// legal
Privacy Policy
Last updated: 14 October 2026
This policy explains what personal data is processed when you visit cpaulo.com, why, and what rights you have under the General Data Protection Regulation (GDPR) and Portuguese law.
1. Who is responsible
The data controller is Paulo Carvalho, an individual based in Portugal and owner of this website. You can reach me via WhatsApp (+351 935 568 569) or LinkedIn.
2. What data is processed
Server logs
When you load any page, the web server automatically records technical data: your IP address, date and time of the request, the page requested, the referring page, and your browser's user agent. This is needed to deliver the site and keep it secure (legal basis: legitimate interest, Art. 6(1)(f) GDPR). Logs are kept only for a short period and are not used to identify you.
Analytics (only with your consent)
If you click Accept in the cookie banner, the site loads Cloudflare Web Analytics to count visits and see which pages are viewed. Cloudflare states this tool does not use cookies, does not fingerprint visitors and does not track you across sites. It is never loaded if you reject or ignore the banner (legal basis: consent, Art. 6(1)(a) GDPR). Provider: Cloudflare, Inc. — privacy policy.
Contact
If you contact me via WhatsApp or LinkedIn, I process the information you send (name, number or profile, message content) only to reply to you. Those services are run by Meta and LinkedIn under their own privacy policies.
3. Cookies and local storage
This site does not set any cookies of its own. It stores one item in your browser's local storage:
| Name | Purpose | Duration |
|---|---|---|
cpaulo-consent | Remembers whether you accepted or rejected analytics, so the banner is not shown on every visit. Strictly necessary. | Until you clear your browser data |
You can change your choice at any time: open cookie settings.
4. Third-party resources
To display the site, your browser connects to the following providers, which receive your IP address as part of the request:
- Google Fonts (Google Ireland Ltd.) — the JetBrains Mono font.
- cdnjs (Cloudflare, Inc.) — the React and Marked JavaScript libraries (homepage only).
- GitHub (GitHub, Inc.) — the resume is fetched from GitHub only when you click view resume.
Some of these providers may process data outside the European Economic Area. Where that happens, transfers rely on the EU–US Data Privacy Framework or Standard Contractual Clauses.
5. Your rights
Under the GDPR you have the right to access, correct or delete your personal data, to restrict or object to its processing, to data portability, and to withdraw consent at any time without affecting earlier processing. To exercise any of these rights, contact me using the details in section 1.
You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD).
6. Data sharing
Your data is not sold or shared for advertising. It is only processed by the service providers listed above, to the extent needed to run the site.
7. Changes
This policy may be updated when the site changes. The date at the top shows the latest version.