Privacy Policy | COLBYLICIOUS

Who I am

This website, COLBYLICIOUS, is available at [https://colbylicious.com] (the “Site”). It is a personal blog run by an individual, not by a company.

This Privacy Policy explains what personal data I collect from visitors, why I collect it, and what rights you have regarding that data.

The Site is written and operated by a private individual publishing under the pen name COLBYLICIOUS, resident in Romania. I am the person responsible for your personal data (the “data controller”).

Contact: hello [at] colbylicious.com
Country of residence: Romania

I write under a pen name for personal reasons and do not publish my legal name on this Site. This does not limit your rights in any way. I will disclose my full legal identity to any data subject who makes a substantiated request in connection with exercising their rights under the GDPR, and to the competent supervisory authority on request. Messages sent to the address above reach me directly and are answered by me personally.

If you have any questions about this policy or about how I handle your data, you can contact me at the email address above.

What personal data I collect and why

Comments

When visitors leave comments on the Site, I collect the data shown in the comment form, as well as the visitor’s IP address and browser user agent string to help with spam detection.

An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to check whether you are using it. The Gravatar service privacy policy is available at https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment.

Legal basis: your consent, given when you submit the comment form.

Contact forms

If you contact me through a form on the Site, I collect the information you provide (typically your name, email address, and the content of your message) in order to reply to you. I do not use this information for marketing purposes unless you have separately subscribed to my newsletter.

Messages sent to me pass through an email aliasing and forwarding service operated by a company established in France, using servers located in the European Union and Switzerland. This service only relays messages and does not store them. Messages are then delivered to a mailbox hosted by an email hosting provider whose servers are located in the United States, where they are stored until I delete them. This means the content of your message and your email address are stored outside the European Economic Area. See Section 6 for details on how this transfer is safeguarded.

Media

If you upload images to the Site, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the Site can download and extract any location data from images uploaded to the Site.

Cookies

If you leave a comment on the Site, you may opt in to saving your name, email address, and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies last for one year.

If you visit the login page, a temporary cookie is set to determine whether your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

When I log in to administer the Site, several cookies are set to save login information and screen display choices. Login cookies last for two days, and screen options cookies last for a year. These cookies apply only to administrator accounts and are not set for ordinary visitors.

You can control and delete cookies through your browser settings at any time. Please note that disabling certain cookies may affect how the Site functions.

Embedded content from other websites

Articles on this Site may include embedded content (e.g. videos, images, articles, social media posts). Embedded content from other websites behaves in the exact same way as if the visitor had visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

Analytics

I use Google Analytics 4, a service provided by Google Ireland Limited (with Google LLC in the United States acting as a sub-processor), to understand how visitors use the Site so I can improve its content and performance. This service collects information such as pages visited, time spent on the Site, approximate location derived from your IP address, referring website, device type, and browser, and stores cookies on your device.

Google Analytics 4 does not store your full IP address; it is truncated before being recorded. I have not enabled advertising features or Google Signals, and analytics data is not used to identify you personally or combined with advertising profiles.

Legal basis: your consent. Analytics cookies are set only after you accept them through the cookie banner, and no analytics data is collected if you decline.

Google’s privacy policy is available at https://policies.google.com/privacy. You can also install Google’s browser opt-out add-on at https://tools.google.com/dlpage/gaoptout.

If you subscribe to my newsletter, I collect your email address and, optionally, your name. I use MailerPress to manage subscriptions and Amazon Simple Email Service (Amazon SES), operated by Amazon Web Services EMEA SARL, configured to use a region located within the European Union. Subscriber data processed through this service is stored on servers in the European Union.

Sending an email also involves processing basic delivery information such as whether a message was delivered, bounced, or reported as spam, so that I can keep the mailing list clean and avoid sending to invalid addresses.

You can unsubscribe at any time by clicking the unsubscribe link at the bottom of any email I send, or by contacting me directly. When you unsubscribe, your data is removed from the mailing list.

Legal basis: your consent.

Affiliate links

This Site might contains affiliate links.

Affiliate links mean I may earn a commission if you make a purchase after clicking them, at no additional cost to you. Clicking such links may share limited data (such as a referral identifier) with the merchant.

Server logs and security

My hosting provider automatically records certain technical information when you access the Site, including your IP address, browser type, operating system, and the date and time of the request. This information is used to keep the Site secure, diagnose technical problems, and prevent abuse.

Legal basis: my legitimate interest in maintaining the security and stability of the Site.

Content Delivery Network and Bot Protection

The Site uses Cloudflare, a service provided by Cloudflare, Inc., as a content delivery network and security layer. This means that requests to the Site are routed through Cloudflare’s servers before reaching the origin server. Cloudflare processes your IP address, the pages you request, your browser and device characteristics, and similar technical data in order to deliver content quickly, filter malicious traffic, and protect the Site against attacks. For visitors in Europe, requests are normally handled by Cloudflare servers located in Europe.

