Privacy Policy.

Last updated: 30 October 2026. I may update this policy as the site evolves; the date above reflects the version in force, and material changes will be reflected here. When what audience measurement collects changes, everyone is asked again.

Who I am

I am Nijat Hummatović, an AWS Cloud DevOps Engineer based in Italy, and I run this site as a personal and professional portfolio. Under the EU General Data Protection Regulation (GDPR) and the Italian Codice Privacy (d.lgs. 196/2003, as amended by d.lgs. 101/2018), I am the data controller for any personal data processed through this site.

The site is non-commercial. I am employed, I sell nothing through it, offer no paid services on it, and receive no payment, advertising revenue or other remuneration from it. It presents my own career and writing, and lets people contact me.

Although this is a personal site, the GDPR applies because the site is publicly accessible, processes personal data from third parties (contact form submissions and CV requests), and serves a professional purpose. The obligations described here are proportionate to the minimal data the site actually handles.

You can reach me at any time at mail@hummatovic.com, which is the contact channel for every privacy matter. Because I am an individual and not a company, I do not publish a physical address. I have not appointed a Data Protection Officer, because the GDPR (Article 37) does not require one for processing of this kind and scale. My supervisory authority is the Garante per la protezione dei dati personali, the Italian data protection authority.

What this site does and does not do

This is a portfolio site with no database of visitors or messages. It has no advertising, no newsletter, no profiling, and no tracking across sites. It counts visits with Cloudflare Web Analytics only if you allow it (see section 6). Form submissions are delivered to me by email only, and the emails this site sends contain no tracking pixels and no click-tracking links. The one link whose use is recorded is the personal CV download link, as explained in section 2 below.

Fonts and images are served from this site itself, not from Google Fonts or any other outside provider, so no third party learns about your visit when a page loads. The only outside code the site loads is Cloudflare Turnstile, the bot check on the forms (see section 3), and, only if you allow it, Cloudflare Web Analytics (see section 6). Links to other sites, such as LinkedIn, GitHub or Credly, are ordinary links: nothing is loaded from those sites until you click one, and once you do, that site's own privacy policy applies.

The site stores at most four small values in your own browser (local storage). None of them is ever sent to me or to anyone else:

• theme: whether you chose the light or dark theme.
• blog-reader-prefs: your blog reading mode, text size and width.
• an-last-shown: the time a short note on blog posts was last shown, so it appears at most once a day.
• consent-1: your audience-measurement choice (Allow or Decline) and its date, for 6 months; then you are asked again.

Each is written only when you use the related feature: switching the theme, opening a blog post, seeing the note, or answering the audience-measurement question. They remember your own choices, so they need no consent (Article 122 Codice Privacy; Garante cookie guidelines, 10 June 2021). You can delete them at any time by clearing this site's data in your browser settings.

The site's own code does not set any cookies. Cloudflare, which hosts and serves the site, can set security cookies that it describes as strictly necessary and does not use to track you across sites. The one you are most likely to get is cf_clearance, set when you pass a Cloudflare security check before a page loads (for example, for visits from outside the countries listed in section 4). It records that you passed the check and expires after a limited time. Cloudflare's bot-management cookies, such as __cf_bm, belong to features this site does not use. Cloudflare lists every cookie it can set, with its purpose and duration, in its cookie documentation. Audience measurement sets no cookies either, but because its script reads information from your device, it runs only after you choose Allow (see section 6).

A practical note: please do not include sensitive information in the contact form or the CV request form. Passwords, credentials, identity documents, payment details and similar data are never needed to reach me or to receive my CV. Including them creates an unnecessary risk for you and serves no purpose here.

Your right to object

Where I rely on legitimate interest (the forms, the CV request, spam protection, serving the site, technical logs and the photos), you can object at any time, on grounds relating to your situation, by writing to mail@hummatovic.com (Article 21 GDPR). Audience measurement runs on your consent instead: withdraw it with Privacy choices.

Processing activities

Every way personal data passes through this site is listed below, with the purpose, the data involved, the legal basis, how long I keep it, and who receives it.

1. Contact form

When you use the contact form on /connect, you send me your name, email address, a subject, and a message. The same applies when you choose "Reserve a call" or "Something else" on /linktree; the call request can also ask for your company, which is optional.

Purpose: to let you reach me and to let me reply. If you request a call, the site also sends one automatic confirmation email to the address you entered, so you know the request arrived. No other form sends you an automatic email.

Data involved: your name, email address, subject and message, plus your company if the form asks for it and you fill it in. If you email me directly instead of using a form, the same purpose, legal basis and retention apply to that email.

