Privacy policy

1. Who is responsible for your data

This website, martinmalandra.com, belongs to Martín Malandra, a freelance web developer and graphic designer based in Buenos Aires, Argentina. I’m the data controller for the personal data described in this policy. For any question about it, or to exercise your rights, write to martin.malandra@gmail.com.

2. What data I collect

When you use the contact form

I receive your first name, last name, email address and message. If you choose to fill them in, I also receive your agency or company, phone number and the service you’re interested in.

When you write to me by email

I receive your email address and whatever you include in the message.

Usage data, only with your consent

If you accept analytics cookies, Google Analytics 4 collects information about how the site is used: pages visited, time on page, approximate location (country or city), device, browser and the site you came from. Google Analytics 4 doesn’t log or store IP addresses, and I don’t use this information to identify you.

Technical data

Like any website, the hosting provider processes technical data such as your IP address and browser type to deliver the pages and protect the site from abuse.

I don’t ask for sensitive data of any kind.

3. Why I use it and on what legal basis

• Replying to your inquiry and preparing a proposal. Basis: steps taken at your request before entering into a contract, and my legitimate interest in answering business inquiries (GDPR, art. 6(1)(b) and (f)).
• Carrying out the project, if we work together. Basis: performance of a contract (art. 6(1)(b)) and legal obligations such as invoicing and tax records (art. 6(1)(c)).
• Measuring traffic with Google Analytics. Basis: your consent (art. 6(1)(a)), which you can withdraw at any time.
• Hosting and security. Basis: my legitimate interest in keeping the site available and secure (art. 6(1)(f)).

I don’t use your data for automated decision-making or profiling, and I don’t add you to any mailing list.

4. Who processes the data

I work with a few providers that process data on my behalf, only for the purposes above:

• Formspree (Formspree, Inc., United States): receives the contact form and forwards it to my email.
• Google (Google LLC, United States, and Google Ireland Ltd. for visitors in the European Economic Area and the UK): Gmail, my email inbox, and, with your consent, Google Analytics.
• Vercel (Vercel Inc., United States): website hosting.

The links to Upwork, LinkedIn and Instagram lead to sites with their own privacy policies. I don’t share your data with them.

5. I don’t sell your data

I don’t sell your personal data or share it for targeted or cross-context behavioral advertising. Google Analytics is set up with Google signals and ad personalization turned off.

6. International transfers

The providers above are based in, or store data in, the United States. When data from the European Economic Area, the UK or Switzerland is transferred there, it relies on the safeguards these providers offer, such as the EU–US Data Privacy Framework or the Standard Contractual Clauses approved by the European Commission. Your messages are also handled from Argentina, a country recognized by the European Commission as offering an adequate level of data protection.

7. How long I keep it

• Inquiries that don’t turn into a project: deleted one year after our last exchange.
• Clients: for as long as we work together, and afterwards for as long as tax and accounting laws require.
• Analytics: Google Analytics keeps event data for a maximum of 14 months.
• Hosting logs: for the limited time defined by Vercel.

8. Cookies and local storage

The site only sets analytics cookies if you click “Accept analytics” in the cookie notice. You can change your choice at any time from “Cookie settings” in the footer of every page, or delete cookies from your browser settings.

9. Your rights

Depending on where you live, you have some or all of these rights over your personal data:

• Access it and get a copy.
• Correct it if it’s inaccurate or incomplete.
• Have it deleted.
• Restrict or object to its processing.
• Receive it in a portable format.
• Withdraw your consent at any time, without affecting the processing done before.
• Not be treated differently for exercising any of these rights.

To exercise them, write to martin.malandra@gmail.com. I’ll reply within the deadlines set by the applicable law, and in any case within 30 days. I may ask you for information to confirm your identity.

You can also file a complaint with a data protection authority: in Argentina, the Agencia de Acceso a la Información Pública (AAIP); in the European Union, the authority of your country; in the United Kingdom, the Information Commissioner’s Office (ICO).

10. Security

I take reasonable measures to protect your data: the site is served over HTTPS, the providers above apply their own security measures, and only I have access to the accounts where your messages are stored.

11. Children

This site is aimed at businesses and isn’t directed to anyone under 16.

12. Changes to this policy

If this policy changes, I’ll update this page and the date at the top.