Last updated: 25 August 2026
1. Data controller
The controller of personal data collected through jmillans.es is Jorge Millán Serrano, with Spanish tax identification number (NIF/CIF) 53617611B, address Carretera de Galapagar 30, P2, 2.º A, and privacy contact email jmillans404@gmail.com.
No data protection officer has been appointed.
2. Data that may be processed and purposes
This website is a professional portfolio. It does not conduct sales or advertising campaigns, or create commercial profiles for behavioural advertising.
| Channel | Data | Purpose and legal basis |
|---|---|---|
| Contact form | Name, email address and message content; any other data the individual voluntarily includes. | Handle and respond to the enquiry. Consent expressed when submitting the request (Article 6(1)(a) GDPR). |
| My Avatar | Full name, conversation content and any data voluntarily provided. | Provide the interaction, enable download and retain it for 30 days. Consent (Article 6(1)(a) GDPR). |
| Email delivery from My Avatar | Email address and PDF of the requested conversation or summary. | Send the requested content through Brevo, without tracking opens or clicks. Consent (Article 6(1)(a) GDPR). |
| Web analytics | Aggregate browsing metrics through Vercel Web Analytics; if accepted, online identifiers, technical browser information and usage data associated with Google Analytics. | Measure the audience and improve the website. Vercel Web Analytics does not use cookies; Google Analytics requires prior consent. |
| Security | Technical logs strictly necessary to detect misuse, prevent fraud and protect the service. | Website security and integrity. Legitimate interest (Article 6(1)(f) GDPR). |
3. Important information about My Avatar
My Avatar is an AI conversational system that digitally represents Jorge Millán. Before a conversation begins, users are clearly informed that they are interacting with AI rather than a person.
Do not enter sensitive or confidential information, or personal data about third parties without a valid basis for doing so.
Responses may contain errors, do not constitute professional advice and do not replace a direct conversation with Jorge Millán.
The chat is not used to make automated decisions producing legal effects or similarly significant effects on individuals.
My Avatar uses the OpenAI API with store: false. Conversations are stored encrypted in an AWS database in the Europe (Paris) region for 30 days. On request, a PDF of the conversation is generated and emailed through Brevo; the email address is not used for marketing and opens and clicks are not tracked.
4. Recipients, processors and international transfers
Data is not sold or disclosed to third parties except where required by law. Providers acting on behalf of the controller, subject to applicable processing terms, help deliver the website: Vercel Inc. for hosting and website execution in Paris; Amazon Web Services (AWS) for the conversation database in Europe (Paris, eu-west-3); OpenAI for conversational processing through its API; Brevo for transactional delivery of contact form messages and emails or PDFs requested through My Avatar; and Google Tag Manager and Google Analytics for web analytics when the analytics category is accepted.
Vercel and AWS are configured in Paris (France). OpenAI and other providers may process or access data outside the European Economic Area to deliver their services. In such cases, appropriate GDPR safeguards apply, such as standard contractual clauses, adequacy decisions or equivalent mechanisms provided in the applicable data processing agreements.
OpenAI acts as a processor for its API and its processing terms provide mechanisms for international transfers. AWS incorporates a data processing agreement and standard contractual clauses where appropriate. Current provider information is available on request at jmillans404@gmail.com.
5. Retention
Data is retained for the following periods: contact forms, 12 months from the last interaction; My Avatar conversations, 30 days after closure; email address, delivery data and requested PDF, 30 days; technical security logs, 30 days, exceptionally extendable to 90 days for an active security incident, abuse case or claim; Google Analytics event data, 2 months; and cookie choices, 12 months.
Data will be deleted or anonymised when no longer necessary, without prejudice to restricted retention for legally required periods to address potential liabilities.
6. Your rights
You may request access, rectification, erasure, objection, restriction of processing and portability where applicable. You may also withdraw consent at any time without affecting the lawfulness of earlier processing. To exercise your rights, email jmillans404@gmail.com and state the right you wish to exercise.
If you believe processing does not comply with the rules, you may complain to the Spanish Data Protection Agency: www.aepd.es.
7. Children
The website and My Avatar are not intended for children under 14. They must not provide personal data through these channels without the authorisation of a parent or guardian where required.
8. Security and changes
Reasonable technical and organisational measures are applied to protect data, taking account of the nature and risks of processing. This policy may be updated to reflect changes to the website, providers or legislation; the update date identifies the current version.