# Privacy Policy
## Martín (Tato) Panelati Portfolio (tato.pm)

> Last Updated: August 2026
> Compliant with the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA).

- **Canonical URL**: https://www.tato.pm/privacy
- **Alternate Markdown URL**: https://www.tato.pm/privacy.md
- **Data Controller**: Martín (Tato) Panelati
- **Contact / Inquiries**: https://www.tato.pm/contact

---

## 1. Overview & Data Controller Identity
This Privacy Policy outlines how personal data is collected, processed, and safeguarded on the website **https://www.tato.pm** (and its canonical aliases). As the Data Controller, Martín (Tato) Panelati is committed to data minimization, transparency, and user privacy.

---

## 2. Information Collected

- **Contact Form Inquiries**: When submitting a message through the website contact form, we collect your *name, email address, topic, and message content*. This data is submitted voluntarily to initiate professional or advisory correspondence.
- **Aggregated Web Analytics**: We use Google Analytics (`gtag.js`, Property: `G-GNCKW7SFQQ`) to collect anonymous, aggregated metrics regarding site usage, browser platforms, and geographic regions. We do not sell or monetize personal data.
- **Server Logs & Content Negotiation**: Our OCI Nginx web server processes standard HTTP request headers, including IP addresses, timestamps, requested URLs, and `Accept` headers (for Markdown vs HTML content negotiation).

---

## 3. Lawful Basis for Processing (GDPR Art. 6)

- **Consent (Art. 6(1)(a))**: Explicitly given when sending inquiries via the contact form.
- **Legitimate Interests (Art. 6(1)(f))**: For maintaining website infrastructure security, preventing abuse, and responding to incoming professional inquiries.

---

## 4. Third-Party Service Providers

- **Formspree Inc.**: Securely transmits contact form submissions to the Controller's verified inbox.
- **Oracle Cloud Infrastructure (OCI)**: Hosts web compute and static assets in European data centers.
- **Google LLC**: Provides anonymized site analytics. Users may opt-out of tracking via browser settings or standard ad-blocker extensions.

---

## 5. Cookies & Tracking Technologies
This website deploys only essential technical cookies and anonymized Google Analytics cookies. No advertising, behavioral profiling, or cross-site tracking trackers are used.

---

## 6. Your Rights Under GDPR & CCPA
You have the right to:
1. **Access** the personal data stored about you.
2. **Rectify** inaccurate or outdated information.
3. **Erase** ("Right to be Forgotten") your personal correspondence.
4. **Restrict or Object** to processing based on legitimate interests.
5. **Data Portability** to obtain your data in a structured format.

To exercise your privacy rights, please reach out via [https://www.tato.pm/contact](https://www.tato.pm/contact).