Privacy policy

Data controller

Mario Garrido Torres. Contact: hola@mariogarridotorres.com.

What data is processed and why

If you write to me or book a call, I process your name, your email address and whatever you tell me, in order to reply and, if there is an assignment, to carry it out. The lawful basis is the relationship you start by writing or booking and, if there is an assignment, the contract.

Messages are kept for as long as the conversation or the assignment lasts, and afterwards for as long as the law requires records of invoiced work to be kept.

Analytics

This site has no analytics. Neither my own nor third-party. I do not know who visits, how many people, or where from.

Who else sees your data

The site is served by Cloudflare, which receives the technical connection data it needs to deliver each page. My email is handled by my email provider. If you give me your email address for a delivery link, its notices reach you through Resend, which acts as a data processor solely to deliver them; and if I give you access with your email, so does the code to sign in. Cloudflare and Resend are US companies, and Resend keeps there the emails it delivers: what they process for me may leave the EU, with the safeguard of the EU-US Data Privacy Framework, which both have joined, and the European Commission's standard contractual clauses. If you book a call, whatever you enter in the calendar is processed by Cal.com. I do not pass your data on to anyone else.

The booking calendar

Cal.com's booking calendar is embedded in the contact page and in the last stop of the home page. When it loads (when you open the contact page, or reach the end of the home page), Cal.com receives technical data about your connection, loads my profile photo from Google and sends its error reports to Sentry. If you book, whatever you write is processed by Cal.com, and if the session is a paid one, payment is made within its calendar: this site does not see or store any payment data. Its privacy policy: https://cal.com/privacy.

Photo deliveries

If I send you photos with a private link on entregas.mariogarridotorres.com, each download is recorded: what was downloaded (one photo, a gallery or everything), when, how big it was, and a fingerprint of the network you connect from, computed from the first three numbers of your IP (its first half, for IPv6): your IP cannot be worked out from it. Your IP is not kept.

I record it to know that the photos reached the people they were for, and to cut off a link that someone is misusing. The basis is the commission or the relationship for which I send you the photos.

Each delivery lasts the period I give it when I create it, from one month to a year or until a date, and I can extend it. The photos and that record are deleted automatically 7 days after it expires, or after its last link expires or is revoked if that comes first. A delivery with no expiry is kept until I delete it or you ask me to, or until 7 days after its last link expires or is revoked. The photos of a delivery I never publish are deleted 97 days after its last photo or link, or after I created it. They are stored with Cloudflare, in the European Union.

If you give me your email address for the link, I use it only to let you know the delivery is about to expire: 14 and 3 days before and on the day, and again if I change its date. The basis is the commission or the relationship for which I send you the photos. The notices are sent through Resend, which acts as a data processor solely to deliver them. Each notice has a link to unsubscribe, and your address is deleted when you unsubscribe or with the delivery.

If the link has a password, failed attempts are recorded with that same fingerprint for one or two days, to stop anyone trying to guess it.

If I give you access to a delivery with your email, I keep that address, the groups I put you in and which deliveries or galleries you can open. To sign in I send you a code by email, through Resend, which expires after 10 minutes; the code is not kept, only a fingerprint of it. To stop abuse, each time a code is asked for, the email typed, even one with no access, and the network's fingerprint are recorded for a day; and each wrong try, for a day with your email. Once you sign in, your browser keeps a session that lasts 30 days or until you press «Sign out». What you download with your account is recorded like the rest, with your email instead of the link's name, and is deleted with the delivery. The basis is the commission or the relationship for which I give you access. If you no longer have access to anything, yours or through a group, and do not sign in for 7 days, your address, your groups and everything of yours are deleted; also if you ask me.

Your rights

You can exercise your rights of access, rectification, erasure, restriction, objection and portability by writing to hola@mariogarridotorres.com. If you think I have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos).

If you appear in a photo

The photos on this site are documentary and sports work. If you appear in one and want it taken down, write to me and I will remove it.