Privacy Policy

1. Data controller

2. What data we collect and how

• Contact form data: when you fill in the contact form, we collect your full name, email address, phone number (optional), subject and message. You provide this data voluntarily, and to submit the form you must give your consent by ticking a dedicated checkbox. Your name, email address and message are required so that we can reply; without them we cannot respond to your request.
• Cookie consent preference data: we store your cookie choice locally on your device (localStorage, key ‘pt-consent’). This information is technically necessary so that we can remember your preference.
• Analytics data: if, and only if, you give your consent, data about your use of the website (e.g. the pages you visited, your approximate location and your device type) is collected through Google Analytics 4, using cookies (_ga, _ga_*). Google Analytics 4 does not log or store IP addresses, and the Consent Mode advertising signals (ad_storage, ad_user_data, ad_personalization) always remain disabled. Without your consent, Google's script is not even loaded, so no such data is collected and the related cookies are not set (in addition, Google Consent Mode v2 defaults to ‘denied’ for all storage categories).
• Spam protection data: when you start filling in the contact form, the Cloudflare Turnstile service is loaded. It processes technical data about your device and connection (e.g. IP address, user agent and browser characteristics) to confirm that the submission is made by a human and not by an automated program (bot). In addition, our server temporarily keeps the IP address and time of each submission in order to limit bulk submissions (rate limiting). This data is held only in the server's memory (not in a database or in files) and is deleted automatically about 24 hours after the last submission.
• Server logs: when you visit the website, the hosting provider automatically records technical data such as your IP address, browser type (user agent) and time of access, for security purposes and to keep the website running properly.
• Cloudflare network data: all requests to the website pass through Cloudflare's network, which acts as a content delivery network (CDN) and as a firewall. To deliver pages quickly and fend off attacks, Cloudflare processes technical data about each request, such as the IP address, user agent, page URL and time of access.
• Cookieless analytics (Cloudflare Web Analytics): a small Cloudflare script (from static.cloudflareinsights.com) loads on every page and records aggregate statistics, such as page views, referring page, country, device type, browser type and load times. According to Cloudflare, the service does not use cookies or localStorage, does not use fingerprinting and does not track individual visitors over time. This information is not used to identify you.

3. What this website does not collect

4. Purposes and lawful bases for processing

• Responding to requests made through the contact form (replying, communicating with you, providing information about our services). Lawful basis: the consent you give when submitting the form (Article 6(1)(a) GDPR) and/or taking steps at your request before entering into a contract (Article 6(1)(b) GDPR).
• Statistical analysis and improvement of the website (Google Analytics 4). Lawful basis: your consent (Article 6(1)(a) GDPR), which you may withdraw at any time.
• Storing your cookie preference. Lawful basis: our legitimate interests and the technical necessity of making the website work properly and respecting your choices (Article 6(1)(f) GDPR), together with our obligation to document consent.
• Security, stability and protection of the website against malicious activity (server logs, Cloudflare's protective network, anti-spam measures such as Cloudflare Turnstile and rate limiting). Lawful basis: our legitimate interests (Article 6(1)(f) GDPR) in the security of our systems.
• Aggregate, cookieless visitor statistics (Cloudflare Web Analytics), so that we know which pages are read and how quickly they load. Lawful basis: our legitimate interests (Article 6(1)(f) GDPR) in improving the website, with minimal intrusion into your privacy.

5. Processors and international transfers

• Brevo (formerly Sendinblue): the provider that sends and manages messages from the contact form (transactional email). The company is based in the European Union (France).
• Proton AG (Proton Mail): our email provider, where contact form messages are delivered and stored. The company is based in Switzerland, a country covered by an adequacy decision of the European Commission.
• Google (Google Analytics 4): our analytics provider, used only if you have given your consent. The relevant script is loaded from Google's servers (googletagmanager.com), and Google may also process data outside the EEA (e.g. in the US).
• Cloudflare, Inc.: (a) content delivery network (CDN) and website protection, through which all requests to the website pass; (b) Cloudflare Web Analytics, for cookieless statistics; and (c) Cloudflare Turnstile, which protects the contact form from automated submissions (bots) and loads only when you interact with the form. None of these services is used for advertising. Cloudflare is based in the US; transfers rely on the EU-U.S. Data Privacy Framework, under which the company is certified, and on the Standard Contractual Clauses.
• Hosting infrastructure provider: the website is hosted on a virtual private server (VPS) that we manage ourselves, where the related server logs are recorded.

6. How long we keep your data

• Contact form data: kept for as long as it takes to consider and deal with your request, and for a reasonable period afterwards. If we go on to work together, it is kept for as long as applicable tax and commercial law requires. It is then deleted or anonymised.
• Google Analytics data: kept in accordance with the data retention setting of our Google Analytics 4 account, and not used to identify you.
• Cookie consent preference (localStorage): kept until you withdraw it or clear your browser data.
• Server logs: kept for a limited period, solely for security purposes and to keep the website running properly.
• Rate-limiting data (IP address and time of submission): held only in the server's memory, for about 24 hours after the last submission. Data processed by Cloudflare (CDN, Web Analytics, Turnstile) is kept in accordance with Cloudflare's privacy policy.

7. Your rights

• Right of access: to find out what data we process about you and to receive a copy of it.
• Right to rectification: to ask us to correct inaccurate data or fill in incomplete data.
• Right to erasure (‘right to be forgotten’): to ask us to erase your data, subject to the conditions laid down by law.
• Right to restriction of processing: to ask us to restrict processing in certain cases.
• Right to data portability: to receive your data in a structured, commonly used and machine-readable format.
• Right to object: to object to processing based on our legitimate interests.
• Right to withdraw consent: to withdraw your consent at any time (e.g. for analytics), without affecting the lawfulness of any processing carried out before you withdrew it.

8. How to exercise your rights and make a complaint

9. Data security

10. Cookies

11. Children

12. Changes to this policy

13. Contact