1. Who is responsible
This personal professional website is operated by Victoria Bernal, The Hague, the Netherlands (the “controller” for any personal data described below). Contact: victoria@victoriabernal.nl.
2. Cookies and similar technologies
victoriabernal.nl is a static website. It does not set cookies of any kind — neither functional, analytical nor advertising — and does not use local storage, fingerprinting or comparable techniques. Fonts and all other resources are served from this domain; no third-party services are embedded.
3. Server logs
The site is hosted by Hostinger International Ltd. within the EU. Like virtually all web servers, the hosting infrastructure keeps standard technical logs (IP address, timestamp, requested URL, user agent) for security and operation of the service, on the basis of legitimate interest (art. 6(1)(f) GDPR). These logs are not used by the controller to identify visitors and are retained for the hoster's standard limited period.
4. If you contact Victoria
If you send an email or connect via LinkedIn, the personal data you provide (name, contact details, message content) is used solely to respond to you and to conduct any subsequent professional conversation (art. 6(1)(b) and 6(1)(f) GDPR). It is not shared with third parties, not used for marketing, and is deleted when no longer needed for that purpose.
5. External links
Links to third-party websites (e.g. LinkedIn, company websites) are provided for convenience. Those sites operate under their own privacy policies.
6. Your rights
Under the GDPR you may request access, rectification, erasure, restriction, portability, or object to processing, by writing to victoria@victoriabernal.nl. You may also lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.
7. CV downloads
When you download the CV, the site records one minimal technical entry — timestamp, CV language, an anonymised (truncated) IP address, a basic bot/human classification, the referring page (HTTP Referer header: where the link was clicked, e.g. LinkedIn or a search engine) and the browser's user-agent string — and sends an internal download notification to the controller. Purpose: security and monitoring of CV distribution, on the basis of legitimate interest (art. 6(1)(f) GDPR). From the truncated address the server itself derives — using geolocation and network databases stored locally (DB-IP Lite, CC BY 4.0); no query ever leaves the server and no third-party service receives any visitor data — an approximate location (city, region, country, approximate coordinates and the resulting time zone) and the network organisation (autonomous system, ASN); it also looks up the reverse DNS name of the connecting address and keeps only its domain part, as a rough indication of whether the network belongs to a consumer operator or to an organisation. These derived data are kept in that same entry for the same 60 days, are included in the internal notification and in an internal daily summary of downloads sent to the controller, and are correlated only with this site's own 60-day log (e.g. repeated downloads from the same network); the internal notification may also include small map images that the server itself composes from OpenStreetMap map tiles using only those approximate, city-level coordinates (no visitor data is sent to OpenStreetMap). No cookies, tracking pixels, fingerprinting or third-party analytics are used — neither on this site nor inside the PDF. These entries contain no full IP addresses, are not used to identify visitors, are not shared with any third party, and are deleted after 60 days at the latest.