Privacy Policy | Martín (Tato) Panelati

1. Overview & Data Controller Identity

This Privacy Policy governs the personal product management portfolio and leadership website of Martín (Tato) Panelati (operating at https://www.tato.pm and https://tato.pm). As the Data Controller, I am committed to respecting your privacy, maintaining data minimization principles, and ensuring transparency regarding how information is collected, processed, and safeguarded.

If you have questions regarding this policy or wish to exercise your legal data privacy rights, you may reach out via the contact form or directly via LinkedIn.

2. Information We Collect

We collect minimal personal data solely for direct professional communication, website performance monitoring, and security:

Contact Form Submissions: When you choose to reach out via the contact form on this site, we collect your name, email address, inquiry topic, and message content. This information is provided voluntarily by you to initiate a professional conversation or advisory inquiry.
Aggregated Analytics Data: We utilize Google Analytics (gtag.js, Property: G-GNCKW7SFQQ) to collect aggregated, anonymized usage statistics such as page views, referral sources, browser type, and country of origin. We do not use this data to identify individual visitors.
Server Logs & Content Negotiation: Our web server (Nginx hosted on Oracle Cloud Infrastructure) processes standard HTTP request headers, including IP addresses, timestamps, requested URIs, and Accept headers (used to negotiate Markdown vs HTML responses for web browsers and AI agents).

3. Legal Basis for Processing (GDPR Article 6)

We process your personal information under the following lawful bases:

Consent (Art. 6(1)(a) GDPR): When you explicitly submit the contact form or opt-in to communication.
Legitimate Interests (Art. 6(1)(f) GDPR): To ensure website security, prevent spam and abuse, evaluate site performance, and respond to incoming professional inquiries.

4. Third-Party Processors & Infrastructure

We do not sell, rent, or trade your personal information to third parties. We rely on established infrastructure providers who adhere to strict data protection standards:

Formspree Inc.: Processes contact form submissions asynchronously and delivers messages to my verified email. Formspree complies with GDPR and standard security protocols.
Oracle Cloud Infrastructure (OCI): Provides compute and static file hosting in secure European data center regions.
Google LLC (Google Analytics): Aggregates anonymized traffic metrics. You may opt-out of Google Analytics tracking at any time using browser extensions or by disabling cookies.

5. Cookies & Tracking Technologies

This website uses minimal essential cookies and Google Analytics measurement cookies to understand user engagement. No advertising, remarketing, or third-party behavioral profiling trackers are deployed on this website. You can configure your browser settings to decline all cookies or alert you when cookies are being sent.

6. Data Retention & Security

Contact form inquiries are retained only for as long as necessary to conduct ongoing professional correspondence or advisory discussions. We implement industry-standard SSL/TLS encryption (HTTPS with TLS 1.2/1.3), security headers (HSTS, CSP, X-Frame-Options, nosniff), and access controls to prevent unauthorized access, alteration, or disclosure of data.

7. Your Legal Rights (GDPR & CCPA)

Under European data protection laws (GDPR) and California privacy regulations (CCPA), you possess the following rights:

Right of Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete personal data.
Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data when no longer needed.
Right to Restrict Processing: Request limits on how your personal data is utilized.
Right to Data Portability: Request transfer of your data to another controller in a structured format.
Right to Object: Object to data processing based on legitimate interests.

To exercise any of these rights, please submit a request via our contact page.

8. Changes to This Privacy Policy

We may occasionally update this Privacy Policy to reflect technical updates, legal requirements, or changes in data processing practices. Any updates will be posted directly to this URL with an updated revision date.