LEGAL
Privacy Policy
This Privacy Policy explains how personal data may be collected, used, stored and protected when you visit gabrieldeavilabatista.com, contact me or otherwise interact with this website.
Last updated: 6 October 2026
PRIVACY AT A GLANCE
- Personal data is not sold to advertisers.
- The main collection point is the contact/enquiry form and direct correspondence.
- Technical data may be processed to operate and secure the website.
- No behavioural advertising or automated decision-making is intended.
- Optional tracking technologies are addressed in the Cookie Policy.
ON THIS PAGE
- 1. Controller
- 2. Data collected
- 3. Purposes & legal bases
- 4. Contact form & email
- 5. Retention
- 6. Recipients & providers
- 7. International transfers
- 8. Cookies & external services
- 9. Your rights
- 10. Security & children
- 11. Changes & contact
This policy should be read together with the Cookie Policy.
01
Who is responsible for your personal data?
The controller responsible for personal data processed through this website is:
Gabriel de Avila Batista
Environmental Scientist · Biologist · Data Analyst
Based in Poland
No Data Protection Officer has been designated for this website. Privacy questions and requests can be sent directly to the contact address above.
02
What personal data may be collected?
The data processed depends on how you use the website. The categories below describe the information that may be involved.
CONTACT & ENQUIRIES
Information you provide through the contact form
This may include your name, email address, organisation, enquiry type, message and any other information you choose to include.
DIRECT CORRESPONDENCE
Email and professional communication
If you contact me directly, I may process your name, email address, message, attachments you voluntarily provide and ordinary correspondence metadata needed to manage the communication.
TECHNICAL & SECURITY DATA
Information generated when the website is accessed
Hosting, server and security systems may process information such as IP address, browser or device information, timestamps, requested resources, security events and error data where needed to deliver, troubleshoot or protect the website.
COOKIES & SIMILAR TECHNOLOGIES
Information stored or accessed on your device
Details about cookies, local storage, session storage and related technologies are provided separately in the Cookie Policy.
Please avoid sending unnecessary sensitive information. The enquiry form is intended for ordinary professional, project, research, training and employment-related communication. Do not include special-category personal data or confidential third-party information unless it is genuinely necessary and appropriate for the purpose of your message.
03
Why personal data is used & the legal bases
Personal data is processed only where there is an appropriate purpose and legal basis. The basis may differ according to the context of the interaction.
| Purpose | Examples | Legal basis |
|---|---|---|
| Responding to enquiries and discussing requested services | Contact details, message, project context | GDPR Art. 6(1)(b) where you request steps before entering a contract; otherwise Art. 6(1)(f), legitimate interests in responding to professional enquiries |
| Managing professional, research or recruitment correspondence | Email correspondence and relevant contextual information | Art. 6(1)(f), legitimate interests in professional communication and relationship management |
| Providing agreed services or administering an ongoing professional relationship | Contact, project and administrative records | Art. 6(1)(b), contract performance, and where applicable Art. 6(1)(c), legal obligations |
| Operating, maintaining and securing the website | Technical logs, security events, request data | Art. 6(1)(f), legitimate interests in website operation, security, abuse prevention and troubleshooting |
| Meeting accounting, tax, regulatory or other legal requirements | Records required by applicable law | Art. 6(1)(c), compliance with legal obligations |
| Using optional technologies where consent is required | Optional analytics or comparable technologies, if introduced | Art. 6(1)(a), consent, together with applicable rules on device storage/access |
| Establishing, exercising or defending legal claims | Relevant correspondence and project records | Art. 6(1)(f), legitimate interests in protecting legal rights |
Legitimate interests are used only where the relevant interest is considered compatible with your rights and reasonable expectations. Consent, where used, can be withdrawn without affecting the lawfulness of processing carried out before withdrawal.
04
Contact form & email correspondence
The contact page uses SureForms within WordPress. Submitted information is used to deliver and respond to your enquiry. The form is intended to operate with GDPR Compliance enabled and without retaining a persistent copy of submitted entries in the WordPress form-entry database after submission.
SureForms states that form submission data is handled within the website rather than stored on SureForms’ own servers. Connected integrations, if enabled, may create additional data flows and must be assessed separately.
Even where the WordPress form-entry copy is not retained, the message delivered to the professional email account may remain in email correspondence for the period described below. Replies and subsequent messages become part of that correspondence.
DATA MINIMISATION
The form should request only information useful for understanding and responding to the enquiry. Additional files or detailed project materials can be shared later when genuinely needed.
05
How long is personal data kept?
