Draft. This page is being finalised and is not yet in force.
Privacy Policy
Last updated: 12 November 2026
In plain English
- Chef Portfolios is run by one person, Paweł Kukulka, in Spain. He decides how your data is used.
- We collect what you type and upload to build your portfolio, plus your email address so you can sign in.
- When you publish your page, it is public on the internet. Drafts, unpublished photos and your CV stay private.
- Your email address and phone number are never shown on your page.
- No advertising, no analytics, no tracking, and we never sell your data.
- You can see, correct, download or delete your data. Write to hello@chefportfolios.com.
1. Who we are
Chef Portfolios (chefportfolios.com) is run by Paweł Kukulka, a self-employed sole trader (autónomo) resident in Spain, trading as "Chef Portfolios". In this policy "we", "us" and "our" mean him.
We are the controller of the personal data described here. That means we decide why and how it is used, and we are responsible for it under the EU General Data Protection Regulation (GDPR) and Spain's Organic Law 3/2018 on data protection (LOPDGDD).
- Tax identification number: [TO ADD: tax identification number (NIF)]
- Postal address: [TO ADD: registered business address]
- Email: hello@chefportfolios.com
- Data protection officer: [TO ADD: confirm none appointed] None has been appointed, as one is not required for a business of this size and type. Write to the email above with any privacy question.
This policy is in English. A Spanish version will follow.
2. Whose data this covers
- Chefs who create an account and build a portfolio.
- People who send an introduction request through a chef's page, such as hiring managers, recruiters inside a business, or households looking for a private chef.
- People who request an invite on our front page.
- Visitors to the website, and anyone who emails us.
3. What we collect, why, and our legal basis
We only collect what we need to run the service. The GDPR requires a legal basis for each use. The ones we rely on are:
- Contract: we need the data to provide the service you asked for (GDPR article 6(1)(b)).
- Legitimate interests: we have a genuine reason, such as keeping the service safe, and it does not override your rights (article 6(1)(f)). You can object to this; see your rights.
- Consent: you have said yes to something specific, and you can withdraw it at any time (article 6(1)(a)).
- Legal obligation: the law requires us to keep a record (article 6(1)(c)).
| Data | Who it comes from | What we use it for | Legal basis |
|---|---|---|---|
| Email address and invite code | Chefs | Creating your account, sending sign-in links, checking your invite, and sending messages about your account and page | Contract |
| Name, job title, current and past employers, roles and dates, city and country, availability | Chefs | Building and showing your portfolio page | Contract |
| Introduction, interview answers, accolades and ratings, languages and skills | Chefs | Building and showing your portfolio page | Contract |
| Dish photographs and an optional portrait | Chefs | Showing your work on your page. Hidden location data is removed when you upload. We do not use photos to recognise faces. | Contract |
| CV file (optional) | Chefs | Kept privately for you. Only shared on your page if you upload a version for sharing and confirm it. | Contract |
| Your page and what it contains, before it goes live | Chefs | During the founding programme, we check every page before it is published, to catch mistakes, misleading claims and content that breaks someone's rights | Legitimate interests (accuracy, protecting others and the service) |
| Your page used as an example of a portfolio | Chefs | Only if you give separate permission, for example to show your page on our front page | Consent |
| Name, organisation, role being hired for, work email, note; for private chefs also dates, place and number of guests | People who send an introduction request | Storing the request and passing it on to the chef by email | Legitimate interests (the sender asked us to pass it on, and the chef wants to receive it) |
| Email address | People who request an invite | Sending you an invite | Steps you asked us to take before an account is set up (contract) |
| Technical data: IP address, browser and device type, pages requested and times | Everyone who visits | Delivering pages, keeping you signed in, and protecting the service against abuse, spam and attacks | Legitimate interests (security) |
| Emails you send us and our replies | Anyone who writes to us | Answering you, handling requests and complaints | Legitimate interests; contract where it is about your account |
| Records of privacy requests, rights complaints and, once paid plans exist, invoices | Chefs and others who contact us | Showing we handled requests properly; keeping tax and accounting records | Legal obligation |
Tables scroll sideways on small screens.
We use your data only to run Chef Portfolios. We do not use it for any other business, we do not sell it, and we do not use it for advertising. We do not make decisions about you by automated means alone.
Giving us your email address is required to have an account. Everything else on your page is up to you, though a page with very little on it may not be accepted for publication.
Please only put information about other people on your page (for example, naming a former head chef) where it is needed and fair to them.
4. What is public and what is private
Public: once your page is approved and published, it is available to anyone at chefportfolios.com/your-name. It can be found and indexed by search engines such as Google, and people can share the link. When a link is shared, apps may show a preview with your name and a photo.
Private: drafts, photos you have not published, your CV (unless you have chosen to share a version) and your email address. Your email address and phone number are never shown on your page.
You can hide your page at any time. Search engines and other websites may keep copies of a public page for a while after it is hidden or deleted. We cannot control that, but we can help you ask a search engine to remove an out-of-date copy.
5. Introduction requests
A published page has a form for anyone who wants to be introduced to the chef. When you send one:
- We store your request and email it to the chef.
- The chef decides whether to reply. We do not reply on their behalf.
- Once the chef has your details, they hold them as their own responsibility, separately from us. If you want a chef to delete your details, ask them directly, or ask us and we will pass the request on.
Please send only what is needed for the introduction. Do not include sensitive details such as health information.
6. Who receives your data
We use a small number of service providers to run the site. They act as our processors: they handle data only on our instructions, under a data processing agreement.
