Privacy & data protection
Privacy Policy
Effective date: 15 October 2026
1. Who operates this website
This website, www.bobbyleonard.me, is operated by Robert Leonard, an independent professional (trabalhador independente) established in Portugal, trading as Bobby Leonard Freelance (referred to as "I," "me," or "my" in this Privacy Policy).
Data controller: Robert Leonard
Trading name: Bobby Leonard Freelance
Business address: Rua de Inglaterra 283, 1 Esq, 2775-395 Carcavelos, Portugal
Portuguese tax identification number (NIF): 294023941
Privacy contact:bobby@bobbyleonard.me
This policy explains how I collect, use, store, and disclose personal information when you visit the website, submit an inquiry, or contact me about professional services.
Personal information processed on behalf of consulting clients during engagements may be governed by separate contractual and data-protection arrangements.
2. Personal information I collect
Information you provide
When you submit a website inquiry, I collect:
- Required information: Your name, email address, brand or company website, service interest, and the description of your inquiry.
- Optional information: Details you choose to provide, including your business's revenue range, use of Klaviyo or migration plans, responsibility for marketing execution, and how you discovered my website.
- Correspondence: The information you provide in follow-up emails or discussions about a prospective engagement.
Please do not submit passwords, customer-level datasets, or sensitive personal information through the public inquiry form.
Information processed when you visit
Webflow and the website's supporting infrastructure process technical information to deliver and secure the website. Such information may include IP addresses, browser and device details, request timestamps, and requested pages.
Analytics information: After you consent to Analytics, Google Analytics 4 collects information about website visits and interactions, including page views, traffic sources, and device information. Names, email addresses, brand website URLs, and inquiry messages are not intentionally included in analytics event parameters.
3. Why I process information and the legal bases
I process personal information for these purposes under Article 6 of the EU General Data Protection Regulation (GDPR):
| Purpose | Legal basis |
|---|---|
| Review and respond to genuine business inquiries, assess fit, and prepare proposals | Legitimate interests in answering inquiries and operating my consulting business (Article 6(1)(f)) |
| Take steps before entering into a contract directly with an individual making a request | Contract-related steps requested by that individual, where applicable (Article 6(1)(b)) |
| Maintain relevant business correspondence and prospective client relationships | Legitimate interests in administering my consulting business (Article 6(1)(f)) |
| Operate and secure the website, prevent misuse, and diagnose technical problems | Legitimate interests in website security and reliable operation (Article 6(1)(f)) |
| Measure website usage using optional analytics | Consent (Article 6(1)(a)), alongside applicable cookie and electronic-communications requirements |
| Meet tax, accounting, and other legal obligations | Compliance with a legal obligation (Article 6(1)(c)), where applicable |
For inquiries submitted by employees or representatives of brands, legitimate interests will ordinarily be the relevant basis for responding. Article 6(1)(b) is relevant only where processing is necessary for a contract or pre-contractual steps with the individual concerned.
Where I rely on legitimate interests, I consider those interests against the rights and freedoms of the individuals concerned.
4. Cookies and website analytics
The website uses technologies necessary to deliver its pages, maintain security, and support submitted inquiries. It also uses optional analytics to understand website traffic and improve the visitor experience.
Essential technologies. Necessary technologies support site operation, form functionality, security, and storage of your privacy preferences. Strictly necessary storage may be used without consent where permitted by applicable law.
Google Analytics 4. After you consent to Analytics, Google Analytics 4 measures website usage, referral sources, page views, and configured interactions. Google Analytics scripts, analytics cookies, and associated tracking are not activated before Analytics consent.
Your choices. You can accept or reject optional analytics and change your choice using the website's privacy controls. Declining optional analytics does not prevent you from submitting an inquiry.
Cookie settings. You can reopen your preferences at any time using Cookie settings in the website footer, and you can withdraw Analytics consent there.
