Privacy Policy
Last updated: June 2026
This Privacy Policy explains how Dr. Sebastian Brickel ("I", "me", "the controller") collects, uses, and protects personal data when you visit sbrickel.github.io. It complies with the EU General Data Protection Regulation (GDPR) and Spain's Organic Law 3/2018 (LOPDGDD).
1. Data Controller
2. Data Collected and Purposes
I collect and process personal data in the following circumstances:
| Data |
Source |
Purpose |
Legal Basis |
| Contact form submissions (name, email, message) |
Tally.so form on this site |
Responding to your enquiry |
Legitimate interest / pre-contractual steps (Art. 6(1)(b)(f) GDPR) |
| IP address, browser type, pages visited |
GitHub Pages server logs |
Site security and abuse prevention |
Legitimate interest (Art. 6(1)(f) GDPR) |
| Cookie preferences |
Cookie consent banner |
Respecting your consent choices |
Legal obligation / consent (Art. 6(1)(a)(c) GDPR) |
| YouTube embed interaction data |
YouTube (youtube-nocookie.com) if you interact with the embedded video |
Video playback functionality |
Consent (Art. 6(1)(a) GDPR) |
| Anonymous checklist scores (aggregated totals per dimension only) |
AI Adoption Readiness Checklist on this site |
Research into AI readiness patterns; improving the checklist |
Legitimate interest (Art. 6(1)(f) GDPR) - no personal data is collected |
I do not sell personal data. I do not use personal data for automated profiling or decision-making.
3. Third-Party Services
This website integrates the following third-party services that may process personal data:
- GitHub Pages (hosting) - GitHub, Inc., USA. Subject to GitHub's Privacy Policy. Data may be transferred to the USA under standard contractual clauses.
- Cal.com (booking system) - Cal.com, Inc., USA. When you book an intro conversation, Cal.com processes your name, email address, and any answers to booking questions. Cal.com connects to Google Calendar to check availability. See Cal.com's Privacy Policy.
- Tally.so (contact form) - Tally SRL, Belgium. The in-page form pop-up loads only after you accept non-essential cookies; without consent, the contact button links to Tally's own website instead. Data submitted via the form is processed by Tally. See Tally's Privacy Policy.
- Buy Me a Coffee (support widget) - Buy Me a Coffee, Inc., USA. See BMAC Privacy Policy.
- YouTube / Google (embedded video, youtube-nocookie.com) - Google Ireland Ltd, Ireland. The video player loads only when you actively click to load it; until then, no request is made to YouTube. The nocookie domain further limits tracking. See Google's Privacy Policy.
- Google Fonts (web font delivery) - Google Ireland Ltd. Loading the Montserrat typeface from Google's CDN transmits your IP address to Google for content delivery. No cookies are set. See Google's Privacy Policy.
- Cloudflare Workers (checklist submission relay) - Cloudflare, Inc., USA. When you submit the AI Adoption Readiness Checklist, your anonymous aggregated scores are relayed through a Cloudflare Worker. Cloudflare technically processes your IP address in transit but it is not stored with the submission. See Cloudflare's Privacy Policy.
- Odoo (self-hosted CRM) - the anonymous checklist scores are stored in a self-hosted Odoo instance operated by the data controller. No personal or identifying data is stored with the scores.
4. Data Retention
- Contact form data: Retained for as long as necessary to respond to your enquiry and for a reasonable period thereafter (maximum 2 years), unless a longer retention period is required by law.
- Server logs (GitHub Pages): Governed by GitHub's data retention policies.
- Cookie consent records: Retained for 12 months.
5. International Transfers
Some third-party services (GitHub, Buy Me a Coffee, Cloudflare) are based in the United States. Data transfers to the USA take place on the basis of standard contractual clauses (SCCs) or other appropriate safeguards recognised under GDPR Chapter V.
6. Your Rights
Under GDPR and the LOPDGDD, you have the right to:
- Access - request a copy of the personal data I hold about you
- Rectification - correct inaccurate or incomplete data
- Erasure ("right to be forgotten") - request deletion of your data where no legitimate retention basis applies
- Restriction - request that I limit how your data is processed
- Portability - receive your data in a structured, machine-readable format
- Objection - object to processing based on legitimate interests
- Withdraw consent - at any time, where processing is based on consent
To exercise any of these rights, contact me at remoteconsultant.sebastian@gmail.com. I will respond within 30 days.
You also have the right to lodge a complaint with the Spanish Data Protection Authority: Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid.
7. Security
I implement reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or destruction. However, no internet transmission is completely secure, and I cannot guarantee absolute security.
8. Children
This website is not directed at individuals under the age of 14. I do not knowingly collect personal data from minors. If you believe a minor has submitted personal data to this site, please contact me so I can delete it.
9. Changes to This Policy
I may update this Privacy Policy from time to time. The "Last updated" date at the top will reflect any changes. Continued use of the site after an update constitutes acceptance of the revised policy.
10. Contact
For any privacy-related questions: remoteconsultant.sebastian@gmail.com