Privacy notice
Privacy
Last updated:
The short version: this site shows you my work and does nothing else with your data unless you say yes. Google Analytics runs only after you accept it in the cookie banner. There is no contact form, no account, no newsletter and no advertising.
Who is responsible
The controller for this website is Sergiu Vlad, a software engineer based in Cluj-Napoca, Romania. For anything about your personal data, write tome@sergiuvlad.com. I have not appointed a data protection officer; I handle these requests myself.
Hosting and server logs
The site is a set of static files served from a server in Germany (EU) that I administer myself. Like every web server, it writes an access log for each request:
- IP address
- date and time of the request
- requested address, HTTP status and size of the response
- referring page, if your browser sends one
- browser and operating system (user agent)
Purpose: delivering the site, keeping it secure (for example, spotting abuse) and fixing errors. Legal basis: my legitimate interest in running a secure website, Art. 6(1)(f) GDPR.Retention: logs are rotated and deleted automatically after a short period, no longer than these purposes need. They are not used to build profiles and are not combined with other data.
Google Analytics, only with your consent
With your consent, the site uses Google Analytics 4 (measurement ID G-8X112X9BTV) to see which pages and sections are read and which links are used, so I can tell what is useful.
Before you choose, nothing is sent to Google. The Google tag is blocked until you accept analytics in the banner, and Google Consent Mode v2 starts with analytics and advertising storage set to denied. If you decline, the tag never loads.
If you accept, Google Analytics collects:
- pages viewed, the sections of the home page that come into view, scroll depth and visible time on the page
- clicks on navigation, the CV download, the email and LinkedIn links, links to other sites, language and theme changes, the command menu (the command name only), and when you point at or focus the contact details
- when the tab is hidden or shown again, and how long the visit lasted
- browser, device type, screen size, language, and the referring site
- an approximate location (country or city) that Google derives from your IP address
- pseudonymous identifiers stored in the cookies listed below
The site never sends your email address, anything you type into the command menu, or any other text you enter. Advertising features are not used: the advertising consent signals (ad_storage,ad_user_data, ad_personalization) stay denied.
Legal basis: your consent, Art. 6(1)(a) GDPR, and Art. 4(5) of Romanian Law 506/2004 for storing cookies on your device. Retention: as configured in Google Analytics, at most 14 months for event data. The cookies expire after up to 2 years unless you delete them or withdraw consent.
Recipient and transfers: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, processes this data on my behalf as a processor. Google may process it in the United States. Google LLC is certified under the EU-US Data Privacy Framework, and Google's data processing terms include the European Commission's Standard Contractual Clauses.
The cookie banner
The banner is TermsFeed's free Cookie Consent script, loaded from www.termsfeed.com. As with any file your browser downloads, TermsFeed's server receives your IP address and the name of this site when the script loads. The script stores your choice in cookies on this site so the banner does not ask again on every page.
Legal basis: I am required to ask for and remember your consent (Art. 6(1)(c) together with Art. 7(1) GDPR); these cookies are strictly necessary for that and need no consent themselves.
Cookies and browser storage
| Name | Set by | Purpose | Lifetime |
|---|---|---|---|
cookie_consent_user_accepted, cookie_consent_level, cookie_consent_user_consent_token | TermsFeed script | Remember your cookie choice (strictly necessary) | Up to 1 year |
theme (localStorage) | This site | Remember light or dark theme, if you pick one. Stays in your browser, never sent anywhere | Until you clear it |
_ga, _ga_8X112X9BTV | Google Analytics, only after consent | Distinguish visits and sessions for statistics | Up to 2 years |
If you email me
The site has no contact form. If you write to me@sergiuvlad.com, I receive your email address, your name if you include it, and whatever you write. Mail for this domain is handled on the same server as the site.
Purpose: replying to you and, if we decide to work together, preparing and running that work. Legal basis: steps before a contract and the contract itself, Art. 6(1)(b) GDPR, or my legitimate interest in answering messages, Art. 6(1)(f). Retention: as long as the conversation is relevant; longer only where a contract or the law requires it, for example accounting records for contract work invoiced through my company, VAR24 INTERNATIONAL SRL.
Fonts and other third parties
All fonts (Newsreader, IBM Plex Sans, IBM Plex Mono) and images are served from this site. Your browser makes no requests to Google Fonts or any other font or content service. There are no embedded videos, maps, social media widgets or advertising scripts. The LinkedIn link is a plain link: LinkedIn receives data only if you follow it, under its own privacy policy.
Apart from the providers named above, I do not share, sell or rent your data. There is no automated decision-making or profiling. Giving any data is voluntary; the site works fully if you decline analytics.
Your rights
Under the GDPR you have the right to:
- access the personal data I hold about you (Art. 15)
- have it corrected (Art. 16) or erased (Art. 17)
- restrict its processing (Art. 18)
- receive it in a portable format (Art. 20)
- object to processing based on legitimate interest (Art. 21)
- withdraw your consent at any time, without affecting processing before the withdrawal (Art. 7(3))
Email me@sergiuvlad.com to use any of them. I answer within one month, as Art. 12(3) GDPR requires. Analytics data is pseudonymous, so I may need the client ID from your _ga cookie to find yours.
You can also complain to a supervisory authority. In Romania that is theNational Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest,dataprotection.ro. You may also contact the authority in the EU country where you live or work.
Changing your choice
You can accept or withdraw analytics at any time. Open the preferences with the button below or the "Cookie settings" link at the bottom of every page. After you withdraw, the Google tag stops sending data and the site deletes the Google Analytics cookies it set; you can also delete cookies in your browser settings.
Changes to this notice
If the site starts processing data in a new way, I will update this page and the date at the top. The Romanian version is at sergiuvlad.com/ro/privacy/.