Last updated: 25 August 2026
At Glutendtrotters we take your privacy seriously. This policy explains, in plain language, what data we collect, why we use it, who we share it with and what you can do about it, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Act 3/2018 on Data Protection and the Guarantee of Digital Rights (LOPDGDD).
This site is operated from Spain. Wherever you are reading from, the standards described below apply to everyone.
1. Who is responsible for your data
- Data controller: Rita Naboni Romanillo
- Address: Calle Perines, 16, Santander, Cantabria (Spain)
- Email: info@glutendtrotters.com
- Website: glutendtrotters.com
We are not required to appoint a Data Protection Officer, so you can send any privacy question directly to the email address above.
2. Our commitments
- We never sell or rent your personal data.
- We only ask for the data that is strictly necessary for each purpose.
- We do not use your data for purposes other than those explained to you.
- You can exercise your rights at any time, free of charge and without complications.
3. What data we process and why
These are all the processing activities carried out through this website:
3.1. Blog comments
| Data | Name or nickname, email address, website (optional), comment content, IP address and browser details. |
| Purpose | To publish and moderate your comment, reply to you and detect spam. |
| Legal basis | Your consent when submitting the comment (Art. 6(1)(a) GDPR) and our legitimate interest in protecting the site against spam and abuse (Art. 6(1)(f) GDPR). |
| Retention | For as long as the comment remains published. If you ask us to delete it, the associated data is deleted with it. |
| Visibility | Your name and comment are publicly visible. Your email address is never published. |
We use Akismet (Automattic Inc.) to filter spam; it analyses the comment content, the IP address and browser data. A hashed version of your email address may also be sent to Gravatar to display your profile picture if you have an account there.
3.2. Contact form
| Data | Name, email address and the content of your message. |
| Purpose | To answer your question, request or collaboration proposal and keep track of the conversation. |
| Legal basis | Your consent when submitting the form (Art. 6(1)(a) GDPR). |
| Retention | While we handle your enquiry and for up to one year after our last contact, unless a legal obligation requires us to keep it longer. |
We do not use this data to send you marketing, and we will not add you to the newsletter unless you expressly ask us to.
3.3. Newsletter subscription
| Data | Name and email address. Our provider also records technical delivery data and email interaction (opens and clicks). |
| Purpose | To send you blog updates, new articles, recipes and gluten-free travel recommendations. |
| Legal basis | Your express consent when subscribing (Art. 6(1)(a) GDPR and Art. 21 LSSI-CE). |
| Retention | Until you withdraw your consent or unsubscribe. |
Newsletters are sent using Mailchimp (Intuit Inc.). You can unsubscribe at any time using the link at the bottom of every email, or by writing to info@glutendtrotters.com.
3.4. Website analytics
| Data | Cookie identifiers, pages visited, time on page, traffic source, device, browser, language and approximate location derived from your IP address. |
| Purpose | To understand which content is useful and improve the site. Reports are reviewed in aggregate form. |
| Legal basis | Your consent, given through the cookie settings panel (Art. 6(1)(a) GDPR and Art. 22(2) LSSI-CE). |
| Retention | According to each cookie’s lifetime, detailed in our Cookie Policy. Google Analytics reports are retained for a maximum of 14 months. |
We use Google Analytics 4, integrated through the Google Site Kit plugin.
3.5. Advertising
| Data | Advertising identifiers, cookies, IP address, pages visited, ad interactions and, where applicable, inferred interests. |
| Purpose | To display the advertising that keeps this blog running, measure its performance and limit how often the same ad is shown. |
| Legal basis | Your consent, given through the cookie settings panel (Art. 6(1)(a) GDPR and Art. 22(2) LSSI-CE). |
| Retention | According to each cookie’s lifetime and each ad network’s own policies. |
Advertising is served through Google AdSense and Mediavine services, including the Grow recommendation widget. If you do not accept advertising cookies you will still see ads, but they will not be personalised to your profile.