Personal data is not intended to be kept for longer than reasonably necessary for the purpose for which it was collected, subject to legal, accounting, contractual or claim-related requirements.
| Data/context | Retention approach |
|---|---|
| SureForms entry in the WordPress dashboard | No persistent form-entry copy after submission, provided the recommended SureForms setting remains enabled. |
| General enquiries that do not lead to an ongoing relationship | Normally retained in correspondence for up to 12 months after the last meaningful contact, then deleted or archived only where a continuing reason exists. |
| Project, client, collaboration or recruitment correspondence | Kept for the duration of the active matter and afterwards for as long as reasonably necessary for follow-up, record-keeping, legal obligations or the establishment, exercise or defence of claims. |
| Accounting, tax or legally required records | Kept for the period required by the applicable law. |
| Technical, security and hosting logs | Retained according to operational, security and provider requirements. The exact period may be controlled by the hosting or security infrastructure rather than by this website directly. |
| Consent records, where relevant | Kept for as long as reasonably necessary to demonstrate the choice made and manage withdrawal or renewal. |
Retention periods may be shortened where the data is no longer needed and may be extended where a specific legal obligation, dispute or ongoing professional relationship requires it.
06
Who may receive or process personal data?
Personal data is shared only where necessary for a legitimate operational or legal purpose. Relevant categories may include:
Hostinger
Website hosting and professional email infrastructure. Hosting and email services may process information needed to deliver, store, secure and maintain the website and correspondence.
SureForms
Form software used within WordPress. According to SureForms’ documentation, ordinary submission data is stored and processed on the website rather than on SureForms’ own servers; enabled integrations may change the data flow.
Professional advisers or service providers
Accountants, legal advisers, technical support providers or comparable professionals may receive relevant information only where reasonably necessary for the service they provide.
Public authorities
Information may be disclosed where required by applicable law, a valid legal process or a competent authority.
Personal data collected through this website is not sold to advertisers.
07
International data transfers
Some hosting, email, infrastructure or other service providers may process data in more than one country. Where personal data is transferred outside the European Economic Area, the transfer should rely on an applicable legal mechanism or safeguard, such as an adequacy decision, Standard Contractual Clauses or another mechanism recognised under data-protection law.
The exact processing location can depend on the provider, service configuration and sub-processors used at a given time. This policy will be updated where a new service materially changes the relevant transfer arrangements.
09
Your data-protection rights
Depending on the circumstances and legal basis for the processing, you may have the following rights under the GDPR:
Access
Ask whether your personal data is being processed and request access to it.
Rectification
Ask for inaccurate or incomplete personal data to be corrected.
Erasure
Ask for deletion where the applicable legal conditions are met.
Restriction
Ask for processing to be restricted in the circumstances provided by law.
Portability
Receive certain data in a structured format where the legal conditions for portability apply.
Objection
Object to processing based on legitimate interests in circumstances recognised by the GDPR.
Withdraw consent
Withdraw consent at any time where consent is the legal basis, without affecting earlier lawful processing.
Complain
Lodge a complaint with a competent supervisory authority if you believe data-protection rules have been infringed.
These rights are not absolute in every situation. For example, data may need to be retained where processing is required by law or where records are necessary for the establishment, exercise or defence of legal claims.
HOW TO MAKE A REQUEST
Email contact@gabrieldeavilabatista.com and describe the right you wish to exercise. Additional information may be requested where reasonably necessary to verify identity and prevent unauthorised disclosure.
SUPERVISORY AUTHORITY IN POLAND
President of the Personal Data Protection Office (UODO)
You may lodge a complaint with the Polish supervisory authority where appropriate. The UODO website provides current information on exercising GDPR rights and lodging complaints.
10
Security, automated decisions & children
Security
Reasonable technical and organisational measures are used to protect personal data, including controlled account access, secure hosting and appropriate website and email security practices. No internet transmission, website or storage system can be guaranteed to be completely secure.
Automated decision-making and profiling
This website is not intended to make decisions about individuals solely by automated means that produce legal or similarly significant effects, and it is not intended to carry out behavioural profiling.
Children
This is a professional website and is not directed at children. Its enquiry functions are not intended to knowingly collect personal data from children. If you believe that a child has submitted personal data inappropriately, please contact me so that the situation can be reviewed.
11
Changes to this policy & contact
This Privacy Policy may be updated when the website, its forms, hosting, providers, services or processing activities change, or when an update is needed to reflect applicable legal requirements. The date at the top of the page indicates the latest revision.
For privacy questions, requests or concerns, contact:
This policy is intended to provide clear information about the privacy practices of this professional website. It does not constitute legal advice for any visitor’s separate circumstances.