Privacy

Short version: this site sets no cookies and does not track you. I only see anonymous statistics on how often each page is visited. I only receive personal data when you write to me, book a time or we work together. For that I use a few established services, each under a data processing agreement.

Who is responsible

Josep Oriol Ulaszewski Ylla, Calle Renoir 3, 35017 Las Palmas de Gran Canaria, Spain. NIF 53998583B. Contact: hello@ulasz.com.

This website

The site is static and is served by Cloudflare. No cookies are set and no tracking scripts are loaded. Cloudflare processes technically necessary data such as your IP address to deliver the site and protect it from abuse. Legal basis: legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). I don't analyse that data.

Visitor statistics: I use Cloudflare Web Analytics. A small script measures page views, referring page, country, device type and loading time. It sets no cookies, stores nothing on your device and builds no profiles; I only see aggregated numbers, never individual people. Legal basis: legitimate interest in understanding which content is used and how fast the site loads (Art. 6(1)(f) GDPR).

When you write to me

I receive your email address and your message and use them only to reply and, if we work together, to organise our sessions. My mailbox runs on Google Workspace (business account). Legal basis: steps prior to a contract, or the contract itself (Art. 6(1)(b) GDPR). Enquiries that don't lead to working together are deleted no later than 12 months after the last contact.

Please don't send health information in your first email. We can talk about what matters in the call.

When you book a time

You book through my Google Calendar. I process your name, email address, the time you choose and, if you fill it in, your answers in the booking form. You receive a confirmation with a Google Meet link for the video call. Calls are not recorded.

Paid sessions are paid at booking through Stripe. Stripe processes your payment details (e.g. card) and is itself responsible for part of that processing, such as fraud prevention and legal obligations. From Stripe I only receive your name, email address, amount and date, never card details. Stripe only learns that a session was booked and paid for, never anything about its content. Legal basis: contract (Art. 6(1)(b) GDPR).

When we work together

I keep session notes, because continuity is part of the service. They are stored in my Google Workspace account, protected by two-factor authentication; only I have access. Everything you tell me is covered by my professional secrecy as a psychologist. The only exceptions are those provided by law, such as a serious risk to life or health, or a court order.

Legal basis: contract (Art. 6(1)(b) GDPR). Where notes contain information about your health, I process it only with your explicit consent (Art. 9(2)(a) GDPR), which you give with the consent form before the first session and can withdraw at any time. The details are in that consent form.

If your company pays for the sessions, it only learns what is on the invoice.

Invoices

For invoices I process your name, address or company details, date and amount. Legal basis: legal obligation (Art. 6(1)(c) GDPR). My accountant receives only these invoice details.

How long data is kept

• Enquiries that don't lead to working together: up to 12 months after the last contact.
• Session notes and the signed consent form: 5 years after the last session (the limitation period for contractual claims in Spain), or earlier on request unless I need them to defend legal claims.
• Invoices: 6 years (Spanish commercial and tax law).

Recipients and transfers outside the EU

As processors under contract: Google (Google Workspace: email, calendar, Meet, documents; contracting entity Google Cloud EMEA Ltd., Ireland), Stripe (Stripe Payments Europe Ltd., Ireland) and Cloudflare (website). These providers may also process data in the United States. Such transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework and, additionally, on standard contractual clauses. Beyond that I don't share data, except where the law requires it.

Your rights

You can ask for access, correction, deletion, restriction or portability of your data, object to processing and withdraw any consent at any time by writing to hello@ulasz.com. You can also complain to the Spanish data protection authority (Agencia Española de Protección de Datos, aepd.es).

Without contact details I can't arrange a session; everything else is voluntary. There is no automated decision-making or profiling.

Last updated: September 2026.