Contact

Privacy Policy

Last updated: September 5, 2026

This Privacy Policy explains how Álvaro Ortega Escot ("I", "me", "my") collects, uses, and protects your personal data when you visit alvaroortegaescot.com or contact me through the website.

I take your privacy seriously. I only collect the minimum data needed to respond to you and provide my services.

1. Who I am (Data Controller)

I operate as an independent freelance professional (trabalhador independente) registered in Portugal.

2. What data I collect

Data you provide voluntarily (contact form)

When you use the contact form on this website, I collect:

  • Name (required)
  • Email (required)
  • Website URL (optional)
  • Service interest (required)
  • Message content (optional)

Data collected automatically

  • Technical logs from the hosting provider (Cloudflare Pages): IP address, browser type, timestamps. Used only for security and to serve the website. Not linked to your identity.
  • Cookieless analytics (Cloudflare Web Analytics): aggregate, anonymous visit data. No cookies, no personal tracking. Active for every visitor.
  • Google Analytics 4: only if you accept analytics cookies. Collects pages viewed, session duration, device, browser, approximate country derived from your IP, and traffic source. Google Consent Mode v2 is implemented: until you accept, no analytics cookie is written and no identifier is stored.

I do NOT use advertising cookies, retargeting pixels or social media trackers.

Full detail of every cookie in the Cookie Policy.

3. How I use your data

Your data is used ONLY for these purposes:

  • To respond to your contact form submission
  • To provide the services you have requested
  • To fulfill legal obligations (invoicing, tax records)
  • To understand how the website is used and improve it

I will never:

  • Sell your data to third parties
  • Send you marketing emails without your explicit consent
  • Share your information with anyone not directly involved in the service

4. Legal basis for processing (GDPR Article 6)

  • Consent (Art. 6.1.a): when you submit the contact form
  • Consent (Art. 6.1.a GDPR and Art. 5 of Portuguese Law 41/2004): for analytics cookies. You can withdraw it at any time without affecting the lawfulness of prior processing
  • Contract performance (Art. 6.1.b): when we work together as client and provider
  • Legal obligation (Art. 6.1.c): for invoicing and tax records in Portugal
  • Legitimate interest (Art. 6.1.f): for security logs and for cookieless analytics, which collects no data capable of identifying you

5. Third-party processors

To operate this website and respond to you, I use these processors, all bound by a data processing agreement under Article 28 GDPR:

  • Cloudflare, Inc. — hosting (Cloudflare Pages), cookieless analytics, DNS and email routing. See cloudflare.com/privacypolicy
  • Web3Forms (Web3Creative) — contact form processing. Operates from India, with infrastructure on AWS. Uses CleanTalk as a spam-prevention sub-processor, which may receive the IP address and email address of form submitters. Transfers from the EEA are made under Standard Contractual Clauses. See web3forms.com/privacy
  • Google Ireland Ltd. / Google LLC — Google Analytics 4, only with your consent. Processed in Ireland with transfer to the United States. See Google's Privacy Policy

6. Data retention

  • Contact form submissions: kept for up to 24 months in my inbox, unless we start a professional relationship (in which case they're kept as long as legally required for tax records — 10 years in Portugal)
  • Form submissions on Web3Forms' servers: 30 days, after which they are automatically deleted. This is separate from the period above, which refers to the copy that reaches my inbox
  • Technical logs: kept for up to 30 days
  • Google Analytics data: 14 months, the maximum available in the free tier. After that, user-level data is deleted automatically
  • Cookieless aggregate analytics: kept indefinitely (cannot identify you)

7. International data transfers

Some processors handle data outside the European Economic Area.

Google is certified under the EU-US Data Privacy Framework, recognised as providing an adequate level of protection by European Commission decision of 10 July 2023.

Web3Forms operates from India and is not covered by an adequacy decision. Transfers from the EEA are made under the European Commission's Standard Contractual Clauses, as set out in their Data Processing Agreement.

Cloudflare may process data in multiple regions under equivalent safeguards.

8. Your rights under GDPR

You have the right to:

  • Access your personal data
  • Rectify incorrect data
  • Erase your data (right to be forgotten)
  • Restrict processing
  • Object to processing
  • Data portability
  • Withdraw consent at any time
  • Manage your cookie preferences at any time from the Cookies link in the footer
  • File a complaint with the Portuguese Data Protection Authority (CNPD): cnpd.pt

To exercise any of these rights, email me at hello@alvaroortegaescot.com. I will respond within 30 days.

9. Security

I take reasonable technical and organizational measures to protect your data:

  • HTTPS-only communications
  • Data stored in secure, GDPR-compliant infrastructure
  • Access to your data limited to me only
  • No unnecessary data collection

10. Children

This website is not directed to children under 16. I do not knowingly collect data from minors.

11. Changes to this policy

I may update this Privacy Policy from time to time. The date at the top of the page will always reflect the last update. Substantial changes will be highlighted here.

12. Contact

For any questions about privacy or data protection:

13. Related documents