01Who I am
This website is operated by Nurriel Robaine Mamaril, trading as Nurriel M. & Co., a sole practitioner providing executive assistance and operations support services, based in the Republic of the Philippines (“I”, “me”, “my”).
I am the data controller in respect of personal data collected through this website. If you are in the European Economic Area or the United Kingdom, this means I decide why and how your personal data is processed.
This policy explains what personal data I collect when you visit nurrielmamaril.xyz or contact me through it, how I use that data, and the rights available to you.
02Information I collect
Information you give me
I do not operate accounts, logins or payment processing on this website. The only personal data you actively provide is what you choose to include when you contact me:
- Email enquiries. When you use an “Email me” link or the contact form, your own mail client opens a message addressed to me. Nothing is sent until you send it. On sending, I receive your email address, your name if your client supplies it, and whatever you write.
- Discovery calls. If you book a call, you are taken to a third-party scheduling service, which collects your name, email address, selected time and any notes you add, and shares them with me so the meeting can be held.
- Resume requests. If you request my resume, I receive the details you include in that email, which may include your company and the role or engagement you have in mind.
Information collected automatically
- Analytics data. Aggregated, non-identifying statistics about visits: pages viewed, approximate country, referring site, device type and browser. This is collected without cookies and is not used to identify you or to build a profile.
- Server and security logs. My hosting provider records technical data required to deliver and protect the site, including IP address, request time, requested URL and user agent.
I do not collect special category data, I do not knowingly collect personal data from children, and I do not use this website for advertising, retargeting or profiling.
03How and why I use it
| Purpose | Data used |
|---|---|
| Replying to your enquiry | Email address, name, message contents |
| Arranging and holding a discovery call | Name, email address, booking details |
| Sending my resume on request | Email address, name, company |
| Negotiating and performing an engagement | Contact and business details you provide |
| Understanding which pages are useful | Aggregated analytics data |
| Keeping the site available and secure | Server and security logs |
| Meeting legal, tax and accounting obligations | Records relating to engagements |
I do not sell personal data, I do not share it for cross-context behavioural advertising, and I do not use it to make automated decisions that produce legal or similarly significant effects.
04Legal bases for processing
Where the UK GDPR or EU GDPR applies to you, I rely on the following legal bases:
- Legitimate interests (Article 6(1)(f)) — responding to enquiries, keeping the site secure and available, and understanding in aggregate how it is used. My interest is in operating and improving a professional services website; I have considered this against your interests and rights and consider it proportionate given the limited data involved.
- Steps prior to entering a contract, and performance of a contract (Article 6(1)(b)) — discussing, agreeing and delivering services to you.
- Legal obligation (Article 6(1)(c)) — retaining records required by tax and accounting law.
- Consent (Article 6(1)(a)) — only where I ask for it separately, and which you may withdraw at any time without affecting earlier processing.
06International transfers
I am based in the Philippines and my service providers are largely based in the United States. If you are in the EEA or the UK, your personal data will therefore be transferred outside your home jurisdiction.
Where that happens, I rely on appropriate safeguards, which in practice means the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where relevant) as incorporated into my providers’ terms, together with the technical and organisational measures described in section 9. You may ask me for further detail about the safeguards in place using the contact details below.
07How long I keep it
- Enquiries that do not become engagements — up to 24 months from our last exchange, then deleted.
- Engagement correspondence and records — for the duration of the engagement and then as required by applicable tax, accounting and limitation rules, typically up to 10 years.
- Booking records — up to 24 months from the meeting.
- Server and security logs — the short retention period operated by my hosting provider, typically no more than 30 days.
- Aggregated analytics — retained in aggregate form only; it does not identify you.
Where I no longer need personal data, I delete it or irreversibly anonymise it.
08Your rights
Depending on where you live, you may have some or all of the following rights:
- Access — to be told whether I hold personal data about you, and to receive a copy.
- Rectification — to have inaccurate or incomplete data corrected.
- Erasure — to have data deleted where there is no overriding reason to keep it.
- Restriction — to limit how I use your data in certain circumstances.
- Objection — to object to processing carried out on the basis of legitimate interests.
- Portability — to receive data you provided in a structured, commonly used, machine-readable format.
- Withdraw consent — where processing is based on consent, at any time.
- Complain — to a supervisory authority. In the Philippines this is the National Privacy Commission; in the UK the Information Commissioner’s Office; in the EEA the authority for your country of residence.
If you are a California resident, you additionally have the rights to know, delete and correct personal information, and to opt out of sale or sharing. I do not sell or share personal information as those terms are defined under the CCPA/CPRA, and I will not discriminate against you for exercising any right.
To exercise any right, email me using the details in section 12. I will respond within 30 days, and will tell you if I need longer and why. I may ask you to confirm your identity before acting, which is a safeguard for you rather than an obstacle.
09Security
I maintain technical and organisational measures appropriate to the limited personal data I hold. These include encryption in transit (HTTPS across the whole site), multi-factor authentication on the accounts used to run my practice, a password manager rather than reused credentials, access limited to me alone, and reputable providers with their own security programmes.
No method of transmission or storage is completely secure, and I cannot guarantee absolute security. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, I will notify the relevant supervisory authority and, where required, you, without undue delay.
10Children
This website offers professional services to businesses and is not directed at children. I do not knowingly collect personal data from anyone under 18. If you believe a child has provided me with personal data, contact me and I will delete it.
11Changes to this policy
I may update this policy to reflect changes to my practice, my providers or the law. The “last updated” date at the top will always show the current version. Where a change materially affects how your personal data is used, I will take reasonable steps to bring it to your attention. Continuing to use the site after an update means you accept the revised policy.
12Contact
For any question about this policy, or to exercise a right, contact:
Nurriel Robaine Mamaril
Nurriel M. & Co.
Email: nurrielrobainemamaril@gmail.com
Philippines
See also my Cookie Policy and Terms of Service.