Legal basis: legitimate interest under Article 6(1)(f) GDPR. I have a legitimate interest in responding to people who contact me, and you set that process in motion by writing to me.

Retention: I keep the email in my inbox for up to 24 months after our exchange ends, then I delete it. I will delete it sooner if you ask.

Recipients: the email is sent via Amazon Web Services (SES) from the Frankfurt region (eu-central-1) and is routed through a Cloudflare Worker, and Cloudflare Turnstile runs a bot check (see section 3). For more detail on how each provider handles data, including processing they perform independently of my instructions, see the "Who else touches this data" section below.

2. CV request

When you request my CV through the /whoami page, or by choosing "Hiring for a role" on /linktree, you provide your name, work email address, company name, and optionally your phone number and a short note about the role. Only business email addresses are accepted. Personal addresses (like Gmail or Outlook) and forwarding or temporary addresses are rejected, because the CV is intended for professional hiring contacts.

Purpose: to send you my CV, to keep a record of who I have shared it with, and to follow up with you about the role. This form is for requesting my CV only: I never ask you to upload or send me your own CV through this site.

Data involved: your name, work email, company, and any phone number or role note you choose to include.

Legal basis: legitimate interest under Article 6(1)(f) GDPR. I have a legitimate interest in sending my CV to the people who ask for it, in following up on the opportunity, and in knowing who holds my CV, both to protect my personal data and to protect the CV as my own copyrighted work.

Retention: I keep the lead notification email for up to 48 months, then I delete it. This is longer than for ordinary messages because its purpose outlasts the hiring conversation: a copy of my CV can stay in circulation for years, and this record is how I know who received it if it is ever misused. I will delete it sooner if you ask.

How the CV reaches you: the email contains a personal download link rather than an attachment. The link is sent only to the email address entered in the form and is tied to it by a cryptographic signature, so it cannot be forged or edited. It stops working after 8 hours or 10 downloads, whichever comes first. The PDF is never published at a public address: it is served only by the Worker, and only against a valid link.

Downloads are logged: each time a link is used, or tried after it has expired or run out of downloads, the Worker records that, when, and which email address the link was issued to, together with the technical request details described in section 5 (including your IP address). The purpose is the same as the record above: to know who holds my CV. These log entries are kept for 3 days. A download counter, which does not contain your email address, is deleted automatically 9 hours after the link was last used, so never more than about 17 hours after the link was sent.

Recipients: the CV link is emailed to you via Amazon Web Services (SES) from the Frankfurt region. A copy of your details is also emailed to me so I know who requested it. A Cloudflare Worker handles the validation, the link, and the routing, and Cloudflare Turnstile runs a bot check (see the next section). For more detail on how each provider handles data, see the "Who else touches this data" section below.

3. Spam and bot protection

Every form on this site (contact, call request and CV request) includes protections against spam and automated abuse.

Purpose: to stop bots from flooding the forms or using them to send spam.

Data involved: your IP address, used briefly for rate limiting, and the country Cloudflare derives from it. Each IP address can send at most 5 submissions per form every 15 minutes. Cloudflare also briefly blocks an IP address that sends more than 10 requests in 10 seconds to the form services or the homepage. Every form uses an invisible spam trap (a hidden field that bots fill in but humans never see) and rejects a form sent faster than a person could fill it in (2 to 2.5 seconds, depending on the form). Every form also uses Cloudflare Turnstile, which processes signals such as your IP address, your browser's TLS fingerprint and user agent, and the site the check runs on, to detect and block bots. When you send a form, the Worker passes your IP address to Turnstile along with the check result, so Cloudflare can confirm the check was solved by the same visitor. On /connect the Turnstile check loads with the page. In the forms that open in a dialog, it loads only once the form itself is on screen.

Legal basis: legitimate interest under Article 6(1)(f) GDPR. Security of the site and protection against abuse.

Retention: for rate limiting, your IP address is held as a short-lived counter in Cloudflare's key-value storage and deleted automatically after at most 15 minutes. Cloudflare's edge rate limit counts requests per IP address over 10-second windows inside Cloudflare's network; I never see or store those counts. No IP address is stored long term. Cloudflare processes Turnstile data on my behalf to protect the forms, and also, as its own controller, to improve its bot detection. It handles that data as described in its Turnstile Privacy Addendum and its privacy policy. The minimum fill time check does not record any personal data; it only compares a client-measured timestamp, which is not stored.

Where the forms work: to limit abuse, the forms and the CV download links accept requests only from the EU and EEA, the UK, Switzerland, the United States, Canada, Azerbaijan and Turkey. Requests from elsewhere are refused based on the country derived from the IP address. If that blocks you, email me directly.

