Privacy policy

This privacy policy applies to santiagoporcel.com, including the Spanish-language pages under /es/. The German-language website santiagoporcel.de runs on different infrastructure and has its own privacy policy. German law and the GDPR apply.

01General information

The protection of personal data matters to me. I process personal data confidentially and in accordance with the applicable data protection law and this privacy policy.

Below you will find information on which personal data is collected when this website is visited, for what purposes this data is processed, and which rights you have as a data subject.

02Controller

Controller for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR):

A data protection officer is not required and has not been appointed. Enquiries about data protection can be sent to the address above.

03Hosting and content delivery

This website is operated on Cloudflare Workers, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. The German subsidiary is Cloudflare Germany GmbH, c/o Design Offices München Atlas, Rosenheimer Straße 143C, 81671 Munich, Germany. Cloudflare also provides the DNS, the TLS certificate and the protection against attacks for this domain.

When the website is accessed, Cloudflare processes technically necessary access data, in particular your IP address, the date and time of access, the page requested and information about your browser and operating system. This data is needed to deliver the website and to protect it against attacks and misuse.

Legal basis: Art. 6(1)(f) GDPR. My legitimate interest is the secure and reliable provision of this website.

Cloudflare processes this data as a processor (Art. 28 GDPR). The basis is Cloudflare's Data Processing Addendum, which forms part of Cloudflare's terms. Cloudflare operates a global network, so processing can also take place outside the European Economic Area, including in the United States. For such transfers Cloudflare uses the standard contractual clauses of the European Commission and states that it complies with the EU-U.S. Data Privacy Framework. Further information: cloudflare.com/privacypolicy and cloudflare.com/cloudflare-customer-dpa

I have switched off Cloudflare's invocation logs for this website, so no request logs are kept on my side. Only my own error messages are recorded, and these contain no content from the contact form.

04Cookies

No cookies are set for web analytics, tracking or marketing, and no tools of that kind are used. There is therefore no cookie banner.

Cloudflare's protection mechanisms can set technically necessary cookies, in particular __cf_bm for bot detection, which expires after 30 minutes without activity, and cf_clearance as proof that a security check was passed. According to Cloudflare these cookies are strictly necessary in order to provide the service, they are generated separately for each website and they are not used to recognise users across websites or sessions.

Legal basis: section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), as these cookies are strictly necessary to provide the service you have expressly requested, together with Art. 6(1)(f) GDPR. Consent is therefore not required.

05Contact form

If you send me an enquiry using the contact form, I process the information you enter (name, email address, optionally company and topic, and your message). In addition, the time of the enquiry, the language version of the form and, where available, the page of this website from which you opened the form are transmitted. The information is used solely to handle and answer your enquiry.

The form is processed in a Cloudflare Worker (see section 03) and forwarded directly as an email to my mailbox at Microsoft 365 (see section 06). I do not operate a database or any other store for the form data on this website.

To protect against spam and misuse, the number of enquiries that can be sent from one IP address within a minute is limited to a small number. For this purpose a pseudonymised value of your IP address (a SHA-256 hash with a secret additional value) is passed to Cloudflare's rate limiting service together with the time of the enquiry. The IP address itself is not stored for this purpose and is not transmitted with the email. The counters expire after one minute. No captcha service is used. A hidden field serves as a spam trap; if it is filled in, nothing is sent.

Legal basis: Art. 6(1)(b) GDPR insofar as your enquiry relates to a contract or to pre-contractual measures, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). Art. 6(1)(f) GDPR applies to the spam protection.

The data is deleted as soon as your enquiry has been dealt with conclusively and no statutory retention obligations prevent deletion.

06Contact by email and email mailbox

If you contact me by email, the personal data you transmit (in particular your name, email address and the content of your message) is processed solely for the purpose of handling and answering your enquiry.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual or contractual measures).

For email, including enquiries from the contact form, I use Microsoft 365. The emails are stored and processed there. Microsoft processes the data as a processor (Art. 28 GDPR). The basis is Microsoft's Data Protection Addendum, which forms part of the contractual terms for Microsoft 365. Microsoft's contact for the European Economic Area is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

Processing in the United States cannot be ruled out. Microsoft Corporation participates in the EU-U.S. Data Privacy Framework and additionally uses the standard contractual clauses of the European Commission for transfers to third countries. Further information: privacy.microsoft.com

The data is deleted as soon as your enquiry has been answered conclusively and no statutory retention obligations prevent deletion.

07Booking a conversation

On the contact page you can book a conversation directly via a link. Booking runs through the service zcal, provided by zcal, Inc., 9800 Centre Pkwy, Houston, TX 77036, USA. Data is only transmitted to zcal once you open the link. When you make a booking, zcal processes the information you enter there and the appointment you select, as well as technical data such as your IP address.

Booked appointments are transferred into my calendar at Microsoft 365 (Outlook, see section 06). Depending on what we agree, the conversation takes place by phone, via Microsoft Teams (also Microsoft 365, see section 06) or via Google Meet.

For a conversation via Google Meet, your participation data (in particular your name, where applicable your email address, your IP address and audio and video data during the conversation) is processed by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing in the United States by Google LLC cannot be ruled out. Google LLC participates in the EU-U.S. Data Privacy Framework. Further information: policies.google.com/privacy

The information is used to arrange and hold the conversation. Legal basis: Art. 6(1)(b) GDPR.

zcal processes this data as a processor (Art. 28 GDPR). The basis is zcal's Data Processing Addendum, which forms part of zcal's terms of use. The data is processed in the United States. For the transfer, the Data Processing Addendum provides for the standard contractual clauses of the European Commission. Further information: zcal.co/privacy

08No tracking and no advertising

No web analytics, tracking or marketing tools are used on this website. No profiles are created and no data is passed on for advertising purposes.

Should this change in future, this privacy policy will be amended accordingly and, where required, consent will be obtained.

09Fonts

The fonts used on this website are loaded from this website's own address. No data is transmitted to third parties such as Google for this purpose.

10Data security (SSL/TLS)

This website uses SSL or TLS encryption to protect transmitted content and personal data. You can recognise an encrypted connection by the address bar of your browser („https://") and by the padlock symbol.

11External links

This website contains links to external third-party websites. When you open those external pages, only the data protection provisions of the respective providers apply. I have no influence on the nature and extent of the processing carried out there.

12Rights of the data subject

Under the GDPR, data subjects have in particular the following rights:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to certain processing (Art. 21 GDPR)
• Withdrawal of consent given (Art. 7(3) GDPR) with effect for the future

There is also the right to lodge a complaint with the competent data protection supervisory authority if you consider that the processing of your personal data infringes data protection law. For my place of business this is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany).

13Obligation to provide personal data

Providing personal data is neither required by law nor by contract. It may, however, be necessary in order to use certain functions of this website, in particular the contact form. Without the corresponding information it may not be possible to handle an enquiry.

14Changes to this privacy policy

I reserve the right to update this privacy policy at any time if my services change or if legal requirements are adjusted. The version current at the time of your visit to the website applies.

Last updated: 28 October 2026.