Legal and privacy

The regulatory position of this website, what happens to information submitted through the CV request form, and the cookie policy.

  1. Regulatory disclaimer
  2. Data controller
  3. What is collected
  4. Lawful basis
  5. Retention
  6. Your rights
  7. Cookies
  8. Website content

Regulatory disclaimer

This personal website is maintained strictly for professional portfolio and biographical purposes. Nothing on this website constitutes investment advice, financial promotion, an offer to buy or sell securities, or a solicitation of interest in any fund, vehicle or financial instrument. Views expressed herein are solely personal to the author and do not reflect the opinions, strategies or positions of current or former employers.

Data controller

The data controller for information submitted through this website is Emanuel Paulet, London, United Kingdom. Questions about this notice, or any request concerning your data, may be sent to privacy@emanuelpaulet.me.

What is collected

The CV request form collects:

  • your name;
  • the professional email address you supply;
  • your firm or organisation, if you choose to give it;
  • the reason you give for the request;
  • where you select “other” as the reason, the short justification you write in the text box that appears;
  • your confirmation that you have read this notice and consent to being contacted about your enquiry;
  • a one-way cryptographic hash of your IP address, and your browser user-agent string, recorded as a security measure;
  • whether and when the download link in your email was used.

This information is used to email you the CV, to issue the accompanying download link, and to maintain a record of who has been sent the document. No other information is collected anywhere on this website.

Your IP address is not stored. What is stored is a salted one-way hash of it, which is sufficient to limit abuse of the form but cannot be reversed to recover the address.

The justification box accepts a short passage of plain text and is limited to three hundred characters. Please keep it to the professional context of your request, and do not enter information about your health, beliefs, or any other sensitive category, or personal details about third parties. There is no facility to upload a file anywhere on this website.

The CV is sent to the address you give, as an attachment and as a download link. Note that ownership of an email address is demonstrated by delivery rather than by validation: the record evidences that the document was sent to a given address, not that a particular named individual received it.

Lawful basis

Consent — Article 6(1)(a) UK GDPR

Sending a request requires one confirmation: that you have read this notice and consent to being contacted about the enquiry you are making. Its scope is deliberately narrow. It covers the reply and the download link you have asked for, and nothing else.

No consent to marketing or to future contact is collected anywhere on this website. You will not be added to a mailing list, and no permission is sought for contact beyond answering your request. This is why the confirmation can be required without difficulty: under Article 7(4) and Recital 43 UK GDPR, consent is not freely given where it is made a condition of providing something that does not need it, so a required box is only legitimate while it is limited to what your request actually involves.

You may withdraw this consent at any time by email, using the address above.

Legitimate interests — Article 6(1)(f) UK GDPR

Maintaining the record of who has been sent the document rests on legitimate interests rather than consent: you have approached the controller in a professional capacity, and a disclosure record is necessary to manage the document's confidentiality. This record is kept whether or not you opt in to future contact.

Security processing — Article 32 UK GDPR

The hashed IP address and the user-agent string are recorded to detect and limit abuse of the form. They are not used to profile you and are subject to the same retention period as everything else.

Retention

Form submissions are retained for twelve months from receipt and are then deleted. Deletion runs automatically as a scheduled database job rather than relying on manual housekeeping. Download links expire seventy-two hours after they are issued.

Data is not sold, is not shared with third parties for marketing, and is not used for automated decision-making or profiling.

Processors

Three providers process this information on the controller's behalf, under contract: the website host, which runs the form endpoint; the database and file-storage provider, which holds the request record and the CV file; and the transactional email provider, which delivers the message to you. Each acts only on documented instructions. No provider is authorised to use the data for its own purposes.

Your rights

Under UK GDPR you have the right to:

  • request access to the data held about you;
  • have inaccurate data corrected;
  • request erasure of your data;
  • restrict or object to its processing;
  • receive a copy of your data in a portable format;
  • withdraw consent at any time, where processing rests on consent.

Requests are actioned within one month and should be sent to privacy@emanuelpaulet.me. If you are not satisfied with the response, you may complain to the Information Commissioner's Office at ico.org.uk.

Cookies

This website sets no analytics, advertising or third-party tracking cookies. There is no tag manager, no pixel, and no session recording.

One item of strictly necessary local storage is used, to remember that you have dismissed the cookie notice so it is not shown again. Under the Privacy and Electronic Communications Regulations, strictly necessary storage of this kind does not require consent. Clearing your browser storage removes it.

Typefaces are served by Google Fonts, which means your browser makes a request to Google's servers when the page loads. To avoid that request entirely, the font files can be self-hosted.

Website content

Descriptions of professional work on this website are anonymised and generalised. No confidential borrower, counterparty, investor or client information is disclosed, and nothing here is published on behalf of any employer.

Institution and firm names appear as plain text references to factual affiliation. No logo, crest or registered mark of any university or firm is reproduced, and no endorsement by any named institution is claimed or implied.

Last revised September 2026.