Legal
Privacy Policy
Last updated: September 12, 2026
1. Who is responsible
This website (ruizrocio.es) is a personal portfolio operated by:
- Owner: Rocío Ruiz
- Location: Valencia, Spain
- Contact: ruizrocio.e@gmail.com
For any questions about how your personal data is processed, you can write to the email above.
2. What this site does
This is a personal portfolio website. There is no contact form or user accounts for visitors. You can browse projects and reach me via the email or LinkedIn links shown in the footer. Some projects are password-protected due to confidentiality agreements (NDAs) with clients.
3. Data I collect
Analytics (Google Analytics). If you accept cookies, I use Google Analytics to understand how visitors use the site (pages viewed, approximate location, device type, and browser). Google may process this data on servers outside the European Economic Area. Google's privacy policy applies to their processing: policies.google.com/privacy.
Technical data. The hosting provider (Vercel) and, when content is loaded from the CMS, Supabase may process technical data such as IP address, request logs, and timestamps to deliver the site securely.
Email. If you contact me by email, I will use your address and message content only to reply to you.
Password-protected access. If you enter a password to view a protected project, this is not stored or linked to any additional personal data; it only unlocks the content for that visit.
4. Legal basis for processing
I process your personal data on the following legal grounds (Art. 6 GDPR):
| Purpose | Legal basis |
|---|---|
| Web analytics (Google Analytics) | Consent (Art. 6.1.a GDPR) |
| Site security and technical operation | Legitimate interest (Art. 6.1.f GDPR) |
| Responding to your emails | Pre-contractual steps or legitimate interest (Art. 6.1.b/f GDPR) |
5. Cookies
There are two types of cookies on this site:
- Essential cookies: necessary for the site to function properly. These do not require consent.
- Analytics cookies (Google Analytics): only set if you click "Accept" on the cookie banner. You can decline them and still use the site normally.
You can change your cookie choice at any time via in the site footer.
| Cookie / storage | Provider | Purpose | Duration |
|---|---|---|---|
| _ga, _ga_* | Google Analytics | Distinguish users and measure site usage | Up to 2 years |
| cookie-consent (local storage) | First-party | Remember your cookie choice | Until you clear it |
6. Why I use this data
- To operate and secure the website against misuse.
- To measure traffic and improve the portfolio (analytics, only with your consent).
- To respond when you contact me directly.
I do not use your data to build advertising profiles, and I do not sell or share it with third parties for commercial purposes.
7. Recipients and international transfers
I only share technical data with the providers necessary to run the site, who act as data processors:
- Vercel (hosting)
- Supabase (CMS database)
- Google Analytics (web analytics, if you accept cookies)
Some of these providers may transfer data outside the European Economic Area (for example, to the US). Where this happens, the transfer relies on safeguards recognized under the GDPR, such as the European Commission's Standard Contractual Clauses or the provider's adherence to the EU-U.S. Data Privacy Framework.
8. How long I keep data
- Analytics data: according to Google Analytics retention settings (14 months by default, unless changed).
- Server logs: for the limited period set by the hosting provider for security purposes.
- Emails: for as long as needed to handle your enquiry, and afterward only if required to meet a legal obligation.
9. Your rights
If you are in the European Economic Area or the UK, you have the right to access, rectify, erase, restrict, or object to processing, and to withdraw consent at any time (without affecting the lawfulness of processing carried out before the withdrawal).
To exercise these rights, email ruizrocio.e@gmail.com. You also have the right to lodge a complaint with your local data protection authority — in Spain, the AEPD — if you believe your data has not been processed in line with applicable law.
10. Security
I apply reasonable technical and organizational measures (such as relying on providers with encryption in transit and access controls) to protect your data against unauthorized access, loss, or alteration.
11. Children's privacy
This site is not directed at children, and I do not knowingly collect data from anyone under 14.
12. Changes to this policy
I may update this policy from time to time to reflect legal changes or changes to how the site works. The latest version will always be published on this page, along with the date it was last updated.