Cloudflare may set strictly necessary cookies for security purposes. These may include a bot management cookie that expires after approximately 30 minutes of inactivity, and a challenge clearance cookie recording that a security check has been passed. These cookies contain no advertising identifiers, are not used to track you across other websites, and are not shared for marketing purposes.

I also use Cloudflare Turnstile to verify that forms on the Site are submitted by a person rather than an automated script. Turnstile runs a background check using browser signals and your IP address. It does not display puzzles, does not set persistent tracking cookies, does not build a profile of you, and is not used for advertising.

Legal basis: my legitimate interest in protecting the Site from automated abuse, spam, and attacks. Because these measures are strictly necessary to provide the Site securely, they operate without a separate consent request. You may object to this processing at any time by contacting me, although the Site may not function correctly without it.

Cloudflare’s privacy policy is available at https://www.cloudflare.com/privacypolicy/.

I do not sell your personal data. Data is shared only with the service providers that make the Site work, and only to the extent necessary. These may include:

Web hosting: the Site is hosted by a professional hosting provider whose servers are located within the European Union. This provider processes data solely on my instructions, under a data processing agreement, and has no independent right to use it.
Content delivery and security: Cloudflare, Inc., which routes and filters all traffic to the Site.
Analytics: Google Analytics 4 (Google Ireland Limited, with Google LLC in the United States as sub-processor).
Newsletter delivery: Amazon Simple Email Service (Amazon Web Services EMEA SARL), using a region located in the European Union.
Email forwarding: an email aliasing service operated by a company established in France, using servers in the European Union and Switzerland. It relays messages without storing them.
Email hosting: an email hosting provider whose servers are located in the United States, which stores messages sent to me.
Comment avatars: Gravatar (Automattic)

I may also disclose personal data if required to do so by law, or if I believe in good faith that disclosure is necessary to protect my rights, your safety, or the safety of others.

If you wish to know the identity of a specific service provider used by the Site, you may request it at the contact address in Section 1 and I will provide it.

Visitor comments may be checked through an automated spam detection service.

How long I keep your data

Comments: if you leave a comment, the comment and its metadata are retained indefinitely so that follow-up comments can be recognized and approved automatically instead of being held in a moderation queue.
Contact form messages: retained for 12 months after our last correspondence.
Newsletter subscriptions: retained until you unsubscribe.
Analytics data: retained for 12 months, according to the settings of the analytics provider.

Your rights over your data

If you are located in the European Economic Area or the United Kingdom, you have the following rights under the GDPR:

Right of access – to request a copy of the personal data I hold about you.
Right to rectification – to have inaccurate or incomplete data corrected.
Right to erasure – to request deletion of your personal data (“right to be forgotten”).
Right to restriction of processing – to ask me to limit how your data is used.
Right to data portability – to receive your data in a structured, machine-readable format.
Right to object – to object to processing based on legitimate interests, and to object to direct marketing at any time.
Right to withdraw consent – where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal.

If you have an account on this Site or have left comments, you can request an exported file of the personal data held about you, including any data you have provided. You can also request erasure of any personal data held about you. This does not include data that must be kept for administrative, legal, or security reasons.

To exercise any of these rights, contact me at hello [at] colbylicious.com. I will respond within one month of receiving your request, as required by law.

Where your data is sent

Website hosting, newsletter delivery, and email forwarding take place on servers located within the European Union or Switzerland, a country recognized by the European Commission as providing an adequate level of data protection. Data processed through those services does not leave that protected area.

Three services involve transfers to, or potential access from, the United States:

Cloudflare, the content delivery and security provider, which is a United States company. Requests from European visitors are normally processed on Cloudflare servers located in Europe, but Cloudflare, Inc. remains subject to United States jurisdiction;
Google Analytics, where Google LLC acts as a sub-processor for Google Ireland Limited;
Email hosting, where messages you send me are stored after being forwarded.

These transfers are safeguarded by the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework where the recipient is certified under it, and otherwise by the European Commission’s Standard Contractual Clauses together with supplementary technical and organizational measures. You are entitled to request a copy of the safeguards applied to a specific transfer by contacting me at the address in Section 1.

You should be aware that United States law may allow public authorities to access data stored there under conditions that differ from those in the European Union, and that the redress available to you in such cases may be more limited than under EU law. I keep the data transferred to the United States to the minimum necessary and do not send special categories of personal data there.

Data security

I take reasonable technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include HTTPS encryption, restricted administrative access, strong authentication, and regular software updates. However, no method of transmission over the internet is completely secure, and absolute security cannot be guaranteed.

Children’s privacy

This Site is not directed at children under the age of 16, and I do not knowingly collect personal data from children. If you believe a child has provided personal data, please contact me and I will delete it.

Automated decision-making

I do not use your personal data for automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

Changes of this Privacy Policy

I may update this Privacy Policy from time to time to reflect changes in how the Site works or in applicable law. When that happens, the “Last updated” date at the top of this page will be revised. You are encouraged to review this policy periodically.

Contact

If you have any questions, requests, or complaints regarding this Privacy Policy or the way your personal data is handled, please contact me at hello [at] colbylicious.com.