What this site collects,
and why.
Written against what the site actually stores, rather than from a template. If something here does not match what happens, that is a fault — tell me and it gets fixed.
Who is responsible
Pedro López-Belmonte, Geneva, Switzerland, is the controller for the personal data described here. This is a personal site; my advisory work runs through a separate company, Bionic Thinking, which is a different controller with its own notice.
For anything on this page — a question, a correction, or a request to erase your data — write to hello@bionicthinking.ch. A person reads that inbox.
Because the audience is mostly in the EU and Switzerland, this notice is written to satisfy both the GDPR and the Swiss FADP. Where the two differ, the stricter reading applies.
Analytics, and the cookie
This site uses Google Analytics to count visits and see which pages are read and which links work. It sets a cookie in your browser and shares your IP address and details of the pages you open with Google.
None of it runs until you say yes. No Google script is loaded and no cookie is set before you answer the banner — not a reduced version, not an anonymous ping, nothing. If you decline, the answer is remembered and you are not asked again. The lawful basis is your consent, and nothing else here depends on it.
The same measurement covers bionicthinking.ch, so that a visit that starts here and continues there is understood as one visit rather than two strangers. Your choice below applies to this site; the other site asks separately.
One thing is stored regardless of your answer, because it is not analytics: your choice itself, in your browser’s localStorage. It never leaves your device, and it is the only way to avoid asking you again on every page.
The contact form
Sending the form on the contact page writes one row to my database: your name, email address, company and message, together with the page you sent it from, your IP address and the time. The IP address is there to recognise abuse of the form, which is otherwise an open door.
The lawful basis is that you asked me to get in touch, and the legitimate interest in not having the form abused.
The newsletter
Subscribing does two things: it registers your address with Buttondown, who send a confirmation email you also have to act on, and it writes a consent record here — your address, the page you were on, your IP address, and the exact wording you agreed to, word for word, so that rewording it later cannot change what you consented to.
The lawful basis is your consent, and you can withdraw it at any time using the unsubscribe link in any email, or by writing to me. Withdrawing stops the emails. The consent record itself is kept, because its whole purpose is to evidence that the subscription was asked for.
Where it goes
Four companies process data on my behalf. I sell nothing to anyone, and nothing here is shared for advertising.
- Supabase — the database holding the contact enquiries and consent records. Hosted in the European Union.
- Netlify — serves these pages and runs the small programs behind the forms. A United States company; its servers see the same request data any web host would.
- Buttondown — the newsletter, and only if you subscribe. A United States company.
- Google — analytics, and only if you consent. A United States company.
Transfers to the United States rely on the standard contractual clauses in those providers’ data processing terms.
How long it is kept
The rule the law sets is that personal data is kept no longer than the purpose it was collected for requires, and that I tell you either the period or how I arrive at it. There is no statutory number. These are the periods I hold myself to, and the reason for each.
- Contact enquiries — 24 months, then deleted. Long enough that a conversation picked up a year later still has its history; short enough that a one-line enquiry does not sit here indefinitely.
- Newsletter consent records — while you are subscribed, and three years after you unsubscribe. The purpose is to be able to show that you asked to be on the list, and a record deleted the moment it might be questioned is not evidence of anything.
- Analytics — 14 months, which is the shortest retention Google Analytics offers for this data, and the setting this property uses.
Asking me to delete something does not wait for any of these. See below.
Your rights
You can ask for a copy of what I hold about you, ask me to correct it, ask me to delete it, object to processing based on legitimate interest, ask me to restrict it, or ask for it in a portable form. Where processing rests on your consent — the newsletter, and analytics — you can withdraw that consent at any time without affecting what was done before.
One email to hello@bionicthinking.ch is enough, and there is no form to fill in. I will answer within a month.
If you think I have handled your data badly, you can complain to the Swiss Federal Data Protection and Information Commissioner, or to the supervisory authority in the EU country where you live.
Changes
When this notice changes the date at the top changes with it. It is reviewed whenever the site starts collecting something it did not collect before.