Privacy policy
What personal data this website handles, why, and what you can do about it.
1. Who is responsible for your data
- Controller
- David Estrada Sardaña
- Tax ID (NIF)
- 79166381J
- Address
- Mijas (Málaga), Spain. Full postal address available on request by email.
This policy follows the General Data Protection Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on data protection (LOPDGDD).
2. The short version
This website has no forms, no accounts and no advertising. It only measures visits, with Google Analytics and with a simple counter of its own, and only if you accept. If you write to me by email, I use your message to answer you. I do not sell your data or use it to build profiles.
3. What data is handled, why, and on what legal basis
When you visit the website
The hosting provider records technical data from each request (IP address, date and time, the page requested, browser and device) in its server logs, to deliver the website and keep it secure. The legal basis is my legitimate interest in running a secure website (art. 6.1.f GDPR). These logs are kept by the hosting provider for a limited period.
Analytics, only if you accept
If you accept analytics cookies, Google Analytics 4 collects data about your visit: online identifiers stored in cookies, pages viewed, how long you stay, the website you came from, your approximate location (country and city, never your exact position), and your browser and device. I use it only to understand in aggregate how the website is used and improve it. The legal basis is your consent (art. 6.1.a GDPR), which you can withdraw at any time from “Cookie settings” at the bottom of every page. User-level and event data is kept in Google Analytics for 14 months. Advertising features and Google signals are switched off. If you do not accept, Google Analytics is not loaded at all.
The website’s own visit counter, only if you accept
If you accept analytics, each page you see also sends a short note to this website’s own server: which page it was, whether it opens a new visit, the website you came from (its domain only) and the kind of device (computer, tablet or phone, worked out from the width of the screen). It stores the mark de-visit in your browser’s session storage, which disappears when you close the tab, to tell a new visit from the next page of the same one. Nothing else is kept: no IP address, no identifier, no cookies. The server only adds them up into daily totals per page, so a visit can never be traced back to a person. The legal basis is your consent (art. 6.1.a GDPR), the same one you give for Google Analytics, and you can withdraw it the same way. The daily totals are kept for as long as the website exists.
When you write to me by email
If you email me, I handle your name, your email address and whatever you tell me, in order to reply and, if we go ahead, to prepare a proposal. The legal basis is taking steps at your request before entering into a contract (art. 6.1.b GDPR) or, for general enquiries, my legitimate interest in answering them (art. 6.1.f GDPR). I keep these messages for as long as the conversation lasts and for up to one year afterwards. If you become a client, invoicing data is kept for the periods required by tax and commercial law.
Client reviews
The reviews shown here come from my public Upwork profile and identify clients by first name and initial, as Upwork does. The legal basis is my legitimate interest in showing real feedback on my work (art. 6.1.f GDPR). If a review is yours and you want it removed, write to me.
4. Who receives your data
I do not sell or give your data to third parties. These providers handle it on my behalf or in order to deliver the website:
- Hostinger International Ltd. (Cyprus): hosting of the website, in the European Union.
- Google Ireland Limited: Google Analytics 4 and the Google tag that loads it (only if you accept analytics), and Gmail, which I use for email.
- Adobe Systems Software Ireland Limited: Adobe Fonts, which serves one of the typefaces of this website. When a page loads, your browser connects to Adobe’s servers, which necessarily receive your IP address and technical data about the request. Adobe Fonts does not set cookies to serve fonts. The legal basis is my legitimate interest in displaying the website as designed (art. 6.1.f GDPR).
All other files of this website, including its other typefaces and its scripts, are served from the website’s own hosting.
5. Transfers outside the European Economic Area
Google and Adobe may process data in the United States. Both Google LLC and Adobe Inc. are certified under the EU–U.S. Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection, and they also rely on the European Commission’s standard contractual clauses.
6. Your rights
You can ask me at any time to:
- access the personal data I hold about you;
- correct it if it is wrong;
- erase it;
- restrict or object to its processing;
- give it to you in a portable format;
- and you can withdraw a consent you have given, without affecting what was done before.
To do so, write to davidestrada.work@gmail.com saying which right you want to exercise. I will answer within one month. I may ask you for information to confirm your identity.
If you believe your data has not been handled properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or with the supervisory authority of your country.
7. Automated decisions and profiling
I do not make automated decisions about you and I do not build profiles.
8. Children
This website is aimed at businesses and professionals. It is not directed at children under 14, and I do not knowingly collect their data.
9. Security
The website is served over an encrypted connection (HTTPS) and I apply reasonable technical and organisational measures to protect the data I handle.
10. Changes to this policy
If the way this website handles data changes, for example if a new tool is added, I will update this policy and the date at the top.