Privacy, in plain language.
1. Controller and scope
Yerlin Antonio Ugarte Baldelomar, trading as Yerlin Ugarte, is the independent professional responsible for personal data processed for this portfolio, enquiries and newsletter. Based in San José, Costa Rica. Contact: contact@yerlinugarte.com. This notice describes the website’s current configuration. Rights apply according to your location and the relevant law; references to European or US rights do not mean every jurisdiction applies to every interaction. Separate client agreements may include additional processing terms.
2. Information and its source
You provide information when contacting me or subscribing: email, optional name, subject, message and preferences. Mailchimp may record submission time, consent or confirmation records and anti-abuse information. Hosting services receive request details such as IP address, browser, URL and time for delivery and security. Language and appearance preferences remain in your browser. Avoid sending passwords, payment details, identity documents or sensitive personal information through an initial enquiry. I do not intentionally obtain contact lists from data brokers.
3. Purposes and legal grounds
Enquiries are used to answer questions and prepare requested proposals, relying on steps requested before a contract or the legitimate interest in handling professional correspondence. Newsletters require a separate choice to subscribe and rely on consent where required. Delivery, troubleshooting and abuse prevention rely on the legitimate interest in a secure, functioning website, balanced against your rights. Records may also be needed for legal obligations or the establishment, exercise or defence of claims. Data is not repurposed for unrelated marketing without required notice and permission. Providing details is voluntary, but an email and message are needed to respond through the form.
4. Contact and newsletter
The website sends form data securely from its server to Mailchimp (Intuit). Enquiries are sent through the contact form service to my Mailchimp Inbox for me to review and answer. A new enquiry contact is non-subscribed unless you separately request the newsletter; existing marketing preferences are preserved. Newsletter requests record the chosen consent text, its version, language, date and submission identifier, and request email confirmation for a new subscription. The website displays the service’s result here; requesting confirmation is not the same as completing it. Unsubscribe through a message’s link or by emailing me; withdrawal does not affect earlier lawful processing. Marketing opt-outs will be honoured within the applicable deadline, including no later than 10 business days where US CAN-SPAM applies. A minimal suppression record may remain to prevent unwanted mail. Campaign software may measure opens or clicks depending on account settings and applicable permissions.
5. Browser storage and external connections
The cookie notice records your choice in yerlin-cookie-preferences for 180 days, for both acceptance and rejection. A material policy version change asks again. Reopen it through Cookie preferences in the footer. Optional analytics and marketing are absent and remain disabled under either choice; no consent for future tracking is collected. Clearing browser data or blocking storage may cause the notice to reappear. We do not sell or share browsing data for advertising, including when Global Privacy Control is enabled. Local storage keys yerlin-language and yerlin-theme remember choices you request. Without a saved choice, English is used and appearance follows your device when available. Change these choices or clear site data in your browser. This build installs no advertising pixels or audience analytics and serves its own fonts and images. Contact and newsletter forms send to this website’s server; they do not embed a Mailchimp page, load its tracking scripts or place Mailchimp cookies in your browser. The server briefly keeps a hashed network identifier to limit repeated submissions; this is not an advertising profile. Infrastructure providers may retain necessary security logs. External links and email confirmation pages are governed by their destination’s notice.
6. Recipients and disclosure
Necessary information is handled by hosting and infrastructure providers (Vercel when deployed there), Mailchimp for forms and mailing lists, and email services used to answer you. Access is limited to the service’s purpose and applicable contractual safeguards. Professional advisers or authorities may receive data when needed for legal duties or legitimate claims. A business reorganisation may involve a transfer only with appropriate safeguards and required notice. I do not sell personal information, share it for cross-context behavioural advertising or configure targeted advertising on this site. Public portfolio material is separate from private enquiry records.
7. International processing
I operate from Costa Rica and providers may process information in the US and other countries with different privacy laws. Where EEA or UK transfer restrictions apply, an applicable lawful mechanism is required, such as an adequacy decision or approved contractual clauses with supplementary measures where necessary. A provider’s certification is not assumed to cover every transfer. Contact me for information about safeguards relevant to your data. Mailchimp publishes its processing addendum and transfer terms at mailchimp.com/legal/data-processing-addendum/.
8. Retention
Enquiries that do not become projects are normally reviewed for deletion within 12 months of the last meaningful exchange. Project and contractual records remain for their operational purpose and applicable tax, accounting or limitation periods. Newsletter information remains while the subscription is active; minimal consent and suppression records may be retained afterwards to demonstrate compliance or honour an opt-out. Provider security logs follow necessary operational retention. Legal holds may delay deletion only to the extent needed for an obligation or dispute. Backups expire through their retention cycle with access restricted meanwhile.
9. Your privacy rights
Depending on applicable law, you may request access, a copy or portability, correction, deletion, restriction and information about processing; object to legitimate-interest processing; or withdraw consent. An objection to direct marketing stops that use. Email the contact above with enough information to locate your records. Verification will be proportionate; an authorised agent may act where permitted. Under GDPR, requests are normally answered within one month; any lawful extension of up to two further months will be explained within the first month. Other laws have their own deadlines. If a request is refused or limited, you will receive the reason and review or complaint options. You may complain to your competent data protection authority, including the authority of your EEA residence or workplace where applicable.
10. US state privacy rights
Where a US state privacy law applies to this activity, residents may have rights to know, access, correct, delete or obtain a portable copy; opt out of sale, certain sharing or targeted advertising; and appeal a refusal. Send requests to the email above without unlawful discrimination. This site has no sale, advertising-sharing or targeted-advertising activity to opt out of and makes no automated decisions with legal or similarly significant effects. A recognised signal such as Global Privacy Control will not be treated as permission for those activities. If practices change, required notices and controls will be updated first. This notice does not assert that the business meets every state law’s applicability thresholds.
11. Security and children
Reasonable technical and organisational safeguards are used in proportion to the data and risks. No internet service guarantees absolute security. Report suspected unauthorised access to the contact above; required breach notifications will follow applicable law. This professional site is not directed to children under 16 and does not knowingly solicit their data, including children under 13 in the US. If a child has provided information, contact me for review and appropriate deletion. Applicable age and parental-authorisation rules remain unaffected.
12. Changes to this notice
The revision date appears above. Material changes will be explained here and, where required, communicated directly before new processing begins. New consent will be requested where necessary. A revision does not retrospectively authorise a different use of your information or remove existing rights.