Who is responsible for your data
The data controller is Nelson Jeronimo, an independent product designer based in Quarteira, Algarve, Portugal. For anything about personal data: nvjeronimo@gmail.com.
What data I collect
Project form: name, email, company (optional), project type, approximate budget and the message you write.
Emails you send me directly, with whatever you choose to include.
WhatsApp messages: your number, profile name and the content of the messages you send me.
Server logs: like any web server, the hosting provider logs the IP address, date and time, the page requested and the browser, so the site works and stays secure.
Usage statistics, only if you accept cookies: pages viewed, where the visit came from, device, browser and approximate location, via Google Analytics (see the Cookie Policy).
Spam protection: when you submit the form, your IP address is used temporarily and in hashed form (a digest, not the plain IP) for about 10 minutes to limit repeated submissions.
I do not ask for or want sensitive data (health, origin, beliefs, etc.). Please do not include it in your message.
Why I use the data and on what basis
Replying to your request and preparing a proposal: steps taken at your request before a contract (Article 6(1)(b) GDPR).
Delivering the project if we go ahead: performance of a contract (same point b) and legal obligations such as tax (point c).
Keeping the site secure and preventing abuse: legitimate interest (point f).
Site usage statistics: your consent (point a), which you can withdraw at any time.
I do not use your data for marketing without your consent, I do not profile you and I never sell data.
Who I share it with
Only with the providers that make this work: DreamHost (site hosting and sending the form email), Google (Gmail, where I receive and keep emails, and Google Analytics if you accept cookies) and WhatsApp/Meta, if you choose to message me on WhatsApp.
These providers may process data outside the European Economic Area. Where they do, the transfer relies on GDPR safeguards such as the European Commission standard contractual clauses or the EU-US Data Privacy Framework.
I may have to share data with authorities where the law requires it.
How long I keep the data
Requests that do not become a project: up to 2 years after our last contact, then deleted.
Clients: for the duration of the project and afterwards only what is needed to meet legal obligations (for example, invoicing records for the statutory period).
Server logs: for the short period set by the hosting provider.
Google Analytics statistics: up to 14 months.
Your rights
You can ask for access, correction, deletion, restriction or portability of your data, and object to processing based on legitimate interest.
Just write to nvjeronimo@gmail.com. I reply within one month at the latest.
If you think your data has not been handled properly, you can complain to the Portuguese data protection authority (CNPD) at www.cnpd.pt.
Security
The site is served over HTTPS only, has no public database or login area, and access to hosting and email is protected. No system is infallible, but I treat your data with the care I would want for mine.
Changes to this policy
If this policy changes, I will update this page and the date at the top.