Privacy Policy

This page explains what personal data andrespedes.com collects, why, who else handles it, and what you can ask me to do with it. Short version: I collect as little as I can, I never sell it, and you can ask me to delete it at any time.

Who is responsible

The data controller for this website is Andrés Céspedes Morales, Amsterdam, the Netherlands. For anything about your data, email [email protected].

What I collect and why

Newsletter and free toolkits

When you sign up, I collect your email address and which toolkits you picked, so I can send them and a short email about once a week. Sign-ups are handled by Kit (formerly ConvertKit), my email provider, and are confirmed by a double opt-in email: nothing is sent until you click the confirmation link. Kit may record whether an email was opened and which links were clicked, which tells me what’s useful.

Legal basis: your consent. Every email has an unsubscribe link, and unsubscribing stops all emails. To have your address deleted entirely, email me.

Contact form

The contact form asks for your name, email address and message. They are sent to my inbox by email; the website does not keep a copy. To keep out spam bots, the form uses Google reCAPTCHA (v3), which looks at how the page is used and at technical details of your device and browser to tell people from bots. Google’s privacy policy (opens in a new tab) applies to that check.

Legal basis: my legitimate interest in answering you and in keeping the form free of spam, and steps you ask for before any work together. I keep messages for as long as needed to handle your request and any follow-up.

Visitor statistics

I use Burst Statistics to count visits and see which pages are read. It runs on this website’s own server, shares nothing with third parties, and respects your browser’s “Do Not Track” setting. Without your consent it works without cookies; if you allow Statistics in the cookie banner, it sets one anonymous cookie to recognise repeat visits.

If you allow Statistics, the site also uses Google Analytics to record things like the pages you view, your device and browser, and your approximate location. Until you agree, Google Analytics is told not to store anything on your device. You can change your choice at any time on the Cookie Policy page.

Legal basis: my legitimate interest in understanding how the site is used (Burst Statistics without cookies), and your consent (Burst’s cookie and Google Analytics).

Hosting, security and delivery

The site is hosted by Hostinger, and Cloudflare sits in front of it to make it faster and to block attacks. Like any web server, they process your IP address, browser details and the pages you request, and keep short-lived logs for security and troubleshooting. Cloudflare may set a strictly necessary cookie to tell people from bots.

Legal basis: my legitimate interest in keeping the site available and secure.

If you email me directly

I receive whatever you send, including your email address, and use it only to reply.

Cookies

The cookie banner lets you choose which optional cookies to allow. The full list, and the controls to change your choice, are on the Cookie Policy page.

Who else receives it

Only the services that run the site for me, each acting on my instructions:

• Hostinger (web hosting)
• Cloudflare (speed and security)
• Kit (newsletter and toolkit emails)
• Google (reCAPTCHA on the contact form; Google Analytics only with your consent)

I don’t sell your data, I don’t share it for advertising, and I don’t make automated decisions about you.

Transfers outside the EU

Some of these providers are based in the United States or process data there. Those transfers rely on safeguards recognised under the GDPR, such as the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

How long I keep it

• Newsletter: until you unsubscribe or ask me to delete it.
• Contact messages and emails: as long as needed for the conversation and any follow-up.
• Statistics and server logs: only as long as the provider’s retention settings require for the purposes above.

Your rights

Under the GDPR you can ask to see the data I hold about you, correct it, delete it, limit or object to how I use it, or receive a copy to take elsewhere. Where I rely on your consent, you can withdraw it at any time. Email [email protected] and I’ll reply within one month.

If you think I’ve handled your data wrongly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (opens in a new tab), though I’d appreciate the chance to fix it first.

Children

This site is not aimed at children under 16, and I don’t knowingly collect their data.

Changes

If this policy changes, I’ll update it here and change the date at the top.