Data by ToufikPrivacy policy
Last updated: 2 September 2026
- I never sell, rent or trade your personal data, to anyone, for any reason.
- There is no advertising on this site and no ad tracking.
- Analytics runs only if you accept it in the cookie banner.
- What you type into the contact form is used to reply to you, nothing else.
Who is responsible
This site is run by Data by Toufik, the freelance data analytics and automation practice of Toufik. For anything about your data, write to [email protected]. That address reaches me directly.
What is processed, why, and by whom
1. Hosting and access logs
The site is served by Cloudflare Pages (Cloudflare, Inc., San Francisco, USA). To deliver the pages and protect them from abuse, Cloudflare processes your IP address, browser type, the page requested and the time of the request. Cloudflare participates in the EU-US Data Privacy Framework and offers EU Standard Contractual Clauses.
In addition, the site keeps aggregated, non-identifying traffic statistics (country, page and referring domain). No cookie is set and no IP address is stored for this purpose.
Legal basis: legitimate interest in operating a secure, working website (Art. 6(1)(f) GDPR).
2. Contact form
When you use the contact form, the following is processed: your name, email address, message, the optional answer to "How did you find me?", the page you submitted from, and the referring site or campaign parameters of your first visit (used only to understand which channels bring enquiries).
The message is delivered to my mailbox by Resend (Resend, Inc., San Francisco, USA) and a copy of the enquiry is kept in my own records. The form is protected against bots by Cloudflare Turnstile, which analyses browser signals and your IP address; it may set a temporary technical cookie for that purpose.
Legal basis: steps prior to entering into a contract at your request (Art. 6(1)(b) GDPR) and legitimate interest in preventing spam (Art. 6(1)(f) GDPR). Retention: as long as needed to handle the enquiry and any resulting engagement, and no longer than 24 months after the last contact unless a contract or legal obligation requires longer. Your details are never passed to anyone else.
3. Analytics
Google Analytics 4 (Google Ireland Limited, Dublin, Ireland) is used to understand which parts of the site are useful. It runs only if you accept it in the cookie banner (Google Consent Mode v2; in the EEA, UK and Switzerland, analytics is off by default). GA4 does not log or store IP addresses. Data may be transferred to Google LLC in the USA under the EU-US Data Privacy Framework. Reports are retained for 14 months. You can withdraw consent at any time via "Cookie settings" in the footer.
Cloudflare Web Analytics measures page performance without cookies and without any identifier that could single out a visitor. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
4. Fonts, videos and embedded content
Fonts and videos are served from this domain. No third-party fonts, video players or social widgets are loaded, so no data is sent to those providers by simply viewing the site.
5. External links
Links to Upwork, LinkedIn, GitHub, YouTube, Medium, Etsy and Gumroad lead to services with their own privacy policies. This site has no influence over what they process once you leave it.
Cookies and local storage
| Name | Type | Purpose | Duration |
|---|---|---|---|
| dbt_consent | localStorage | Remembers your cookie choice. | Until you clear it |
| Site storage (dbt_*) | localStorage / sessionStorage | First-visit landing page, referrer and visit count, attached to a contact enquiry only if you send one. | Until you clear it |
| _ga, _ga_* | Cookie (Google) | Google Analytics visitor and session identifiers. Set only after you accept. | Up to 13 months |
| Turnstile cookies | Cookie (Cloudflare) | Bot check on the contact form. Strictly necessary. | Short-lived |
Strictly necessary storage is used without consent. Everything else is off until you accept. To change your choice, use "Cookie settings" in the footer of any page.
Your rights
Under the GDPR you have the right to access the personal data held about you, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw any consent you have given, with effect for the future. To exercise any of these rights, write to [email protected].
You also have the right to lodge a complaint with a data protection supervisory authority, for example the authority of the EU member state where you live.
Changes
This page is updated when the site's processing changes. The date at the top shows the current version.