Privacy, in plain language.
1. Controller and scope
Yerlin Antonio Ugarte Baldelomar, trading as Yerlin Ugarte, is the independent professional responsible for personal data processed for this portfolio, enquiries and newsletter. Based in San José, Costa Rica. Contact: contacto@yerlinugarte.com. This notice describes the website’s current configuration. Rights apply according to your location and the relevant law; references to European or US rights do not mean every jurisdiction applies to every interaction. Separate client agreements may include additional processing terms.
2. Information and its source
You provide information when contacting me or subscribing: email, optional name, subject, message and preferences. Mailchimp may record submission time, consent or confirmation records and anti-abuse information. Hosting services receive request details such as IP address, browser, URL and time for delivery and security. Language and appearance preferences remain in your browser. Avoid sending passwords, payment details, identity documents or sensitive personal information through an initial enquiry. I do not intentionally obtain contact lists from data brokers.
3. Purposes and legal grounds
Enquiries are used to answer questions and prepare requested proposals, relying on steps requested before a contract or the legitimate interest in handling professional correspondence. Newsletters require a separate choice to subscribe and rely on consent where required. Delivery, troubleshooting and abuse prevention rely on the legitimate interest in a secure, functioning website, balanced against your rights. Records may also be needed for legal obligations or the establishment, exercise or defence of claims. Data is not repurposed for unrelated marketing without required notice and permission. Providing details is voluntary, but an email and message are needed to respond through the form.
4. Contact and newsletter
The contact form is hosted by Mailchimp (Intuit) and connects when you load it or follow its external link. An enquiry does not by itself authorise newsletters. The subscription form sends your email to the identified Mailchimp audience, where validation or confirmation appears. Confirmation by email may be required depending on audience settings. Unsubscribe through a message’s link or by emailing me; withdrawal does not affect earlier lawful processing. Marketing opt-outs will be honoured within the applicable deadline, including no later than 10 business days where US CAN-SPAM applies. A minimal suppression record may remain to prevent unwanted mail. Campaign software may measure opens or clicks depending on account settings and the permissions applicable to you.
5. Browser storage and external connections
Local storage keys yerlin-language and yerlin-theme remember choices you request. Without a saved choice, English is used and appearance follows your device when available. Change these choices or clear site data in your browser. This build installs no advertising pixels or audience analytics, and serves its own fonts and images. Before showing the embedded contact form, the page asks you to enable a connection to Mailchimp, which may use its own cookies, storage and anti-abuse tools. Closing the form stops the embedded connection but does not erase data already held by Mailchimp. Use browser controls and the provider’s privacy choices for that data. External links are governed by the destination’s notice.
6. Recipients and disclosure
Necessary information is handled by hosting and infrastructure providers (Vercel when deployed there), Mailchimp for forms and mailing lists, and email services used to answer you. Access is limited to the service’s purpose and applicable contractual safeguards. Professional advisers or authorities may receive data when needed for legal duties or legitimate claims. A business reorganisation may involve a transfer only with appropriate safeguards and required notice. I do not sell personal information, share it for cross-context behavioural advertising or configure targeted advertising on this site. Public portfolio material is separate from private enquiry records.
7. International processing
I operate from Costa Rica and providers may process information in the US and other countries with different privacy laws. Where EEA or UK transfer restrictions apply, an applicable lawful mechanism is required, such as an adequacy decision or approved contractual clauses with supplementary measures where necessary. A provider’s certification is not assumed to cover every transfer. Contact me for information about safeguards relevant to your data. Mailchimp publishes its processing addendum and transfer terms at mailchimp.com/legal/data-processing-addendum/.
8. Retention
Enquiries that do not become projects are normally reviewed for deletion within 12 months of the last meaningful exchange. Project and contractual records remain for their operational purpose and applicable tax, accounting or limitation periods. Newsletter information remains while the subscription is active; minimal consent and suppression records may be retained afterwards to demonstrate compliance or honour an opt-out. Provider security logs follow necessary operational retention. Legal holds may delay deletion only to the extent needed for an obligation or dispute. Backups expire through their retention cycle with access restricted meanwhile.
9. Your privacy rights
Depending on applicable law, you may request access, a copy or portability, correction, deletion, restriction and information about processing; object to legitimate-interest processing; or withdraw consent. An objection to direct marketing stops that use. Email the contact above with enough information to locate your records. Verification will be proportionate; an authorised agent may act where permitted. Under GDPR, requests are normally answered within one month; any lawful extension of up to two further months will be explained within the first month. Other laws have their own deadlines. If a request is refused or limited, you will receive the reason and review or complaint options. You may complain to your competent data protection authority, including the authority of your EEA residence or workplace where applicable.
10. US state privacy rights
Where a US state privacy law applies to this activity, residents may have rights to know, access, correct, delete or obtain a portable copy; opt out of sale, certain sharing or targeted advertising; and appeal a refusal. Send requests to the email above without unlawful discrimination. This site has no sale, advertising-sharing or targeted-advertising activity to opt out of and makes no automated decisions with legal or similarly significant effects. A recognised signal such as Global Privacy Control will not be treated as permission for those activities. If practices change, required notices and controls will be updated first. This notice does not assert that the business meets every state law’s applicability thresholds.
11. Security and children
Reasonable technical and organisational safeguards are used in proportion to the data and risks. No internet service guarantees absolute security. Report suspected unauthorised access to the contact above; required breach notifications will follow applicable law. This professional site is not directed to children under 16 and does not knowingly solicit their data, including children under 13 in the US. If a child has provided information, contact me for review and appropriate deletion. Applicable age and parental-authorisation rules remain unaffected.
12. Changes to this notice
The revision date appears above. Material changes will be explained here and, where required, communicated directly before new processing begins. New consent will be requested where necessary. A revision does not retrospectively authorise a different use of your information or remove existing rights.