Alex de Pablos

Privacy policy

Last updated: 14 September 2026.

1. INFORMATION FOR THE USER

Alejandro de Pablos López, as Data Controller, informs you that, in accordance with Regulation (EU) 2016/679 of 27 April (GDPR) and Spanish Organic Law 3/2018 of 5 December on data protection and digital rights (LOPDGDD), your personal data will be processed as described in this Privacy Policy.

This Privacy Policy describes how we collect your personal data and why, what we do with it, who we share it with, how we protect it, and your choices regarding its processing.

2. CONTACT

Name: Alejandro de Pablos López Trading name: Alex de Pablos Email: alex@alexdepablos.com

3. KEY PRINCIPLES

  • Lawfulness: We only collect your personal data for specific, explicit and legitimate purposes.
  • Data minimisation: We limit data collection to what is strictly relevant and necessary for the purposes it was collected for.
  • Purpose limitation: We only collect your data for the declared purposes and according to your wishes.
  • Accuracy: We keep your personal data accurate and up to date.
  • Data security: We apply technical and organisational measures proportionate to the risks to protect your data against unauthorised access, disclosure, accidental or unlawful destruction, loss or alteration.
  • Access and rectification: You can access or rectify your data whenever you consider it appropriate.
  • Retention: We keep your personal data lawfully and only for as long as necessary for the purposes it was collected for.
  • International transfers: If your data is transferred outside the EU/EEA, it will be adequately protected.
  • Third parties: Access to and transfer of personal data to third parties follows applicable laws and regulations, with appropriate contractual guarantees.
  • Direct marketing and cookies: We comply with applicable advertising and cookie legislation.

4. COLLECTION AND PROCESSING OF YOUR PERSONAL DATA

The types of data that may be requested and processed are:

  • Identifying data (e.g., name and email when you use the contact form or subscribe to the newsletter).

Data about your visit is also collected automatically: pages viewed, referrer, language and device type. This is done with Matomo running on a server rented from Hetzner rather than a third-party service, and without cookies. The IP address is stored with its last two octets masked (for example, 203.0.113.47 is kept as 203.0.0.0). That reduces precision considerably, but it does not make the data anonymous: alongside the user-agent and a timestamp it remains personal data, and it is treated as such. I would rather say that than sell you an anonymity I cannot guarantee. No third-party analytics provider receives this data, and it is used for no advertising purpose and never joined up with your activity on other sites; the infrastructure providers involved are listed in section 6. The detail is in the cookie policy.

Protection against automated submissions

When you submit a contact or newsletter form, Cloudflare Turnstile checks for automated abuse. Cloudflare processes technical signals such as IP address, connection fingerprint, browser information and the website origin. The check may ask you to select a checkbox. We do not include your name, email or message in its challenge metadata.

Our purpose and basis are to protect the requested service and its availability against abuse, under the site owner's legitimate interest. Cloudflare acts as a processor for site protection and separately as a controller when improving its bot detector, as explained in its Turnstile privacy notice  (opens in a new tab). We do not use these signals for audience measurement or advertising. The cookie policy describes the browser-side check.

Whenever we request personal data, we will clearly inform you of what we collect and why. In general, we collect and process your personal data to:

  • Provide information, services and relevant updates.
  • Send communications you have requested.

Contact messages and assisted review

The form collects your name, email, message and language for delivery to the site owner. Messages may also receive assisted review: for that review, the contact is saved in a private inbox hosted on Hetzner and OpenAI, through Codex, may analyse it to identify spam and help prepare a reply. When useful, the analysis consults public professional information relevant to your message. Your submitted email is not treated as verified proof of identity.

Automated assessments can be wrong. Retained messages can be reviewed, and no automatic reply is sent on your behalf. During the initial evaluation, classification does not hide messages from the site owner. The private inbox uses a 30-day retention period for originals and assessments; backup copies expire after seven days. Both use scheduled cleanup, which an outage may delay until the service recovers. Copies received by email and providers' applicable retention are separate from those periods.

Please do not include passwords, confidential documents or sensitive data unnecessary for your enquiry. You can request review or exercise your rights by contacting alex@alexdepablos.com.

5. LEGAL BASIS

In accordance with applicable data protection law, your personal data may be processed when:

  • You have given your consent. You may withdraw it at any time.
  • Required by law.
  • There is a legitimate interest not overridden by your privacy rights (for example, sending information you subscribed to).
  • It is necessary to provide a service under a contractual relationship between you and us.

6. DISCLOSURE OF PERSONAL DATA

Data may be shared with the following technical service providers for the functions described:

  • Vercel Inc: site hosting.
  • Resend: delivery of contact-form and newsletter email.
  • OpenAI: assisted analysis of messages and, when useful, public-source research to help contextualise a reply.
  • Hetzner Online GmbH (Germany): hosting for the private contact inbox and analytics server. "Self-hosted" means the software is mine and no third party monetises it, but the machine is rented, and that is a disclosure worth making.
  • Cloudflare, Inc.: domain DNS, the analytics tunnel and authenticated transport of contacts from Vercel to the private inbox; this traffic crosses its network. It also provides Turnstile for form protection, with the separate roles described above.

No other disclosure will take place except where legally required. In particular, no third-party analytics provider receives this data and none of it is used for advertising.

7. YOUR RIGHTS

Regarding the collection and processing of your personal data, you can contact us at any time to:

  • Access your personal data and any other information indicated in Article 15.1 of the GDPR.
  • Rectify inaccurate or incomplete personal data in accordance with Article 16 of the GDPR.
  • Erase your personal data in accordance with Article 17 of the GDPR.
  • Restrict the processing of your personal data in accordance with Article 18 of the GDPR.
  • Request data portability in accordance with Article 20 of the GDPR.
  • Object to the processing of your personal data in accordance with Article 21 of the GDPR.

If you have given consent for a specific purpose, you have the right to withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal.

You can exercise these rights by sending a reasoned and accredited request to alex@alexdepablos.com.

You also have the right to lodge a complaint with the competent supervisory authority if you consider that the processing does not comply with current legislation.

8. LEGAL INFORMATION

The requirements of this Policy complement, and do not replace, any other requirement under applicable data protection law, which prevails in any case.

This Policy is subject to periodic review and may be modified at any time. When that happens, you will be notified of any changes and asked to review the most recent version.