Last updated: 20 October 2026
This policy explains how personal information is handled when you visit this portfolio or contact me about my work.
1. Who is responsible for your information?
André Miguel Berberan de Arriaga, professionally known as André Arriaga, is responsible for personal information received in connection with enquiries about his design services. Based in Lisbon, Portugal.
Email: andre_mba@hotmail.com
Telephone: +351 925 031 278
2. Contacting me
The contact form asks for your name, email address, subject and message. These fields are required to submit this form and allow me to understand and respond to your enquiry. Providing them is voluntary and is not a statutory requirement; without them, the form cannot be submitted. Submitting an enquiry does not oblige you to enter into a contract. You can also contact me directly using the email address or telephone number above.
Selecting “Send message” sends your enquiry securely to Formspree for processing, spam filtering and delivery to my email inbox, without opening an email application. Formspree stores and processes submissions and may process technical information to provide and protect this service. If sending fails or cannot be confirmed, your entries remain in the form while the page stays open; they are not saved to local storage.
If you send an email, I receive your contact details, message and any information you choose to include. Please only include information relevant to your enquiry, and do not include sensitive personal information such as health details or identification documents. The privacy checkbox acknowledges that you have read this policy; it does not subscribe you to marketing.
3. Why I use your information
I use enquiry information to reply, discuss your requirements and prepare proposals. Where you request steps towards a contract, the basis is Article 6(1)(b) of the GDPR. For other professional correspondence, I rely on my legitimate interest in responding to enquiries and managing professional relationships under Article 6(1)(f). Legal record-keeping obligations, where applicable, are covered by Article 6(1)(c).
This portfolio does not use automated decision-making or profiling. Contact details are not collected here for mailing lists or advertising campaigns.
4. Website access, cookies and local storage
The portfolio code does not include analytics, advertising pixels or social-media embeds, and does not save form contents to local storage. Fonts are served with the site. Portfolio content and images may also be requested from Sanity’s content delivery services; those requests disclose technical information such as your IP address to Sanity. Contact form contents are sent to Formspree, not to Sanity.
The site uses a temporary sessionStorage entry named “portfolio-navigation”, containing an internal page path and timestamp, to coordinate page transitions. It is removed when the destination page reads it, or when the browser tab session ends. It contains no contact form data and is not used for advertising or audience measurement.
Cloudflare uses the “__cf_bm” security cookie to distinguish automated traffic and protect the site. Cloudflare states that it expires after 30 minutes of continuous inactivity. This is separate from the page-transition storage. See Cloudflare’s cookie documentation for details.
This version is hosted through ChatGPT Sites on Cloudflare infrastructure. Hosting and access-control services may process technical data, such as IP addresses, request times, browser information and security logs, to deliver and protect the site. Platform authentication may also use essential cookies. These infrastructure operations are separate from the contact form.
Where I control technical processing, its purpose is secure, reliable access to the portfolio, based on my legitimate interests. Providers also explain their own processing in their privacy notices.
5. Service providers and external websites
Contact form submissions are processed by Formspree and delivered to my Hotmail address through Microsoft’s Outlook.com service. If you email me directly, your chosen email provider also processes the message. Hosting and security are provided through OpenAI’s Sites platform and Cloudflare. Sanity provides the content management and delivery services used to display portfolio projects. Information may also be disclosed where required by law.
Behance, LinkedIn and Instagram buttons are ordinary links. Their content is not embedded in this portfolio. If you follow a link, the destination website processes information under its own privacy policy.
Relevant provider notices: Sanity, Formspree, OpenAI, Cloudflare and Microsoft.
6. International processing
Formspree states that its services are hosted in the United States and that it relies on the European Commission’s Standard Contractual Clauses when acting as a data processor. Its security information describes these arrangements. The other providers listed above also operate internationally and may process technical or correspondence data outside the European Economic Area. Their linked privacy notices describe their transfer arrangements. You can contact me to request information about the safeguards relevant to your data and how to obtain a copy.
7. How long information is kept
I retain enquiry correspondence only while it is needed to answer the request, handle relevant follow-up and maintain a record of any resulting professional relationship. The criteria include whether the enquiry remains active, whether a contract follows and whether records are needed for legal obligations or a dispute. Information that is no longer needed is deleted. Provider logs, email backups and deleted items follow the relevant provider’s retention arrangements.
8. Your rights
Subject to the applicable conditions, you may request access, correction, deletion, restriction or portability, and object to processing based on legitimate interests. Email andre_mba@hotmail.com to make a request. I may need proportionate information to verify your identity. Requests are normally answered within one month of receipt. If a lawful extension is necessary because of the complexity or number of requests, I will explain the reason and extension within that first month.
You may also complain to Portugal’s Comissão Nacional de Proteção de Dados (CNPD), or your competent supervisory authority.
9. Changes to this policy
This policy describes the current website and contact form delivery process. It will be updated if the way the website processes personal information changes. The date above identifies the latest revision.