5. Service providers and disclosures
The following providers support website operations and business inquiries:
- Webflow: Website hosting, form-submission processing and storage, form notifications, and website security functions.
- Cloudflare Turnstile (via Webflow): Automated bot detection and spam protection for website inquiries. This security function may process technical browser and device signals.
- Google Workspace: Business email hosting, including receipt of inquiry notifications and related correspondence.
- Google Analytics 4 (Google): Consent-based website analytics.
- Finsweet: Cookie-consent interface and management of your analytics preferences.
I share information with these providers as necessary to deliver their services and under applicable data-protection arrangements. I may also disclose information where required by law or necessary to establish, exercise, or defend legal claims.
I do not sell website inquiry information to data brokers or third parties for their independent marketing purposes.
6. International transfers
Webflow and Google services can involve processing or access to personal information from outside the European Economic Area (EEA), including the United States.
Where personal information is transferred outside the EEA, the applicable safeguards depend on the provider and the transfer. These may include an adequacy decision, an applicable EU-U.S. Data Privacy Framework certification, or European Commission-approved Standard Contractual Clauses and supplementary measures where required.
You may request information about the applicable safeguards by contacting bobby@bobbyleonard.me.
7. How long I retain information
- Inquiries that do not become client engagements: I retain the inquiry and related correspondence for up to 12 months after the last substantive communication, unless a specific legal need requires longer retention.
- Client engagement records: Records necessary to manage client engagements are retained for the engagement and afterward only as justified by relevant contractual, accounting, tax, or legal obligations.
- Accounting and tax documentation: Invoices, accounting records, and supporting tax documentation are retained for the periods required by Portuguese law.
- Website technical and analytics records: Retention depends on their purpose, the provider’s technical settings, and applicable legal requirements.
When information is no longer needed, I delete or anonymize it, unless continued retention is required by law or is necessary to resolve a legal matter.
8. Marketing communications
Submitting a contact inquiry does not subscribe you to a newsletter or promotional email program. My website does not offer a newsletter signup at launch.
I contact you to respond to your inquiry and discuss the services you requested. Any future optional marketing subscription will have its own applicable notice and consent or other lawful basis, and an appropriate unsubscribe method.
9. Your data protection rights
Depending on the circumstances and the GDPR's conditions, you may have the right to:
- Access personal information about you.
- Correct inaccurate or incomplete information.
- Request deletion in eligible circumstances.
- Restrict processing or object to certain processing, including processing based on legitimate interests.
- Obtain qualifying information in a portable format.
- Withdraw consent at any time where processing relies on consent, without affecting processing carried out lawfully before withdrawal.
To make a request, contact bobby@bobbyleonard.me. I respond within the periods required by law, generally within one month under the GDPR, subject to permitted extensions.
You may also lodge a complaint with a competent supervisory authority, including Portugal's Comissão Nacional de Proteção de Dados (CNPD).
10. Providing information and automated decisions
Submitting an inquiry is voluntary. The required form fields are necessary to understand and respond to your request. Without them, I may be unable to respond.
I review inquiries personally. I do not use solely automated decision-making through this website that produces legal or similarly significant effects on visitors.
11. Information security
I use reasonable technical and organizational measures intended to protect personal information against unauthorized access, loss, alteration, or disclosure. No method of internet transmission or electronic storage is completely secure.
12. External websites
My website may link to third-party websites. Those websites have their own privacy practices, and you should review their applicable policies.
13. Changes to this policy
I update this Privacy Policy when website features, service providers, data-handling practices, or relevant legal requirements change. The effective date above identifies the current version. Additional notice or consent will be provided where required by law.
14. Contact
Bobby Leonard Freelance
Operated by Robert Leonard
Independent professional (trabalhador independente), Portugal
Rua de Inglaterra 283, 1 Esq
2775-395 Carcavelos, Portugal
NIF: 294023941
Email:bobby@bobbyleonard.me