4. Serving and securing the site

The site is hosted and served through Cloudflare.

Purpose: to deliver the site to you and keep it secure.

Data involved: your connection data and IP address, processed by Cloudflare as the host and content delivery network. Firewall rules use the country derived from your IP address, Cloudflare's threat score for it, and your browser's user agent to block known attack patterns. Visits from a fixed list of countries are blocked outright, and visits from outside the EU and EEA, the UK, Switzerland, the United States, Azerbaijan and Turkey may be shown a Cloudflare security check before the page loads. Passing that check sets the strictly necessary cf_clearance cookie described above. None of this is used to track you across sites.

Legal basis: legitimate interest under Article 6(1)(f) GDPR.

Retention: I do not keep any record of page visits myself. Cloudflare's security dashboard lets me view a sample of the requests made to the site, and the requests it blocked or challenged, including the IP address, country and user agent, for up to 31 days (see Cloudflare's Security Analytics documentation). I use that view only to investigate attacks, and I do not export or store it. Everything else is handled by Cloudflare under its own retention policies, described in Cloudflare's privacy policy.

5. Technical logs of the form services

The two Cloudflare Workers that receive the forms and serve the CV links keep technical logs.

Purpose: to find and fix delivery failures, and to investigate abuse.

Data involved: request details such as the time, the web address requested, your IP address and approximate location, error messages, and, for CV links, the email address the link was issued to. The text of your message is not written to these logs.

Legal basis: legitimate interest under Article 6(1)(f) GDPR. Keeping the forms working and secure.

Retention: 3 days, then deleted automatically by Cloudflare.

6. Audience measurement

What: if you choose Allow, your browser loads Cloudflare Web Analytics. For each page you view it reports the page address (without query strings), the page you came from, load and responsiveness timings (Core Web Vitals), and, derived by Cloudflare from the request, your country, browser, operating system and device type. I see these as counts and charts in Cloudflare's dashboard, not as a record of you.

How it is built: according to Cloudflare, Web Analytics uses no cookies or other client-side state such as local storage, does not log query strings, and does not fingerprint visitors through their IP address, user agent or any other data for the purpose of displaying analytics. Like any request, each report reaches Cloudflare with your IP address. Details are on Cloudflare's Web Analytics page and in its FAQ.

Legal basis: your consent (Article 6(1)(a) GDPR; Article 122 Codice Privacy, because the script reads information from your device). Until you choose Allow, the script is not loaded at all.

Your choice: Allow and Decline are offered side by side and look the same. Closing the question with its × counts as Decline. The site works the same either way. You can change your choice at any time with Privacy choices at the bottom of every page or the button below; a change takes effect at once. Your choice is remembered for 6 months, then you are asked again. If your browser sends Global Privacy Control or Do Not Track, measurement stays off and you are not asked; you can still turn it on yourself with Privacy choices.

Change your choice

Retention: Cloudflare keeps the full reports for 7 days, then aggregates them down to about 10% of their original volume for long-term storage. Its dashboard shows the previous six months.

Recipient: Cloudflare, acting on my instructions under its data processing addendum (see "Who else touches this data" below).

How long each piece of data is kept

• Messages from the contact and call forms, and emails you send me directly: up to 24 months after our exchange ends.
• CV request details (the lead notification): up to 48 months.
• Email delivery reports from AWS: deleted together with the correspondence they relate to.
• Technical logs, including CV download records: 3 days.
• CV download counter (no email address): 9 hours after the link was last used, so at most about 17 hours after it was sent.
• IP address for rate limiting: at most 15 minutes.
• Audience measurement (only if you allowed it): full reports 7 days, then aggregated to about 10% of the original volume; shown for six months. Kept by Cloudflare.
• Email Routing log for email to mail@hummatovic.com: 31 days, kept by Cloudflare.
• Security dashboard (sampled and blocked requests): up to 31 days, kept by Cloudflare.
• Suppression list (only if an email to you hard-bounced or was reported as spam): your email address, until I remove it, which I do on request.
• Values in your browser's local storage: kept on your device until you clear them. I never receive them.
• Cloudflare and Turnstile data at the network level: under Cloudflare's own retention policies.

These periods are maximums, not minimums. I may delete any of this data earlier, for example when I clear my inbox, and once it is deleted I no longer hold it.

I delete messages, CV request details and delivery reports sooner if you ask, and remove your address from the suppression list, unless I need them to establish, exercise or defend a legal claim. The short-lived items (logs, counters and rate-limit entries) are deleted automatically on the schedule above.

