This policy explains what personal data this site processes, why, on which legal basis, for how long, who receives it, and how you can exercise your rights.
In short: no advertising, no data sold or shared for marketing, audience statistics only with your consent, and messages sent through the contact form are not stored on this site.
Who is responsible
This site is published by Nabil Charaf EI (sole proprietorship, data and measurement consulting), SIREN 992 922 302, 60, rue François 1er – 75008 Paris, France, who is the data controller.
For any question about your data or to exercise your rights, write to contact@nabilcharaf.com.
What is processed, why and for how long
Answering your messages (contact form)
- Data: your name, email address and message
- Legal basis: legitimate interest in answering you, or steps taken at your request before a possible consulting engagement
- Retention: 3 years after our last exchange
The form sends your name, email address and message to me by email. They are not saved in the site’s database. The email is sent through Brevo and received through Cloudflare, then kept in my mailbox, hosted by Google (Gmail).
Protecting the contact form from spam
- Data: technical signals from your browser, read by Cloudflare Turnstile on the contact page
- Legal basis: legitimate interest in protecting the form
- Retention: set by Cloudflare
Turnstile checks that the form is sent by a person. It does not set cookies, but stores a technical item in your browser’s local storage on Cloudflare’s domain.
Audience statistics (Google Analytics 4)
- Data: pages viewed, scrolling, clicks on outgoing links, file downloads, form sent (never its content), device and browser type, approximate location derived by Google from your IP address
- Legal basis: your consent
- Retention: statistics data 2 months; cookies 13 months
Statistics are only collected if you accept them in the cookie banner. Without your consent, no statistics cookie is set and nothing is measured.
To apply your choice, each page loads the Google Tag Manager file from Google’s servers, as for any resource requested by your browser: Google receives your IP address and the address of the page, but no cookie is set and no measurement takes place until you accept statistics.
Google Analytics is set up to collect as little as possible: data is kept for 2 months, its cookies last 13 months instead of Google’s default 2 years, Google signals, advertising features and data sharing with Google are turned off, and visits by the site’s author are excluded. Google acts as a processor under its data processing terms.
You can change or withdraw your choice at any time with the “Cookie settings” link at the bottom of every page. The cookies used are listed in the Cookie Policy.
Remembering your cookie choices
- Data: your consent choices
- Legal basis: legal obligation to collect and prove consent
- Retention: 6 months
Remembering your light or dark mode choice
- Data: your display preference
- Legal basis: strictly necessary for the feature you use
- Retention: 30 days
Operating and securing the site
- Data: IP address, date and time, page requested and browser, in the server logs
- Legal basis: legitimate interest in running a secure site
- Retention: set by Hostinger (see below)
Who receives your data
Your data is only used by the publisher of this site and by the service providers below, for the purposes above:
| Provider | Role | Data | Location |
|---|---|---|---|
| Hostinger | Website hosting | Server logs, site content | France (European Union) |
| Statistics (Google Analytics, Google Tag Manager) | Statistics data, IP address | European Union and United States | |
| Mailbox (Gmail) | Your messages | European Union and United States | |
| Cloudflare | Email reception, spam protection (Turnstile) | Your messages in transit, browser signals | European Union and United States |
| Brevo | Email delivery | Your messages in transit | European Union |
Your data is never sold, rented or used for advertising.
The server logs are kept by Hostinger for the time it sets for the security and operation of its services; Hostinger does not publish a fixed duration. Hostinger processes this data as a processor under its data processing agreement.
Transfers outside the European Union
Google and Cloudflare are US companies. Transfers to the United States rely on the EU–US Data Privacy Framework, to which both are certified, and on the European Commission’s standard contractual clauses.
Your rights
You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw your consent at any time without affecting what was done before. You can also give instructions on what happens to your data after your death.
To exercise these rights, write to contact@nabilcharaf.com. You will receive an answer within one month. If you think your rights are not respected, you can file a complaint with the CNIL, the French data protection authority (www.cnil.fr).
Links to other sites
Articles and pages may link to other sites, such as LinkedIn. This site does not embed their content or buttons: once you follow a link, the other site’s own privacy policy applies.
Children
This site is not intended for children under 15.
Changes to this policy
This policy may be updated when the site or its services change. The date below shows the latest version.
Last updated: 21 October 2026