3.6. Site security and operation
| Data | IP address, access logs, login attempts and technical browser data. |
| Purpose | To protect the site against attacks, unauthorised access and spam, and to keep the service available and performing well. |
| Legal basis | Our legitimate interest in the security of our systems (Art. 6(1)(f) GDPR). |
| Retention | Technical logs are kept for a maximum of 12 months. |
Our hosting provider, the Cloudflare content delivery network and brute-force protection tools are involved in these tasks.
3.7. Browsing preferences
We store basic preferences such as your chosen language (Spanish or English) and your cookie preferences, so we do not have to ask you on every visit. The legal basis is the technical necessity of delivering the service you requested and, for the consent record, compliance with a legal obligation.
4. Do you have to give us your data?
No. You can read the whole blog without providing any identifying data. Data is only needed if you want to comment, contact us or subscribe to the newsletter; in those cases, not providing it means we cannot deliver that particular service.
5. Who we share your data with
We do not disclose your data to third parties except where legally required. We do work with service providers who access it in order to provide their service to us, acting as data processors under a contract that complies with Article 28 GDPR:
| Provider | Service | Location |
|---|---|---|
| Hostinger International Ltd. | Web and email hosting | European Union |
| Cloudflare, Inc. | Content delivery network and security | USA / global |
| Google Ireland Ltd. and Google LLC | Analytics, advertising and web fonts | EU / USA |
| Automattic Inc. | Anti-spam (Akismet) and profile images (Gravatar) | USA |
| Intuit Inc. (Mailchimp) | Newsletter delivery | USA |
| Mediavine, Inc. | Advertising and recommendation widget | USA |
In addition, if you interact with embedded third-party content (videos, maps, social media posts), those platforms may collect data on their own account and under their own privacy policies.
6. International transfers
Some of our providers are located in the United States. These transfers rely on:
- The adequacy decision for the EU-US Data Privacy Framework, where the provider is certified under it.
- The European Commission’s Standard Contractual Clauses, together with supplementary measures, in all other cases.
You can request further information about the safeguards in place by writing to info@glutendtrotters.com.
7. Automated decision-making and profiling
We do not make automated decisions that produce legal effects concerning you or similarly significantly affect you.
You should know, however, that if you accept advertising cookies, ad networks may build interest profiles in order to show you personalised ads. You can prevent this by rejecting those cookies in the settings panel, which will not affect your access to any content.
8. How long we keep your data
We keep each type of data for the period set out in section 3 and, in any case, only for as long as it is necessary for the purpose that justified collecting it. After that, it is deleted or anonymised, unless it must be kept blocked in order to address potential legal liabilities during the applicable limitation periods.
9. Your rights
As a data subject you may exercise the following rights, free of charge:
- Access: find out what data of yours we process and obtain a copy.
- Rectification: correct inaccurate or incomplete data.
- Erasure: ask us to delete your data when it is no longer necessary.
- Restriction: ask us to suspend processing in certain circumstances.
- Portability: receive your data in a structured, commonly used format.
- Objection: object to processing based on our legitimate interest.
- Withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.
To exercise them, write to info@glutendtrotters.com stating which right you wish to exercise. We will reply within one month, extendable to two if the request is complex. We may ask you to verify your identity if there is reasonable doubt about who is making the request.
If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid — www.aepd.es), or with the supervisory authority of the EU country where you live or work. We would be grateful for the chance to resolve it with you first.
10. Children
The features that require personal data (comments, contact and newsletter) are intended for people aged 14 and over, in accordance with Article 7 of the LOPDGDD. If we become aware that we have collected data from a child below that age without parental consent, we will delete it. If you are a parent or guardian and believe this has happened, please write to us and we will resolve it immediately.
11. Data security
We apply appropriate technical and organisational measures to protect your data: HTTPS encryption across the whole site, regular backups, access controls, security updates and protection against automated attacks.
No system is completely secure. If a personal data breach occurred that posed a high risk to your rights, we would inform you and notify the supervisory authority within the legally prescribed deadlines.
12. Cookies
This site uses first-party and third-party cookies. You can find the full detail, and manage or withdraw your consent, in our Cookie Policy.
13. Changes to this policy
We may update this policy to reflect legal changes or new services on the site. The last-updated date appears at the top of this document. If a change materially affects your rights, we will let you know prominently.