Who else touches this data

The service providers below are involved in delivering this site and its forms. Where they act as processors under my instructions (for example, sending an email I initiated, or running code I deployed), data processing agreements are in place. Where they operate their own infrastructure independently (CDN security, DDoS protection, service logging), their own privacy documentation applies:

• Amazon Web Services (AWS SES), Frankfurt region (eu-central-1): sends the contact form email to my inbox, and sends the CV email and the call request confirmation to the address you provide. Open and click tracking is switched off for every email sent. AWS reports the delivery status of each email to me, including your email address and the email's subject line: whether your mail server accepted it, bounced it, or it was reported as spam. This status comes from the receiving mail server, not from your device, and tells me nothing about whether you opened the email. I use it to confirm my emails reach you and to protect the site's ability to deliver email. These reports reach only mailboxes I own and are deleted on the same schedule as the correspondence they relate to. If an email to you hard-bounces (for example, because the address does not exist) or is reported as spam, AWS adds your address to my account's suppression list so it is not emailed again. It stays there until I remove it, which I do on request. AWS also keeps an address that hard-bounces on its own global suppression list for up to 14 days. AWS processes email metadata for service operation and billing under its own policies. See the AWS Privacy Notice and AWS's GDPR compliance page.
• Cloudflare: hosts and serves the site (Cloudflare Workers, CDN, and DNS), runs the bot check on the forms (Cloudflare Turnstile), routes the form submissions, keeps the technical logs described in section 5, measures visits with Web Analytics if you allow it (section 6), and receives email sent to mail@hummatovic.com (Cloudflare Email Routing). Because Cloudflare serves the whole site, it processes every visitor's IP address and connection data as the host, in data centers worldwide, including in the United States. See Cloudflare's privacy policy, its Turnstile Privacy Addendum (which also covers its security checks, and explains that Cloudflare uses Turnstile data as its own controller to improve its bot detection) and Cloudflare's DPA.

Email to mail@hummatovic.com, including every form submission, is received by Cloudflare Email Routing and forwarded to my personal mailbox, which is hosted by an email provider that stores it for me. Cloudflare states that Email Routing does not store or access the content of the emails it forwards. It does keep a log of each forwarded email (sender, recipient, subject line, time and delivery status) for 31 days, which I can view in its dashboard; for form messages, the subject line includes your name (see Cloudflare's Email Service analytics documentation). My mailbox is where the retention periods above apply. If you would like to know which provider it is, email me and I will tell you. If that provider stores mail outside the EEA, the transfer relies on an EU adequacy decision for its country or on the provider's Standard Contractual Clauses.

How your data is protected

• The site is served only over HTTPS, and browsers are told to always use an encrypted connection for it.
• There is no database. A form submission exists only as an email, and the short-lived counters described above contain no message content.
• AWS is set to deliver this site's emails only over an encrypted connection. If the receiving mail server cannot accept one, the email is not sent at all rather than sent unencrypted.
• CV download links are signed, tied to one email address, and expire on their own, as described in section 2.

International data transfers

Email content is sent through AWS SES from a Frankfurt, Germany region. However, form submissions first pass through a Cloudflare Worker, which may process data at Cloudflare data centers globally before reaching AWS SES. Cloudflare operates a global network, including in the United States, and AWS may access data for support purposes outside the EU. Audience measurement reports, if you allow them, are processed on the same Cloudflare network.

Where data leaves the EEA, the transfer relies on the EU-U.S. Data Privacy Framework (with its UK Extension and the Swiss-U.S. Data Privacy Framework), to which both AWS and Cloudflare are certified, and on the EU Standard Contractual Clauses included in each provider's data processing agreement, which also cover countries outside the United States. These safeguards are designed to keep the level of protection the GDPR requires. If you would like a copy of these safeguards, email me and I will send it. You can verify the current certification status of both providers on the Data Privacy Framework list. For the detailed terms, see AWS's Data Privacy Framework page, AWS's GDPR compliance page and Cloudflare's Data Processing Addendum.

If I send you my CV

The CV I email you is both my personal data and my own copyrighted work, shared with you for a single purpose: to consider me for a role or opportunity. I ask that you keep it confidential, use it only for that purpose, do not publish it or pass it outside your own hiring process without my consent, and delete it once it is no longer needed. Its wording and layout are protected by copyright, so redistributing them is not yours to do. Once you hold my details, data protection law generally makes you their controller, responsible for handling them lawfully and not keeping them longer than needed.

