This Privacy Policy explains how personal data is collected, used, and protected when you visit diap.dev. We are committed to transparency, data minimization, and respecting your privacy choices in compliance with the General Data Protection Regulation (GDPR) and applicable EU/EEA data protection laws.
1. Data Controller
The data controller responsible for the processing of your personal data on this website is:
Name: Dimitrios Apostolakis
Role: Software Quality & Performance Engineer
Email: dsapostolakis@gmail.com
2. Purposes of Processing
We process personal data strictly for the following purposes:
- Site analytics and performance: Measuring site traffic, navigation paths, and load speed to ensure optimal user experience and continuous technical improvement.
- Recruiter and company insight: Understanding which organisations and companies visit the portfolio and which technical competencies, projects, or role variants they examine.
- CRM and professional outreach: Reviewing and responding to direct inquiries, professional collaboration requests, and career messages submitted via the contact form.
- Product research: Evaluating developer tooling patterns and assessing requirements for prospective software products and consulting services.
3. Legal Basis for Processing (GDPR Article 6)
We ensure every data processing activity is supported by a lawful basis under GDPR Article 6(1):
Consent (Art. 6(1)(a) GDPR)
Applies to analytics cookies, event tracking via PostHog EU, marketing cookies, and IP-derived organisation lookups. These activities occur only after you provide freely given, explicit opt-in consent through our consent banner.
Legitimate Interest (Art. 6(1)(f) GDPR)
Applies strictly to server diagnostic logs, security event monitoring, and DDoS defense necessary to maintain infrastructure security, network resilience, and prevent fraudulent abuse.
4. Categories of Data Collected
Strictly Necessary Technical Data
Cookie consent preference token (cc_cookie) stored locally in your browser to remember your consent status. Does not contain personal profiling data.
Consent Records
Proof of consent decisions and preference changes: consent ID, choices, policy revision, timestamp, truncated IP prefix (e.g. 192.0.2.0 or IPv6 prefix), and browser user agent. Legal basis: legal obligation to demonstrate consent under GDPR Art. 6(1)(c) and Art. 7(1).
Analytics and Usage Data (Only With Consent)
Page views, timestamps, referrer URLs, browser family, screen dimensions, and interaction events. We configure analytics in cookieless / identified-only mode where no person profile is created for anonymous visitors.
Company Context (Only With Analytics Consent)
Organisation/network name, country, and page path. Processed only with analytics consent to evaluate visiting audience interest. The full IP address is never stored.
Contact Messages
Information you voluntarily submit via the contact form: name, email address, company, message content, and truncated IP prefix. Legal basis: legitimate interest in responding to your communication (GDPR Art. 6(1)(f)).
5. Data Processors and Service Providers
We partner with trusted third-party service providers who process data on our behalf under GDPR-compliant Data Processing Agreements (DPAs):
| Provider | Purpose | Location / Jurisdiction | Status |
|---|---|---|---|
| Vercel Inc. | Cloud hosting, Edge delivery, Speed Insights | USA / Global (SCCs) | Active |
| PostHog EU | Privacy-first product analytics (opt-in only) | European Union (Germany) | Active (Consent-Gated) |
| IPinfo Inc. | IP-to-Organisation resolution (opt-in only) | USA (SCCs) | Active (Consent-Gated) |
| Resend Inc. | Transactional delivery of contact messages | USA (SCCs) | Active |
| Supabase EU | Storage of consent records, consented visitor company context, and contact messages | European Union (Ireland) | Active |
6. Data Retention
- Raw analytics events: Retained for exactly 25 months in PostHog EU cloud, after which raw event entries are automatically expunged.
- Aggregated metrics: De-identified aggregated reports (e.g. monthly view counts) are retained indefinitely for long-term historical trends.
- Consent records: 25 months, deleted automatically.
- Company context: 25 months, deleted automatically.
- Contact messages: Stored up to 25 months, then deleted automatically.
- Cookie preferences: Consent tokens expire after 182 days (approx. 6 months), after which you will be prompted again.
7. Your Rights Under GDPR
Under the GDPR (Articles 15–22), you hold the following statutory rights regarding your personal data:
- Right of access: Request confirmation and copies of your personal data.
- Right to rectification: Request correction of inaccurate or incomplete data.
- Right to erasure: Request deletion of your personal data ("right to be forgotten").
- Right to restriction: Request restriction of processing under certain legal conditions.
- Right to object: Object to processing grounded in legitimate interest.
- Right to withdraw consent: Withdraw previously granted consent at any time without penalty.
You can withdraw or customize your consent instantly using the link available on every page.
8. Contact & Supervisory Authority
To exercise your rights or if you have questions regarding this Privacy Policy, please email dsapostolakis@gmail.com. You also have the right to lodge a complaint with your local EU/EEA data protection supervisory authority if you believe our data processing violates applicable law.