Privacy and cookies

1. Who is responsible

Sergio Berruetta Di Maggio. Pamplona, Navarra, Spain. Contact for privacy questions and data protection rights: jobs@serber.info.

2. What data I use and why

• Professional enquiries. The form asks for your name, email and message. Company is optional. I use this data to read, answer and follow up on your enquiry or employment opportunity. The legal basis is my legitimate interest in handling professional communications that you initiate (GDPR Art. 6(1)(f)). I do not use messages for newsletters or advertising campaigns.
• Operation and security. Hosting and spam protection process technical data such as IP addresses, browser information and requests. Cloudflare Turnstile uses technical signals to distinguish people from bots. The Worker receives the form and verifies the Turnstile token with the IP address. Submission limits use a keyed fingerprint of the IP, not a raw IP in the counter. This is pseudonymisation, not anonymity. The legal basis is the legitimate interest in keeping the site available and preventing spam and abuse (GDPR Art. 6(1)(f)).
• Optional statistics. Only if you accept, Google Analytics 4 measures visits and interactions, such as page views, approximate origin, device and the form submission event. It can distinguish browsers using cookie identifiers. I do not send it the form's name, email, company or message. I do not enable Google Signals or advertising personalisation. The legal basis is your consent (GDPR Art. 6(1)(a)).

I do not make automated decisions that have legal or similarly significant effects on you. Do not include sensitive data, identity documents or confidential information about others in your message. The form cannot be processed without the required fields or a successful spam check. You can also contact me through the profiles linked from the portfolio, subject to each platform's terms. Rejecting Analytics does not prevent you from using the site or contact form.

3. Providers and international transfers

These providers are involved in hosting, security, sending or receiving email and, when you accept, statistics:

• Hostinger: web hosting and email mailbox. Data processing terms.
• Cloudflare, Inc.: form Worker, security counters and Turnstile. Turnstile privacy. Data processing terms.
• Resend (Plus Five Five, Inc.): delivery of your form message to my mailbox. The service stores data in the United States. Data processing terms. Security and retention.
• Google Ireland Limited / Google LLC: Analytics, only with your consent. Privacy. Data processing terms.

Some providers or subprocessors may process data outside the European Economic Area, including in the United States. Their terms provide safeguards such as the European Commission's Standard Contractual Clauses and, where applicable to the recipient, adequacy decisions such as the EU-US Data Privacy Framework. The links above explain those safeguards. You can request information or a copy of the applicable safeguards at jobs@serber.info. Data may also be disclosed to authorities where legally required.

Links to GitHub, LinkedIn, Hack The Box and other sites are not embedded widgets. If you follow them, the destination applies its own privacy policy.

4. How long data is kept

• Messages and replies: for the duration of the conversation and no more than 6 months after it ends. If a legal obligation or the defence of a claim requires keeping particular data, I will restrict its use to that purpose for the applicable period.
• Worker submission counters: expire one hour after their last update. Resend states that email and log data is retained for 30 days on standard plans. Workers logs have a maximum retention period of 7 days. Providers may keep recovery backups or their own records under their terms for the periods necessary to deliver, secure and recover the service or comply with legal obligations.
• Analytics: cookies last up to 2 years and may be renewed on visits while valid consent exists. For a standard property, Google allows user-level and event-level data retention of 2 or 14 months, depending on its settings. That limit does not apply to aggregated statistical reports. Withdrawing consent stops future measurement in this browser but does not itself erase data already sent to Google. You can request erasure where applicable. Google's retention information.

5. Your rights

You can request access, rectification, erasure and restriction of processing. You can object to processing based on legitimate interests on grounds relating to your particular situation and request portability where applicable. You can withdraw Analytics consent at any time without affecting the lawfulness of earlier processing. Contact me at jobs@serber.info.

I will normally respond within one month. I will only ask for additional identification if needed to verify the request. You can also lodge a complaint with the Spanish Data Protection Agency (AEPD).

6. Cookies and browser storage

Not all storage requires permission: remembering a preference you choose or protecting a requested function has a different purpose from measuring visits. On this site:

• theme, lang (first-party local storage): remember the theme and language you choose. They remain until you clear the site's storage. They are not analytics or advertising.
• analytics (first-party local storage): stores your acceptance or rejection, its date and the information version for no more than 12 months of validity. You are asked again when it expires or the information changes materially. An expired record may remain in the browser until overwritten or cleared, but no longer authorises Analytics.
• _ga, _ga_… (Google Analytics cookies on this domain): distinguish browsers and sessions for statistical purposes. Up to 2 years. Used only after acceptance.

Cloudflare Turnstile loads as you approach or interact with the form and performs technical spam checks independently of Analytics. It is not used for advertising. An exemption from consent for technical elements does not remove the duty to explain personal data processing. More about Turnstile.

You can accept or reject Analytics in the notice, using equivalent options. To review or withdraw your decision, use Cookies at the bottom of this page or the portfolio. Rejecting blocks further measurement and deletes accessible _ga cookies on this domain. You can also clear cookies and storage through your browser settings. The choice applies to this browser, not all your devices.