Privacy Policy
Last updated: 23 August 2026
1. Who processes your data (the controller)
The party responsible for processing personal data collected on staffilocode.com is:
- Name: Alexander Gorlov
- Contact email: [email protected]
“StaffiloCode” is the project's commercial name; the legally responsible party is the individual named above.
2. What data we collect
We collect a minimal amount of data, and only in two cases:
a) Contact form. When you send a message through the form on the site, we process:
- your name;
- your email address;
- the text of your message;
- your IP address (technically, at the moment of sending — for spam protection).
b) Site visits (analytics). We use a self-hosted Umami analytics system that collects anonymised statistics: page, referral source, device and browser type, approximate country. Umami does not use cookies, does not create a persistent user identifier, and does not let us identify you.
3. Cookies and data stored on your device
The site does not use advertising or tracking cookies.
- Your language preference is stored locally in your browser (
localStorage) to remember your chosen language. This is a technical necessity and is not shared with third parties. - A security cookie
cf_clearanceis set by our protection provider Cloudflare to filter out bots and malicious traffic. It is a strictly necessary technical cookie; it is not used for advertising or tracking.
Because only strictly necessary technical mechanisms are used, a cookie consent banner is not required under Article 22.2 of Spanish Law 34/2002 (LSSI-CE).
4. Purposes and legal bases
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Contact form (name, email, message, IP) | Reply to your request, contact you, and protect the form from spam | Art. 6(1)(b) — steps at your request prior to a contract, and/or Art. 6(1)(a) — consent; spam protection — Art. 6(1)(f) legitimate interest |
| Analytics (Umami) | Understand site traffic in an anonymised form | Art. 6(1)(f) — legitimate interest |
| Cloudflare security cookie | Protect the site from attacks and bots | Art. 6(1)(f) — legitimate interest |
5. Who receives your data (recipients)
We do not sell or share your data with third parties for advertising. Data is processed by the following service providers:
- Cloudflare, Inc. — site protection and delivery (CDN/WAF). Processes technical connection data, including your IP address.
- Google (Gmail) — messages sent through the form are delivered to our Gmail inbox. Provider: Google Ireland Ltd. / Google LLC.
- Umami analytics is hosted on our own server and does not share data with external parties.
6. International data transfers
Some providers (Cloudflare, Google) may process data outside the European Economic Area, including in the USA. Such transfers rely on mechanisms recognised as adequate by the European Commission (EU–U.S. Data Privacy Framework) and/or Standard Contractual Clauses (SCC).
7. How long we keep data
- Messages from the form — kept for as long as necessary to handle your enquiry and any follow-up communication, but no longer than 12 months from the last contact, unless required for the performance of a contract.
- Anonymised analytics — in aggregated form with no time limit, as it does not relate to identifiable data.
8. Your rights
Under the GDPR you have the right to: access your data, rectify it, erase it, restrict processing, object to processing, and data portability. To exercise your rights, write to [email protected].
You also have the right to lodge a complaint with the supervisory authority — the Spanish Data Protection Agency (AEPD), www.aepd.es.
9. Changes to this policy
We may update this policy. The current version is always available on this page, with the date of the last update.