Privacy notice
Last updated: 17 October 2026
The short version: I collect what you put in the contact form so I can reply to you. I don’t sell it, I don’t use it for advertising, and this site doesn’t use tracking cookies. You can ask me to see, correct or delete your data at any time by emailing ryan@pioneerpmm.com.
The rest of this page is the detail the law asks for, under the EU General Data Protection Regulation (GDPR) and Spain’s data protection law (Ley Orgánica 3/2018, LOPDGDD).
Who is responsible for your data
The data controller is:
- Name: Ryan Woodley-Mitchell, self-employed (autónomo) in Spain, trading as Pioneer PMM (Pioneer Product Marketing)
- NIF/NIE: Z3047127T
- Address: Hermanos Otamendi kalea 11, 20014 Donostia–San Sebastián, Gipuzkoa, Spain
- Email: ryan@pioneerpmm.com
Pioneer PMM is a one-person business, so there is no Data Protection Officer. Write to me directly.
What I collect
When you use the contact form:
- your name, work email and company
- your role, your company’s revenue band, what you’re launching, when, and what you’re most interested in (all chosen from lists)
- anything else you choose to tell me, and how you heard about Pioneer (both optional)
- that you ticked the consent box, and when
Sent automatically with the form:
- the page you sent it from, and any campaign tags in the link that brought you here (utm_source, utm_medium, utm_campaign)
- the time you sent it, and your IP address, which HubSpot receives because your browser sends the form directly to HubSpot
When you book a call: the name and email address you give on Google’s booking page, the time you choose and anything you add to the booking.
When you email me: your email address, your message and anything in it.
Please don’t send sensitive information (for example about health) through the form. I don’t need it.
Why I use it, and on what legal basis
| What I do with it | Legal basis |
|---|---|
| Read and reply to your enquiry, and arrange a call if you want one | Steps you’ve asked for before a possible contract (GDPR art. 6(1)(b)), and my legitimate interest in answering business enquiries (art. 6(1)(f)) |
| Keep a record of our conversation and your business contact details, if we keep talking or work together | Legitimate interest in managing business relationships (GDPR art. 6(1)(f); LOPDGDD art. 19). For clients, our contract (art. 6(1)(b)) |
| Sort my replies. A simple rule flags enquiries that look like a fit (revenue band, what and when you’re launching) so I answer them first. It changes the order of my inbox, nothing else. I read every message myself | Legitimate interest (art. 6(1)(f)) |
| See which pages and links bring in enquiries, using the page and campaign tags | Legitimate interest (art. 6(1)(f)) |
| Keep the form free of spam and abuse | Legitimate interest in security (art. 6(1)(f)) |
| Invoicing, tax and accounting, if you become a client | Legal obligation (art. 6(1)(c)) |
Where I rely on legitimate interest, I’ve weighed it against your rights: you’re contacting a business about business, I only use what you sent, and you can object at any time.
I won’t add you to a mailing list or send you marketing emails unless you ask me to.
Who else handles it
I don’t sell or rent your data. These service providers process it on my behalf, under data processing agreements, and only to provide their service:
- HubSpot (HubSpot, Inc. and HubSpot Ireland Ltd): CRM and contact form. When you send the form, your browser sends what you entered directly to HubSpot, to its EU data centre, rather than through a server of mine. HubSpot stores enquiries and contact records.
- Cloudflare (Cloudflare, Inc.): hosts the website and delivers it securely.
- Google (Google Ireland Ltd and Google LLC): Google Workspace, for email and documents, and Google Calendar appointment booking. The “Book a 30-minute call” button takes you to Google’s own booking page, where you give your name and email address to book. Google’s privacy policy applies on that page.
If you become a client, I also share what’s needed with my accountant (gestoría) for invoicing and tax. I’ll share data with public authorities only where the law requires it.
Transfers outside the European Economic Area
HubSpot, Cloudflare and Google are US companies, so your data may be processed in the United States. HubSpot may transfer data outside the EEA under its Standard Contractual Clauses and its certification under the EU–US Data Privacy Framework. Cloudflare and Google rely on the same safeguards. You can ask me for more detail at ryan@pioneerpmm.com.
How long I keep it
- Enquiries that don’t lead to work: 12 months after our last contact, then deleted.
- Clients: for as long as we work together, then for as long as Spanish tax and commercial law require (accounting records for six years), and no longer.
If you ask me to delete your data, I’ll do it sooner, unless the law says I must keep something.
Your rights
You can ask me to:
- access the data I hold about you, and get a copy
- correct anything that’s wrong or out of date
- delete it
- object to my using it, including for any purpose based on legitimate interest
- restrict how I use it while we sort out a question about it
- move it: get it in a common, machine-readable format, or have it sent to someone else (portability)
To use any of these, email ryan@pioneerpmm.com and say which right you’re using. It’s free. I’ll reply within one month. If a request is complex I may need up to two more months, and I’ll tell you if so. If I can’t be sure the request comes from you, I may ask you to confirm who you are.
If you’re unhappy with how I’ve handled your data, you can complain to Spain’s data protection authority, the Agencia Española de Protección de Datos (AEPD), at www.aepd.es or C/ Jorge Juan 6, 28001 Madrid. I’d appreciate the chance to put it right first.
Cookies and similar technology
This site uses no advertising or tracking cookies.
- Cloudflare may set strictly necessary cookies to keep the site secure and tell people from bots (for example
__cf_bm). The site can’t work safely without them, so they don’t need your consent. - Campaign tags. If you arrive through a link with campaign tags (utm_…), the site keeps them in your browser’s session storage until you close the tab, so they can go with the form if you send it. This isn’t a cookie, and it never leaves your device unless you send the form.
- Fonts are served from this site, not from Google Fonts, so no font request goes to Google.
- Other sites. Links to LinkedIn and Substack (The Go-To-Market Brief) are plain links that open those sites in a new tab. Nothing from them is embedded here, so they set no cookies on this site; once you’re on their pages, their own cookies and privacy policies apply.
- HubSpot receives form submissions directly from your browser, through its forms API, at its EU data centre. No HubSpot script or tracking cookie runs on this site, and sending the form sets no cookies.
- Booking a call. The “Book a 30-minute call” button is a plain link to Google Calendar’s booking page, which opens in a new tab. The calendar isn’t embedded here, so no Google cookies are set on pioneerpmm.com. Google’s page may set its own cookies under Google’s privacy policy.
Changes to this notice
I’ll update this notice when anything changes, for example a new service provider or a change in the business’s legal form. The date at the top shows the latest version.