Privacy policy
Last updated: 3 August 2026
This policy explains what personal data is processed when you visit javimagaldi.com, for what purpose, on what legal basis, and what you can do about it.
1. Data controller
- Owner: Javier García Magaldi (Magaldidev)
- Tax ID: 72178446F
- Address: Federico Vial 1A 1ºB, 39009 Santander, Cantabria, España
- Contact and data-rights requests: magaldi6@gmail.com
- Website: https://javimagaldi.com
No Data Protection Officer has been appointed: the processing carried out does not meet the thresholds of Article 37 GDPR.
2. What data is processed and why
| Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Contact form | Name, email address, service type and message content | Reply to your enquiry and, where relevant, prepare a quote | Consent and pre-contractual steps (Art. 6(1)(a) and 6(1)(b) GDPR) | 12 months from the last contact, unless a contract or legal duty applies |
| Virtual assistant (chatbot) | The content of the messages you type; IP address for abuse limiting | Answer questions about the portfolio and prevent abuse of the service | Consent when starting the conversation and legitimate interest in security (Art. 6(1)(a) and 6(1)(f) GDPR) | Messages are not stored on this site; the IP is held in volatile memory for at most 1 minute |
| Web analytics (Google Analytics 4) | Cookie identifiers, anonymised IP, pages viewed, language, approximate device | Measure traffic and understand which content is of interest | Consent (Art. 6(1)(a) GDPR and Art. 22.2 of Spanish Law 34/2002) | Up to 14 months |
| Cookieless analytics (Vercel Analytics and Speed Insights) | Aggregated visit and performance metrics; no cookies or persistent identifiers | Know the volume of visits and the real speed of the site | Legitimate interest in maintaining and improving the site (Art. 6(1)(f) GDPR) | Up to 25 months in aggregated form |
| Error monitoring (Sentry) | Error message, browser, operating system, URL and technical stack trace. The PII option is disabled | Detect and fix site failures | Legitimate interest in security and correct operation (Art. 6(1)(f) GDPR) | 90 days |
| Session replay (Sentry Session Replay) | Reconstruction of your browsing: clicks, scrolling and page changes | Reproduce the exact context of an error | Consent (Art. 6(1)(a) GDPR) | 90 days |
| Weather widget | Geolocation coordinates, only if you accept the browser permission | Show the weather forecast for your location | Consent given in the browser itself (Art. 6(1)(a) GDPR) | Not stored: used in the request and discarded |
| Hosting and server logs | IP address, date and time, user agent, requested resource | Serve the website and keep it secure | Legitimate interest (Art. 6(1)(f) GDPR) | As per Vercel's retention policy (30 days by default) |
Fonts are served from this same domain, so no request is made to Google servers when the page loads.
3. Processors and third parties involved
The following providers take part in delivering the service, each under its own data processing agreement:
| Provider | Service | Location |
|---|---|---|
| Vercel Inc. | Hosting, cookieless analytics and Speed Insights | USA (Data Privacy Framework) |
| Google Ireland Ltd. / Google LLC | Google Analytics 4 | EU with transfers to the USA (Data Privacy Framework) |
| Functional Software, Inc. (Sentry) | Error monitoring and session replay | EU data region (Germany) |
| Groq, Inc. | Language model powering the chatbot | USA |
| Web3Forms | Email delivery of contact form submissions | As per the provider; see their policy |
| OpenStreetMap Foundation and CARTO | Map tiles in the Travels section | EU / USA |
| Open-Meteo | Weather data | EU (Germany) |
| GitHub, Inc. | Public repository statistics | USA (Data Privacy Framework) |
| Cloudinary | Image delivery | USA (Data Privacy Framework) |
When maps, images or data from these services load, your IP address is technically visible to them. No data is disclosed to third parties for purposes other than those described, and none is sold.
4. International transfers
Some providers are established in the United States. Those transfers rely on the EU-US Data Privacy Framework, on standard contractual clauses approved by the European Commission, or on both, depending on the provider. You can request information about the applicable safeguards by writing to the contact address.
5. Using the virtual assistant
What you type into the chatbot is sent to a language model hosted by Groq, Inc. to generate the reply. Do not enter third-party personal data, credentials, confidential information or special category data (health, beliefs, sexual orientation or others under Art. 9 GDPR). If you need to discuss something like that, email me instead.
6. Your rights
You can exercise the following rights by writing to magaldi6@gmail.com, stating the right you are exercising and proving your identity:
- Access to the data processed about you.
- Rectification of inaccurate data.
- Erasure once the data is no longer necessary.
- Objection to processing based on legitimate interest.
- Restriction of processing in the cases provided by law.
- Portability of the data you provided.
- Withdrawal of consent at any time, without retroactive effect.
You will get a reply within one month at the latest. If you believe the processing does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid — www.aepd.es).
7. Minors
This site is not aimed at children under 14 and no data about them is knowingly collected. If you notice otherwise, tell me at the contact address and it will be deleted.
8. Security
The site is served entirely over HTTPS and reasonable technical measures are in place to protect information. No system is infallible: if you find a vulnerability, tell me before disclosing it.
9. Changes to this policy
If the tools or purposes change, this policy will be updated and the date in the header amended. Where a change affects consent-based processing, consent will be requested again.