The short version
These two sites are my portfolio. You won't find ads or tracking cookies here. I get personal data from you when you write to me, through the contact form or by email. I use it to reply, and I don't sell it or share it for marketing.
Who is responsible
I am: Sérgio Azevedo, based in Porto, Portugal. For the purposes of the EU General Data Protection Regulation (GDPR) I'm the data controller for both sites. For anything about your data, write to [email protected].
What is collected, and why
| When | What | Why and legal basis |
|---|---|---|
| You open any page | Your IP address, browser details, the page you asked for and the time. Cloudflare, which hosts both sites, processes this. | To deliver the page and block attacks and abuse. Legitimate interest in running a secure website (GDPR Art. 6(1)(f)). |
| You open any page | Cloudflare Web Analytics counts page views, the referring site, country, browser type and page speed. It sets no cookies, uses no local storage and builds no profile of you. I see totals, nothing per person. | To know which pages people read and whether the sites are fast. Legitimate interest (Art. 6(1)(f)). |
| You send the contact form on work.sergioazevedo.pt | Your name, email address and message. Formspree receives them and forwards the message to my inbox. | To answer you and, if it comes to that, discuss a project. Steps you asked for before a possible contract (Art. 6(1)(b)), or legitimate interest in replying (Art. 6(1)(f)). |
| You email me | Your email address, the message and anything you attach. My email provider, Zoho Mail, stores them. | Same as the contact form. |
| You click the light/dark switch | One cookie called theme holding the word "light" or "dark". It lasts a year and is shared between the two sites. | To remember a setting you chose. The site sets it when you click and not before. Because the feature needs it to work, the law doesn't require a consent banner for it. |
You don't have to give me anything to use the sites. If you want a reply, I need an email address to send it to.
Who else handles it
- Cloudflare, Inc. (USA): hosting, content delivery, security and Web Analytics. Cloudflare is certified under the EU-U.S. Data Privacy Framework and also signs the EU Standard Contractual Clauses. Cloudflare's privacy policy.
- Formspree, Inc. (USA): receives contact form messages and passes them to me. Transfers out of the EU rely on the EU Standard Contractual Clauses. Formspree's privacy policy.
- Zoho (EU data centre): hosts my mailbox at [email protected], so email you send me is stored in the EU. Zoho's privacy policy.
Nobody else gets your data unless the law requires it.
I serve the fonts from my own sites and the videos from my own storage, so opening a page doesn't contact Google or any other outside service. Links to LinkedIn, ArtStation and YouTube are plain links: nothing loads from them until you click, and after that their own privacy policies apply.
How long I keep it
- Messages and emails: until the conversation is over, and at most two years after our last exchange. If we end up working together, I keep what the contract and Portuguese tax rules require (invoices, for example, for ten years).
- Formspree keeps a copy of form submissions in my Formspree account. I delete them there on the same schedule.
- Cloudflare's security logs and analytics data follow Cloudflare's own retention periods. I see aggregated numbers that don't identify you.
- The theme cookie: one year, or until you clear it.
Your rights
Under the GDPR you can ask me to:
- tell you what data I hold about you and send you a copy;
- correct anything that's wrong;
- delete it;
- limit how I use it, or stop using it where I rely on legitimate interest;
- give it to you, or to someone else, in a common format.
Email [email protected] and I'll answer within one month. It's free. I may ask you to confirm who you are before I hand anything over.
If you think I've mishandled your data, you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), or to the authority in the EU country where you live. I'd appreciate the chance to fix it first, but you don't need my permission.
Profiling and children
I don't sell or rent data, and I don't use it for profiling or for automated decisions about you. I don't aim the sites at children.
Changes
If the way the sites handle data changes, for example a new form or a new provider, I'll update this page and the date at the top.