Your rights

Under the GDPR you have the following rights:

• Right of access (Article 15): you can ask me whether I hold any of your data and, if so, get a copy of it.
• Right to rectification (Article 16): you can ask me to correct any inaccurate data I hold about you.
• Right to erasure (Article 17): you can ask me to delete your data.
• Right to restriction of processing (Article 18): you can ask me to limit how your data is used while a concern is looked into.
• Right to object (Article 21): everything on this site except audience measurement is based on legitimate interest, and you have the right to object to it at any time. If you object, I will stop processing your data unless I can show compelling legitimate grounds that override your interests, rights and freedoms, or I need the data to establish, exercise or defend legal claims.
• Right to withdraw consent (Article 7(3)): for audience measurement, with Privacy choices, as easily as you gave it. Withdrawal does not affect measurement that happened before.

The right to data portability (Article 20) covers only processing based on consent or a contract. The only consent-based processing here is audience measurement, which I see only as counts and charts that cannot be linked to you, so there is no data about you to hand over (Article 11 GDPR).

To exercise any of these rights, email me at mail@hummatovic.com, ideally from the address you used on this site, so I can confirm the request is really yours. If you write from a different address, I may ask you to confirm from the original one before I share or delete anything. Exercising your rights is free of charge. I will respond within one month of receiving your request. If a request is complex, I may extend that by up to two further months, and I will tell you within the first month if I do (Article 12(3) GDPR).

Providing your data is voluntary. If you choose not to provide it, the only consequence is that I cannot reply to your message or cannot send you my CV. There is no profiling on this site, and no automated decision making within the meaning of Article 22 GDPR. The forms do check automatically that an email address looks valid (and, for the CV, that it is a business address), but that only decides whether the form can be sent. You can always email me directly instead.

If you believe I have not handled your data properly, you have the right to complain to the Garante per la protezione dei dati personali, the Italian data protection authority. You may also contact your local EU supervisory authority or, in the UK, the Information Commission (formerly the Information Commissioner's Office), where the UK GDPR gives you the same rights. You are also welcome to raise a complaint with me first at mail@hummatovic.com; I acknowledge every complaint within 30 days and tell you the outcome without undue delay.

Your rights in the United States

I do not sell or share personal information, as the California Consumer Privacy Act (CCPA, as amended by the CPRA) and similar state laws define those words, and I do not use it for targeted advertising or profiling. I collect no sensitive personal information.

In the last 12 months this site has collected these categories, for the purposes above: identifiers (the name, email address and phone number you send; your IP address, for security, rate limiting and the technical logs described above), professional information (the company and role note you send with a CV request), internet activity (pages viewed, referrer and device type, only with your consent), approximate location (country, derived from your IP address), and the content of your messages. They come from you and your browser.

Wherever you live, you can ask to know what I hold, to delete it and to correct it, and you can use an authorized agent to ask for you. I do not treat you differently for using these rights. If I decline a request, reply to my answer to appeal; I answer the appeal within 60 days and say why. If the appeal is declined, you can contact your state attorney general.

Global Privacy Control and Do Not Track: this site reads both. With either signal on, audience measurement stays off unless you turn it on yourself (California Online Privacy Protection Act disclosure). No one collects information about your activity on this site over time and across other sites.

Children

This site is meant for adults and professionals, not for children. I do not knowingly collect personal data from children: under 14 in Italy (Article 2-quinquies Codice Privacy), under the age your country sets elsewhere in the EU (Article 8 GDPR, at most 16), and under 13 in the United States (COPPA). If you believe a child has sent me their data, tell me and I will delete it.

Photos on this site

The gallery on /whoami is personal: conferences, travel, colleagues, moments from my career. Its purpose is to show my professional path. The legal basis is my legitimate interest under Article 6(1)(f) GDPR in presenting my own career. If you appear in a photo here and would rather it were not public, tell me and I will take it down or crop it, no questions asked. Reach me at mail@hummatovic.com.

No ads, no sponsorships, no paid mentions

Nothing on this site is sponsored. I do not run ads, use affiliate or referral links, or get paid to mention a tool, company, or person. Any external link or reference in a post is here because I found it useful or relevant, never because of a payment or partnership.

The design, code, and writing here

© 2026 Nijat Hummatović. All rights reserved. The visual design, source code, and blog writing on this site are my own work and are not open source or licensed for reuse. You are welcome to read, share a link, or quote a short passage with credit. Copying the design, code, or full posts elsewhere is not permitted without asking first. These terms are governed by the laws of Italy.

Product names and certification badges shown on this site, such as AWS, Microsoft Azure, Kubernetes and Terraform, are trademarks of their respective owners. Product names appear in plain text only, to name the technologies I work with. Certification badges are shown only for credentials I hold, each linked to the issuer's verification page. Neither implies that any of those owners endorses this site.