What I collect and what I don’t

Who is responsible

Diego Portilla Tejería, in a personal capacity, from Cantabria (Spain). For anything to do with your data — including asking me to delete it — the channel is the email address in the footer of this page.

Cookies: none, except one

If you are reading this site, you are carrying none. None of my own, none from third parties. That is why you will not see a banner asking for permission: a cookie notice on a site with no cookies is noise that gets clicked through without reading, and it teaches people to click through the ones that do matter.

The exception does not affect you, and I am telling you anyway, because a policy that stays quiet about the awkward part is worth nothing. The CV page publishes a single version, the public one; the other two — an anonymous one and an internal one — open by typing a password only I have, and on success the server leaves a cookie called cv_pase that expires after thirty days. Inside there is a date and its signature, nothing else: it says nothing about who, it measures nothing, and it travels to no third party. It asks for no consent because it is strictly necessary for a feature that is expressly requested — by typing that password — and without that it never happens. So that nobody tries passwords in bulk, the server counts attempts from the same connection using the same cryptographic fingerprint as the form, and only for as long as that half hour lasts.

The only thing this site stores in your browser is a key called kw-theme holding light or dark, so it remembers whether you picked the light theme. It is never sent anywhere, it identifies nobody, and it disappears if you clear your browser data. If you ever unlock the non-public versions of the CV, kw-cv joins it, and all it notes is when that unlock expires.

Analytics

I use Cloudflare Web Analytics to know which pages get read. It sets no cookies and creates no identifier that follows you between visits: the data is aggregated and cannot be used to reconstruct one person’s path.

Separately, when someone downloads a CV I get a notification with the version and the language. Nothing else: not who, not from where, not with which browser. Knowing that three English CVs were downloaded today is useful to me; knowing who downloaded them is not.

Legal basis: legitimate interest in knowing whether what I publish gets read and works, using processing that cannot identify you.

The contact form

This is where personal data does appear, and it is what you type: your name, your email and your message. I collect it for one purpose, replying to you, which is why the consent box is mandatory and not pre-ticked.

One detail worth knowing, because it is not what you would assume: the alert telling me you have written arrives over Telegram, so your message passes through their servers as well as reaching me. There is no form database and no dashboard where submissions pile up — there is that alert, in a chat of mine. If you would rather your message did not go through there, write to the address in the footer instead.

To slow down automated spam, the server counts how many submissions arrive from the same connection within the last ten minutes. To do that it does not store your IP, but a cryptographic fingerprint of it that lives in memory and is discarded when that window closes.

Legal basis: your consent, which you may withdraw at any time by writing to me. Retention: for as long as the conversation lasts and a reasonable period after; if you ask me to delete it, I delete it.

Who else is involved

Two, and no others:

• Cloudflare — hosts the site and provides the analytics. Like any server, it logs the requests it receives in order to operate and to defend against abuse.
• Telegram — carries the notifications, so it sees the contents of the form. It only comes into play if you write; if you simply read the site, Telegram never learns you exist.
• The typefaces are hosted on this domain on purpose. Loading them from Google Fonts, which is the usual approach, would have sent your IP to Google on every visit; they were downloaded once and are served from here.

Your rights

You can ask me for access to whatever I hold about you, for it to be corrected or deleted, object to the processing, or ask me to restrict it. An email is enough, and you do not need to justify yourself. If you think I have not handled it properly, you can complain to the Spanish Data Protection Agency (aepd.es).

In practice, if you wrote through the form and want everything deleted, say so in reply to my email and it is done.