The short version
These two sites are my portfolio. There are no ads. Google Analytics cookies are only set if you click Accept on the cookie banner, and you can change your mind at any time with the Cookie settings link at the bottom of every page. I get personal data from you when you write to me, through the contact form or by email. I use it to reply, and I don't sell it or share it for marketing.
Who is responsible
I am: Sérgio Azevedo, based in Porto, Portugal. For the purposes of the EU General Data Protection Regulation (GDPR) I'm the data controller for both sites. For anything about your data, write to [email protected].
What is collected, and why
| When | What | Why and legal basis |
|---|---|---|
| You open any page | Your IP address, browser details, the page you asked for and the time. Cloudflare, which hosts both sites, processes this. | To deliver the page and block attacks and abuse. Legitimate interest in running a secure website (GDPR Art. 6(1)(f)). |
| You open any page | Cloudflare Web Analytics counts page views, the referring site, country, browser type and page speed. It sets no cookies, uses no local storage and builds no profile of you. I see totals, nothing per person. | To know which pages people read and whether the sites are fast. Legitimate interest (Art. 6(1)(f)). |
| You click Accept on the cookie banner | Google Analytics 4 records the pages you view, how you got here, your rough location (city or country), device and browser type, and how long you stay. It sets the cookies _ga and _ga_<id>, which hold a random ID and last up to two years. Google signals and ad features are off, so none of this is used for advertising. | To see which work people read and where they come from. Your consent (Art. 6(1)(a)). Click Decline, or do nothing, and the Google script never loads. |
| You click Accept or Decline on the cookie banner | One cookie called consent holding "granted" or "denied". It lasts 180 days and is shared between the two sites. | To remember your answer so the banner doesn't come back on every page. The banner can't work without it, so it doesn't need consent of its own. |
| You send the contact form on work.sergioazevedo.pt | Your name, email address and message. Formspree receives them and forwards the message to my inbox. | To answer you and, if it comes to that, discuss a project. Steps you asked for before a possible contract (Art. 6(1)(b)), or legitimate interest in replying (Art. 6(1)(f)). |
| You email me | Your email address, the message and anything you attach. My email provider, Zoho Mail, stores them. | Same as the contact form. |
| You click the light/dark switch | One cookie called theme holding the word "light" or "dark". It lasts a year and is shared between the two sites. | To remember a setting you chose. The site sets it when you click and not before. Because the feature needs it to work, the law doesn't require a consent banner for it. |
You don't have to give me anything to use the sites. If you want a reply, I need an email address to send it to.
Who else handles it
- Cloudflare, Inc. (USA): hosting, content delivery, security and Web Analytics. Cloudflare is certified under the EU-U.S. Data Privacy Framework and also signs the EU Standard Contractual Clauses. Cloudflare's privacy policy.
- Google Ireland Ltd (Ireland) and Google LLC (USA): Google Analytics, only if you accept. Google LLC is certified under the EU-U.S. Data Privacy Framework and also signs the EU Standard Contractual Clauses. Google's privacy policy.
- Formspree, Inc. (USA): receives contact form messages and passes them to me. Transfers out of the EU rely on the EU Standard Contractual Clauses. Formspree's privacy policy.
- Zoho (EU data centre): hosts my mailbox at [email protected], so email you send me is stored in the EU. Zoho's privacy policy.
Nobody else gets your data unless the law requires it.
I serve the fonts from my own sites and the videos from my own storage, so opening a page doesn't contact Google or any other outside service. The one exception is Google Analytics, and only after you click Accept. Links to LinkedIn, ArtStation and YouTube are plain links: nothing loads from them until you click, and after that their own privacy policies apply.
How long I keep it
- Messages and emails: until the conversation is over, and at most two years after our last exchange. If we end up working together, I keep what the contract and Portuguese tax rules require (invoices, for example, for ten years).
- Formspree keeps a copy of form submissions in my Formspree account. I delete them there on the same schedule.
- Cloudflare's security logs and analytics data follow Cloudflare's own retention periods. I see aggregated numbers that don't identify you.
- Google Analytics data: 14 months, then Google deletes it. The
_gacookies last up to two years, and clicking Decline under Cookie settings removes them. - The consent cookie: 180 days. After that the banner asks again.
- The theme cookie: one year, or until you clear it.
Your rights
Under the GDPR you can ask me to:
- tell you what data I hold about you and send you a copy;
- correct anything that's wrong;
- delete it;
- limit how I use it, or stop using it where I rely on legitimate interest;
- give it to you, or to someone else, in a common format;
- withdraw your consent to analytics. Use the Cookie settings link at the bottom of any page and click Decline. It doesn't undo what was collected before.
Email [email protected] and I'll answer within one month. It's free. I may ask you to confirm who you are before I hand anything over.
If you think I've mishandled your data, you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), or to the authority in the EU country where you live. I'd appreciate the chance to fix it first, but you don't need my permission.
Profiling and children
I don't sell or rent data, and I don't use it for profiling or for automated decisions about you. I don't aim the sites at children.
Changes
If the way the sites handle data changes, for example a new form or a new provider, I'll update this page and the date at the top.