- Supabase (Supabase Inc., USA): our database and sign-in system. Our project is hosted in the EU, in Ireland.
- Cloudflare (Cloudflare, Inc., USA): website hosting, storage of photos and files (set to EU storage), forwarding of email sent to hello@chefportfolios.com, and security. Cloudflare runs a global network, so your connection passes through the data centre nearest to you.
- Resend (Plus Five Five, Inc., USA): sends our emails, such as sign-in links and introduction notifications. Emails are sent from Ireland.
- GitHub (GitHub, Inc., a Microsoft company, USA): stores our source code and runs our scheduled, encrypted nightly database backups from a private account.
- Email inbox provider: email sent to hello@chefportfolios.com is forwarded to [TO ADD: the email provider that receives mail forwarded from hello@].
- Google Fonts (Google): the typefaces on this site are currently loaded from Google's servers. When a page loads, your browser connects to Google, which receives your IP address and basic browser details. Google does not set cookies for this. We plan to host the typefaces ourselves, after which this no longer happens.
Others who may receive data:
- The public, for published pages (see section 4).
- The chef, for introduction requests sent to them.
- Professional advisers, such as a lawyer or accountant, where needed, under a duty of confidentiality.
- Public authorities, such as courts or the tax agency, only where the law requires it.
- If the business is ever transferred to someone else, they would receive the data to keep running the service, and we would tell you first.
7. Transfers outside Europe
We store data in the European Union where we can: the database in Ireland, files in Cloudflare's EU storage, and emails sent from Ireland. However, several of our providers are US companies, and some data leaves the EU, for example backups held with GitHub, traffic through Cloudflare's global network, and support access by provider staff.
Where personal data is transferred outside the European Economic Area, we rely on one of these safeguards:
- the provider's certification under the EU-US Data Privacy Framework, which the European Commission has found gives adequate protection; or
- the European Commission's Standard Contractual Clauses, included in the provider's data processing agreement.
You can ask us for details of the safeguard used for each provider.
8. How long we keep it
| Data | How long |
|---|---|
| Your account and portfolio, including photos and CV | While your account is open. When you delete your account, it is removed from our live systems straight away. Deleted files sit in a holding area for up to 30 days before they are permanently removed. |
| A photo or CV you remove | Removed from your page straight away; permanently deleted within 30 days. |
| Database backups | Each nightly backup is kept for 30 days and then deleted. So deleted data can remain in backups for up to 30 days. |
| Introduction requests | 12 months from when they are sent, then deleted. Also deleted if the chef deletes their account. Copies already emailed to the chef are theirs to manage. |
| Invite requests | Until we send you an invite, or 12 months, whichever comes first. |
| Emails to us | As long as needed to deal with your message, then up to 2 years. |
| Records of privacy requests and rights complaints | 3 years, to show we handled them properly. |
| Invoices and payment records (once paid plans exist) | As long as Spanish tax and accounting law requires. |
| Technical and security logs | For the short period set by each provider's standard logging. |
Tables scroll sideways on small screens.
For what is stored in your own browser, see the Cookie Policy.
9. Your rights
You have the right to:
- Access: get a copy of the personal data we hold about you.
- Rectification: have wrong or incomplete data corrected. Chefs can also edit their page themselves.
- Erasure: have your data deleted. Chefs can delete their account themselves.
- Restriction: ask us to pause using your data while a concern is looked into.
- Portability: get the data you gave us in a common, machine-readable format, or have it sent to someone else where that is technically possible.
- Objection: object to uses based on legitimate interests. We will stop unless we have strong legitimate grounds, or need the data for a legal claim.
- Withdraw consent: where we rely on your consent, withdraw it at any time. This does not affect what we did before.
- Complain: to the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), at www.aepd.es. You can also complain to the authority where you live or work in the EU. We would appreciate the chance to put things right first.
10. How to use your rights
Email hello@chefportfolios.com and say what you would like. It is free.
- We reply within one month. If a request is complicated, we may take up to two more months and will tell you why.
- We may ask you to confirm who you are, for example by writing from the email address on your account.
- If we cannot do what you ask, we will explain why.
11. How we protect it
- All connections to the site are encrypted (HTTPS).
- There are no passwords to leak: you sign in with a one-time link sent to your email.
- Access rules in the database mean each chef can only see their own account.
- Drafts, unpublished photos and CVs are kept in private storage, separate from published photos.
- Hidden location data is removed from photos when you upload them.
- Nightly backups are encrypted.
- Only the operator has administrator access.
No system is perfectly secure. If a breach puts your data at risk, we will tell the AEPD and, where the law requires, you, without undue delay.
Keep your email account secure, because anyone who can read your email can sign in as you.
12. Children
Chef Portfolios is for professional chefs aged 18 or over. It is not meant for children. If we learn that someone under 18 has created an account, we will delete it.
13. If you are outside the EU
Chefs and the people who visit their pages may be in the UK, the US, the Middle East and elsewhere. We apply this policy, and the rights in it, to everyone. We are based in Spain and work under EU and Spanish law. Your own country may give you other rights. If you have a question about them, write to us.
14. Changes to this policy
We will update this policy when the service or the law changes, and change the date at the top. If a change matters to how your data is used, we will email chefs before it takes effect.
15. Contact and complaints
Paweł Kukulka, trading as Chef Portfolios
[TO ADD: registered business address]
hello@chefportfolios.com
See also our Terms of Service, Cookie Policy and Legal notice.