of someone under 16, we will delete it.
  • Security. The site is served over HTTPS and access to the data we receive is limited to Rohan and the providers listed above.

10. Changes to this policy

If we change how we handle personal data, we will update this page and the date at the top. Last updated: 26 October 2026.