What this site collects, and why.

Who is responsible

The controller of the personal data described here is the author of Sipral, who runs sipral.org. You reach the controller through the contact form; choose the subject Other and say that your message concerns your data.

The contact form

When you send the form, the following is processed:

• What you type: your name, your e-mail address, your company if you give one, the subject you choose and your message.
• Your consent: the box you tick before sending.
• Technical data for spam protection: your IP address, a time token issued when the page loaded, and the result of the Cloudflare Turnstile check.

Why: to answer your question, prepare a commercial licence quote if you asked for one, or handle a security report, and to keep the form usable by stopping automated spam.

Legal basis: your consent, given with the checkbox (Article 6(1)(a) GDPR); for a licence enquiry, also the steps you asked for before a possible contract (Article 6(1)(b)); for the spam protection, the legitimate interest in a form that is not flooded (Article 6(1)(f)).

Where it goes: the server turns your message into an e-mail and hands it to an outgoing mail relay, which delivers it to the maintainer's mailbox. Your message is not stored on the web server. The reply comes from the maintainer, to the address you gave.

What the server keeps: to limit how many messages one network can send (three in ten minutes, ten a day), it keeps the times of recent attempts under a keyed hash of your IP address, never the address itself, for at most one day. Its log records what was decided (sent, refused as spam, limited), never what you wrote or who you are.

How long: your message is kept in the maintainer's mailbox for as long as the conversation needs. Enquiries that do not lead to a contract are deleted within twelve months of the last exchange; correspondence that leads to a contract is kept as long as the law requires for it.

Visiting the site

The web server keeps standard access logs: the time, the page requested, the browser's identification and the address it came from. They serve security and troubleshooting, are rotated daily and are deleted after a short retention period, ten days in the hosting panel's default setting.

This site sets no cookies of its own and loads no advertising or tracking code. Cloudflare may set strictly necessary security cookies while it protects the site.

Processors

• Cloudflare, Inc. delivers the site through its network, checks the contact form with Turnstile (loaded only on the contact page) and counts visits with Web Analytics, which uses no cookies and builds no profile of you. Cloudflare processes IP addresses and request data for this under its data processing terms, which include standard contractual clauses for transfers outside the EU.
• The hosting provider and the outgoing mail relay run the web server and carry the e-mail your message becomes.

Nothing is sold, shared for advertising, or used for automated decisions about you.

Your rights

Under the GDPR you may ask for access to your data, its correction or erasure, a restriction of its processing or a copy in a portable form, and you may object to processing based on legitimate interest. You may withdraw your consent at any time; that does not affect what was done before. Use the contact form for any of these.

You also have the right to complain to a data protection supervisory authority, in particular in the EU member state where you live, work or where you think the infringement took place.

Changes

When this notice changes, the date at the top changes with it.