Privacy Policy

Welcome to carlos.lehder.co (the "Site"). This policy explains what data we collect, why, how we protect it, and what choices you have — including the choices you have over the personalised advertising served by third parties on this Site.

1. What we collect ourselves

• Data you submit: your email address if you subscribe to the newsletter or use the contact form; any message you write us.
• Data automatically logged: your IP address (truncated to /24 within 24 hours), user-agent string, and the URLs you visit, for operational security and abuse detection. Retained for a maximum of 14 days.

2. Third-party advertising (Adsterra)

This Site uses Adsterra to serve advertisements. Each ad loads in its own frame from Adsterra's servers:

• Adsterra and its partners may set or read cookies and use device identifiers to serve, measure and protect ads against fraud.
• Adsterra has its own privacy policy and cookie disclosure: adsterra.com/privacy-policy.
• We may in future also use affiliate programs such as Amazon Associates. Each such partner has its own privacy policy and cookie disclosure.

Ads load only after you consent in the cookie form shown on your first visit (Consent, or Manage options to choose). Without consent no ads are shown. Your choice is stored in your browser's localStorage under the key cl_consent_v1. You can change it at any time with the Privacy & cookie settings link at the bottom of every page.

3. What we do not do

• We do not sell your data to data brokers.
• We do not build our own advertising profile of you.
• We do not require you to accept advertising cookies in order to read the Site.

4. How we protect what we do hold

The Site is hosted on Vercel with TLS 1.3 in front, HSTS enabled, and no long-lived server-side logs. Newsletter emails are stored encrypted at rest. Access to any personal data is restricted to the editorial and operations staff of carlos.lehder.co on a need-to-know basis.

5. Legal bases (GDPR / Swiss FADP)

• Consent (Art. 6(1)(a) GDPR): advertising and analytics cookies.
• Legitimate interest (Art. 6(1)(f) GDPR): short-term security logs, spam prevention on the contact form.
• Contract / pre-contract (Art. 6(1)(b) GDPR): newsletter subscription you initiated.

6. Your rights

Under GDPR, the Swiss FADP, and equivalent frameworks you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and to data portability. To exercise these rights, write to the contact address below.

7. Children

The Site is not directed at children under 16. We do not knowingly collect data from children under 16. If a parent or guardian believes such data has been submitted, please contact us for immediate deletion.

8. Changes to this policy

We may revise this policy from time to time. The "Last Updated" date at the top of the page reflects the most recent revision. Material changes will be surfaced on the Site.

9. Contact

For any privacy question, correction request, or data-rights request, write to:

legal@carloslehder.co

(Response within 30 days as required by Art. 12 GDPR.)