Privacy Policy

How the personal data collected through this website is used,
stored and protected under the EU General Data Protection Regulation
Last updated: 4 October 2026

About this policy

This website (thalesfelini.com) is operated by Thales Augusto Felini, an independent Senior Product UX/UI Designer based in Tokyo, Japan. There is no company, group or parent organisation behind it. This privacy policy explains how I use the personal data I collect from you when you use this website.

For the purposes of the EU GDPR, I am the data controller for that data, and you can reach me at thalesfelini@gmail.com.

Topics:

1What data do I collect?

I collect the following data:

  • Personal identification information: the name, email address and message content you enter in the contact form.
  • Aggregate usage data: the address of the page you opened, the site you arrived from, your country, and your browser and device type, counted by a cookieless analytics counter.

That is the whole list. This website sets no cookies and stores nothing on your device. The counter records a visit rather than a visitor: it writes nothing to your browser, it builds no profile, and it gives me no way to identify you or to connect a page view to a message you later send. The Cookies Policy sets that out in full, including how to verify it in your browser.

I collect no special category data as defined in Article 9 of the GDPR, no financial information, and no data relating to children.

2How do I collect your data?

You directly provide me with most of the data I collect. I collect and process data when you:

  • Complete and submit the contact form on this website.
  • Write to me by email, on LinkedIn or on WhatsApp in response to this portfolio.
  • Open a page, which the cookieless counter records as one page view. Nothing is stored on your device to do it.

I receive no data about you indirectly. I buy no data from brokers or list providers, and I obtain none from partner organisations.

3How will I use your data?

I collect your data so that I can:

  • Reply to the enquiry you have sent me, and carry on that correspondence.
  • Assess and discuss a professional opportunity, a collaboration or a commission.
  • See which case studies are read and which are not, from aggregate page counts, so I know what is worth writing next.

I do not sell, rent or trade your data. I share it with no partner companies, no advertising networks and no credit reference agencies. It is disclosed to a third party only where I am required to do so by law.

4On what lawful basis do I process your data?

Under Article 6 of the EU GDPR, each purpose above rests on a named lawful basis:

  • Consent, for the data you enter in the contact form. You give it by submitting the form, and you can withdraw it at any time.
  • Legitimate interests, for replying to an enquiry you have already sent me by email, on LinkedIn or on WhatsApp. The interest is in answering the people who write to me, weighed against your rights and freedoms.
  • Legitimate interests, for the cookieless page counter. The interest is in knowing which pages are read. It stores nothing on your device, identifies no one and builds no profile, so the weighing against your rights and freedoms comes out in favour of counting. Any content blocker stops it, and you can object at any time using the address in section 11.

Providing your data is entirely voluntary. You are under no statutory or contractual obligation to give me any personal data, and the only consequence of withholding it is that I have no way to reply to you.

5How do I store your data?

Contact form submissions arrive in my email inbox and are stored there, on the servers of my email provider. That account is protected with a unique password and two-factor authentication, and the connection to this website is encrypted with HTTPS throughout.

Who else handles it. Three companies process data on my behalf, each under data processing terms that limit them to acting on my instructions, and only for the purposes set out in section 3:

  • Vercel Inc. (United States) hosts this website. Its servers receive your IP address with every request, as any web server must, and it provides the cookieless page counter described in section 1. Its privacy policy.
  • Formspree, Inc. (United States) receives what you type into the contact form and passes it to my inbox, keeping a copy on its servers. Its privacy policy.
  • My email provider stores the resulting correspondence in my inbox.

I keep enquiry correspondence for 12 months from our last exchange, unless it becomes part of an ongoing professional relationship, in which case I keep it for the duration of that relationship and for 12 months afterwards. Once that period expires I delete the correspondence permanently, from the inbox and from its trash folder. Your correspondence is kept nowhere else: no database and no server log under my control. The page counts in section 1 sit apart from it; they hold no name, no email address and no message, and they are aggregate figures I cannot trace back to a person.

International transfers. Your data is stored and processed outside the European Economic Area. I am based in Japan, and the European Commission recognised Japan as providing an adequate level of data protection on 23 January 2019, so that transfer rests on an adequacy decision. The two processors above are in the United States, and those transfers rest on the safeguards set out in each company's data processing terms, which is the basis on which they serve customers in the EEA and the UK. Your data therefore keeps a level of protection essentially equivalent to the one it has under the EU GDPR.

6Marketing

I send no marketing. There is no mailing list, no newsletter and no promotional campaign attached to this website, and I pass your details to no one else for marketing purposes.

Where I reply about a service that is relevant to the enquiry you sent, that reply forms part of our correspondence. You have the right at any time to tell me to stop contacting you, and I will act on it immediately.

7What are your data protection rights?

I would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:

  • The right to access. You have the right to request copies of your personal data. I make no charge for this.
  • The right to rectification. You have the right to request that I correct any information you believe is inaccurate, and to request that I complete information you believe is incomplete.
  • The right to erasure. You have the right to request that I erase your personal data, under certain conditions.
  • The right to restrict processing. You have the right to request that I restrict the processing of your personal data, under certain conditions.
  • The right to object to processing. You have the right to object to my processing of your personal data, under certain conditions.
  • The right to data portability. You have the right to request that I transfer the data I have collected to another organisation, or directly to you, in a structured, commonly used and machine-readable format, under certain conditions.
  • The right to withdraw consent. Where processing rests on your consent, you can withdraw it at any time, which does not affect the lawfulness of the processing carried out before you withdrew it.

This website carries out no automated decision-making and no profiling. Nothing you submit is used to build a profile of you, to score you, or to reach a decision about you by automated means.

If you make a request, I have one month to respond to you. To exercise any of these rights, write to me at thalesfelini@gmail.com.

8Cookies

Cookies are text files placed on your computer to collect standard internet log information and visitor behaviour information. This website sets none. It also writes nothing to your browser's local storage, session storage or IndexedDB. The page counter in section 1 is deliberately of the cookieless kind: it reports a page view and keeps nothing on your device to do it.

Because nothing is stored on your device, no consent is required under the ePrivacy Directive, which is why you are not shown a cookie banner. The Cookies Policy explains this in full and shows how to confirm it in your own browser. For further information on cookies generally, visit allaboutcookies.org.

9Privacy policies of other websites

This website loads no content from any other company. The typefaces, the icon set, the images and the video are all served from this domain, so no third party is told that you visited, and your IP address reaches no one but this website's host. The page counter is part of that host and is served from this domain as well, so it adds no other company to the list.

It does contain links out, among them LinkedIn, WhatsApp and an email service. Those requests happen only when you click. This privacy policy applies only to thalesfelini.com, so once you follow a link you should read the privacy policy of wherever you land.

10Changes to this privacy policy

I keep this privacy policy under regular review and place any update on this page. This privacy policy was last updated on 4 October 2026.

11How to contact me

If you have any question about this privacy policy, about the data I hold on you, or if you would like to exercise one of your data protection rights, please do not hesitate to get in touch.

12How to contact the appropriate authority

Should you wish to report a complaint, or if you feel that I have not addressed your concern in a satisfactory manner, you may contact the supervisory authority for your jurisdiction.

  • United Kingdom: the Information Commissioner's Office, ico.org.uk
  • European Economic Area: your national data protection authority, listed at edpb.europa.eu
  • Japan: the Personal Information Protection Commission, ppc.go.jp
  • Brazil: the Autoridade Nacional de Proteção de Dados, gov.br/anpd