Contact →

Privacy Policy

Last updated: July 4, 2026

I take your privacy seriously. This policy explains what personal data is processed on michieldas.com, why, for how long, and what rights you have, in accordance with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Data controller

  • Controller: Michiel Das
  • Location: Barcelona, Spain
  • Website: michieldas.com
  • Email: contact [at] michieldas.com

michieldas.com is my personal website: a blog about marketing, entrepreneurship and personal projects. It is not a shop or a platform, so the data processing is the bare minimum a blog needs to work.

2. What data I process, and why

Blog comments

  • Data: the name (or nickname) you choose, your email address and the text of your comment. The name is published next to the comment; your email is not published — we only use it to manage and moderate comments.
  • Anti-spam: a SHA-256 hash of your IP address is stored alongside the comment (an irreversible identifier: the plain IP is never stored). It is used solely to rate-limit bulk submissions.
  • Moderation: comments are reviewed manually before publication. Once approved, your comment is shown publicly on the article with the name you provided.
  • Storage: Cloudflare D1 database, hosted in the Western Europe (EU) region.

Newsletter

  • Data: your email address and the subscription date.
  • Provider: the newsletter is sent through ipzmarketing, which acts as a data processor and applies its own privacy policy.
  • Double opt-in: your subscription only becomes active after you confirm it from the verification email, so nobody can subscribe you without your permission.
  • Unsubscribing: every email includes a one-click unsubscribe link.

Contact

If you write to me by email or via LinkedIn, I process your name, your contact address and the content of your message for the sole purpose of replying to you.

Web analytics

I use Google Analytics 4 (loaded via Google Tag Manager) to understand how the site is used and to improve the content. Analytics only runs if you accept analytics cookies in the cookie banner: the site implements Google Consent Mode v2 with all signals denied by default. The data collected is statistical and pseudonymised (pages visited, device type, traffic source). See the Cookie Policy for details.

Hosting, security and anti-spam (Cloudflare)

The site is served through Cloudflare (hosting and CDN), which transiently processes technical connection data (such as your IP address) to deliver the pages and protect the site against attacks. The comment form also uses Cloudflare Turnstile, which analyses technical browser signals to tell humans and bots apart, without tracking cookies and without identifying you.

3. Legal basis for each processing activity

  • Comments: your consent (art. 6(1)(a) GDPR), given when you submit the form. The IP hash relies on my legitimate interest (art. 6(1)(f)) in preventing spam and abuse.
  • Newsletter: your consent, confirmed via double opt-in. You can withdraw it at any time by unsubscribing.
  • Contact: my legitimate interest in handling the message you send me (art. 6(1)(f)).
  • Analytics: your consent, expressed through the cookie banner (art. 6(1)(a)).
  • Security and anti-spam: my legitimate interest in keeping the site available and free of abuse (art. 6(1)(f)).

4. Recipients and data processors

I do not sell, rent or trade your data. I work with these providers, which act as data processors contractually bound to protect your information:

  • Cloudflare: hosting, CDN, the comments database (D1) and anti-spam verification (Turnstile).
  • ipzmarketing: newsletter management and delivery.
  • Google: Google Analytics 4 and Google Tag Manager, only if you accept analytics cookies.

Data may also be disclosed to the competent authorities where there is a legal obligation to do so.

5. International transfers

Comments are stored in the European Union (Cloudflare D1, Western Europe region). Some providers (Cloudflare, Google) are headquartered in the United States; in those cases, processing is covered by adequate safeguards such as certification under the EU-US Data Privacy Framework or the Standard Contractual Clauses approved by the European Commission.

6. Retention periods

  • Comments: for as long as the article remains published, or until you request deletion. The IP hash is kept alongside the comment and is not used for any other purpose.
  • Newsletter: until you unsubscribe; your email is then removed from the active mailing list.
  • Contact: for as long as needed to handle your enquiry and at most one year after the last exchange, unless a legal obligation requires longer retention.
  • Analytics: Google Analytics data is retained for a maximum of 14 months.

7. Your rights

Under the GDPR, you can exercise the following rights at any time:

  • Access: find out what data I hold about you.
  • Rectification: correct inaccurate or incomplete data.
  • Erasure: ask me to delete your data (for example, a published comment).
  • Objection: object to processing based on legitimate interest.
  • Restriction: restrict the processing of your data.
  • Data portability: receive your data in a structured, commonly used format.
  • Withdrawal of consent: at any time, without affecting the lawfulness of prior processing.

To exercise them, write to contact [at] michieldas.com stating which right you want to exercise. You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), the supervisory authority for this site, or with the data protection authority of your own country of residence.

8. Security

I apply appropriate technical and organisational measures to protect your data: encrypted connections (HTTPS), EU-based storage, data minimisation (for example, no email addresses are collected with comments) and IP pseudonymisation. No system on the internet is 100% infallible, but the site is deliberately designed to collect as little data as possible.

9. Changes to this policy

I may update this policy when the processing activities or the applicable law change. Any changes will be published on this page with the corresponding update date.

10. Contact

For any questions about this policy or about how your data is processed, write to contact [at] michieldas.com or use the contact page.