Privacy policy
Last updated:
Controller
Víctor Mateu López is the controller of personal data processed through this personal portfolio. Contact is available through the contact form and, where listed above, by email.
Data processed
The contact form collects your name, email address, topic and message, needed to answer your enquiry. Without these fields the enquiry cannot be sent. Do not submit identity documents, health data, passwords or other sensitive information. Infrastructure providers may process IP addresses, browser information, technical logs and signals needed to prevent abuse. If you accept analytics, Vercel also processes visit and performance measurements.
Purposes
To answer enquiries and professional proposals, continue the correspondence you request and protect the form from spam and attacks. Messages are not used for advertising and personal data is not sold. Optional analytics is used to understand visits and improve performance only with your permission.
Legal basis
Enquiries about possible services or contractual relationships are processed to take pre-contractual steps at your request (GDPR Article 6(1)(b)). Other enquiries and abuse prevention rely on legitimate interests in responding to correspondence and protecting this website (Article 6(1)(f)), subject to your right to object. Optional analytics relies on your consent (GDPR Article 6(1)(a)), which you can withdraw at any time without affecting prior lawful processing.
Retention
Ordinary enquiries kept in the owner’s mailbox are retained for no longer than 12 months after the last response, unless you request earlier erasure and there is no overriding reason to retain them. They are reviewed and deleted manually; the website does not automatically delete mailbox messages. If an enquiry leads to a relationship, legal obligations or a dispute, only the relevant data is retained for the applicable period, with access restricted where appropriate. Anti-spam counters linked to an HMAC identifier of the IP expire after 10 minutes; the IP-free global counter expires after 24 hours. The analytics choice stored on your device expires after 180 days. These are distinct from provider logs and backups: Resend documents 30 days for email and log data on standard plans; ImprovMX documents deletion of queued messages after delivery or a permanent failure and 7 days for delivery logs. Technical/account records and backups can have separate provider retention periods.
Providers and recipients
Vercel hosts the website and, after you consent, provides Web Analytics and Speed Insights. Cloudflare Turnstile checks technical signals such as IP address, browser information and TLS fingerprints to prevent automated abuse; it acts as a processor when protecting this site and as a separate controller when improving its bot detection, as described in its own notice. Upstash stores attempt counters and HMAC-derived IP identifiers, which are pseudonymous, not anonymous. Resend delivers contact-form messages to the configured mailbox. Emails sent directly to privacy@victormateulopez.com pass through ImprovMX and are forwarded to Gmail, operated by Google. Each provider’s roles and processing are described in the policies linked below. Data may also be disclosed where legally required.
International processing
These services may process data outside the European Economic Area. Selecting Frankfurt for a function or database does not guarantee EU-only processing. Resend states that stored data is held in the United States; its DPA includes standard contractual clauses. Upstash and Cloudflare also publish contractual transfer safeguards. Their availability does not establish that every account, plan and processing activity is covered by the same agreement. Google describes its consumer Gmail service as distinct from processor services under Google Workspace. You can contact privacy@victormateulopez.com for information about providers and applicable safeguards.
Your rights
You may request access, rectification, erasure, restriction, objection and, where applicable, portability through the contact channels on this page. Additional information will only be requested where needed to verify your identity. Requests are normally answered within one month, subject to legally permitted extensions. You may lodge a complaint with the Spanish Data Protection Agency (AEPD).
Automated decisions
No automated decisions with legal or similarly significant effects or commercial profiling are carried out. Turnstile may assess technical signals to prevent automated submissions; if you cannot use the form, use the published contact email.