Privacy and Cookie Policy

1. Who is responsible

The controller of any personal data collected through this site is Alfonso Bilbao, owner of ALFONSOBILBAO.DEV, publishing here in a personal capacity and on a non-profit basis.

Contact address for anything related to this policy: alfonsobilbao@protonmail.com.

2. What data is processed, why, and on what legal basis

2.1. Server logs

The web server records every request it receives. That record contains your IP address, the date and time, the address requested, the response code, the browser you are using and, if you arrived through a link, the referring page.

• Purpose: keeping the service running, diagnosing errors and detecting abusive access or attack attempts.
• Legal basis: the controller's legitimate interest in the security and correct operation of the site (Article 6(1)(f) GDPR).
• Retention: logs rotate automatically and are kept for no more than 30 days. They are not cross-referenced with any other information, nor used to identify anyone.

2.2. Email

If you write to me, I process your address and the content of your message for the sole purpose of replying. The legal basis is your own consent in starting the conversation, and I keep the message for as long as the exchange remains relevant or a legal obligation requires it.

2.3. Nothing else

This site has no forms, no user registration, no comments, no newsletter, no shopping cart and no payment gateway. There is no other point at which you could hand over personal data.

3. Cookies

The public pages of this site set no cookies at all. None first-party, none third-party, none analytical, none advertising. You can check this yourself in your browser's developer tools: no response includes a Set-Cookie header.

The administration panel, used only by the site owner, does use two technical cookies — sessionid and csrftoken — needed to keep the session alive and protect it against request forgery. They are exempt from the consent requirement under Article 22.2 of the Spanish LSSI-CE, and they are never set while browsing the public pages.

That is why you will not see a cookie banner: there would be nothing to consent to, and showing one would mean asking your permission for something that does not happen.

4. Third parties and international transfers

None. Everything this page loads is served from this same server: fonts, stylesheets and scripts are hosted here, not on a content delivery network. That is a deliberate decision: loading a font from a Google server would hand Google your IP address on every visit, and that is a transfer of personal data to a third party outside the European Economic Area.

No international data transfers take place, and there are no processors beyond the services strictly needed to host the site.

The content does link to external sites (repositories, technical documentation, professional networks). Following one of those links takes you away from here and puts you under that destination's privacy policy, over which I have no control.

5. No advertising, no profiling, no commercial purpose

This is worth stating plainly, because it is the opposite of what most sites do: no data is collected here for advertising purposes. There are no ads, no behavioural profiles are built, no automated decisions are made about anyone, and data is never sold, rented or handed to any company.

This site is a professional portfolio and a lab notebook: its purpose is to publish technical work, not to monetise visitors.

6. Security

Traffic between your browser and this site is encrypted: all connections are redirected to HTTPS.

Access to the administration panel is restricted and password-protected. Server logs are stored on the machine itself and are not synchronised with any external service.

7. Your rights

The GDPR gives you the right to request access to your personal data, its rectification or erasure, the restriction of its processing, the portability of the data, and to object to processing based on legitimate interest.

In practice, and since there are no user accounts here, the only thing that could concern you is your IP address inside the server logs for the period stated above. To exercise any of these rights, write to alfonsobilbao@protonmail.com stating what you are requesting; I will reply within one month at the latest.

If you believe your data is not being handled in accordance with the regulation, you may lodge a complaint with the Spanish Data Protection Agency, the supervisory authority for this site.

8. Minors

This site is not aimed at children under fourteen and does not knowingly collect their data. Since there is no form and no registration, there is no route through which they could provide any.

9. Changes to this policy

If the site changes in a way that affects this policy — for instance, if it ever gains a contact form or a measurement tool — I will update this text and the date shown above. The full history of changes is public in the project's repository, because this page lives in the site's source code rather than in a database.