Privacy Policy (Datenschutzerklärung)
Last updated: November 2026
1. Who is responsible
The controller for this website within the meaning of the General Data Protection Regulation (GDPR) is Paula Carbonell del Castillo. Postal address: see Imprint. Email: hello.paulacarbonell@gmail.com
2. In short
This website does not set cookies itself and does not use analytics or tracking tools. Fonts are hosted on this website's own server. On some project pages, videos from Vimeo and preview images from YouTube are loaded (see section 5). Personal data is only processed to deliver the website, to show this content and to answer enquiries.
3. Hosting and server log files
This website is hosted by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. When you visit the website, Netlify automatically processes the data your browser transmits so that the pages can be delivered: IP address, date and time of the request, the page requested, the referring page, and information about your browser and operating system (server log files).
Purpose: delivering the website and keeping it stable and secure. Legal basis: Art. 6(1)(f) GDPR. My legitimate interest is a reliable and secure website.
Netlify processes this data on my behalf under a data processing agreement (Art. 28 GDPR). Data may be transferred to the USA. Netlify is certified under the EU-U.S. Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR). Server log files are kept only as long as needed for these purposes and are then deleted.
4. Contact by email or phone
If you contact me by email or phone, I process the data you provide, for example your name, email address, phone number and message, to answer your enquiry. If you leave a voice message, the recording is stored on my router and forwarded to my email inbox. Legal basis: Art. 6(1)(b) GDPR where your enquiry relates to a contract or to preparing one, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). I delete the data once your enquiry has been dealt with, unless statutory retention periods under tax or commercial law require me to keep it longer.
Emails are handled via Gmail, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may also process data in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework.
5. Embedded videos and preview images
Vimeo: Some project pages contain embedded videos from Vimeo, a service of Vimeo.com, Inc., 555 West 18th Street, New York, NY 10011, USA. When you scroll to such a video, your browser connects to Vimeo's servers. Vimeo receives your IP address, the page you are on and information about your browser, and may store cookies or similar technologies on your device. Vimeo is certified under the EU-U.S. Data Privacy Framework. More information: https://vimeo.com/privacy
YouTube: Some project pages show preview images of YouTube videos. These images are loaded from YouTube's servers, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google receives your IP address and information about your browser. Google may also process data in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework. The video itself only opens on YouTube when you click on it. More information: https://policies.google.com/privacy
Purpose: presenting my work with videos. Legal basis: Art. 6(1)(f) GDPR. My legitimate interest is an appealing presentation of my projects.
6. Links to other websites
This website links to LinkedIn and YouTube. Apart from the YouTube preview images described in section 5, these are plain links: no data is sent to these services until you click on them. After that, the privacy policy of the respective provider applies.
7. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR).
Right to object: where processing is based on Art. 6(1)(f) GDPR, you can object to it at any time on grounds relating to your particular situation (Art. 21 GDPR).
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement.
To exercise your rights, an email to the address above is enough.
8. Further information
You are not obliged to provide personal data. Without the technical data described in section 3, however, the website cannot be displayed. There is no automated decision-making or profiling. The website is transmitted via an encrypted connection (TLS).