Legal
Privacy, in plain language.
This page describes what the site and the contact pipeline actually do. If the code changes what it stores, this page changes with it.
Last updated 3 July 2026
01 · Controller
GDPR art. 4(7), 24Who is responsible
fyzno, a digital infrastructure studio established in the Netherlands, is the controller for all personal data described on this page. For anything privacy-related, write to info@fyzno.com with the word Privacy in the subject line; the same partner who runs the infrastructure answers the mail.
02 · The brief
What the contact form collects
When you submit the written brief on /contact we store exactly what the form shows: your name, email address, organisation (optional), the project and scale you picked, and the brief itself. The server adds three technical fields: the time of receipt, your IP address, and your browser's user-agent string. The record is appended to a ledger file on our own server and a copy is delivered to our operator mailbox so we can reply. Nothing else is captured; there is no profiling, scoring, or enrichment.
03 · Server logs
GDPR art. 6(1)(f)What the web server logs
The nginx reverse proxy in front of the site keeps standard access logs: IP address, requested path, timestamp, response code, and user-agent. The application writes structured event logs (via systemd's journal) that include an IP address on contact-form events such as a rate-limit trip or a rejected submission. Both exist to keep the service secure and debuggable, and both are rotated and deleted after at most thirty days. The in-memory rate limiter keys on IP and email address, holds each key for a sliding sixty-minute window, and is never written to disk.
04 · Legal bases
Why we may hold it
The brief and our reply to it: steps taken at your request prior to entering into a contract, GDPR art. 6(1)(b). Server logs and rate limiting: our legitimate interest in keeping a public endpoint abuse-free and diagnosable, art. 6(1)(f), weighed and documented. Invoices and engagement records once you become a client: our legal obligation under Dutch tax law, art. 6(1)(c). We do not rely on consent for any of this, because none of it is optional decoration; where consent would ever be needed, we would ask first.
05 · Retention
GDPR art. 5(1)(e)How long, then gone
Contact briefs (ledger and mailbox copy): deleted no later than twenty-four months after our last exchange, sooner on request. nginx and application logs: at most thirty days. Rate-limit entries: sixty minutes, in memory only. Encrypted backups cycle on a thirty-day schedule, so data erased from the primary system leaves the backup set within one further cycle. Invoices and contract records: seven years, as required by the Dutch fiscal administration duty (Algemene wet inzake rijksbelastingen, art. 52). Nothing is kept because it might be useful someday.
06 · Location
terms § 05 · data & hostingWhere it lives
Everything runs on our own server at OVHcloud in Gravelines, France, with encrypted daily backups retained in Strasbourg. OVHcloud acts as our hosting processor under a GDPR art. 28 agreement. All processing stays inside the EU; we transfer no personal data outside the European Economic Area, and we sell or trade data to no one, ever.
07 · Cookies
None. Actually none.
This site sets no cookies: no analytics, no advertising, no fingerprinting, no third-party embeds. Our Content-Security-Policy blocks requests to other origins outright, and fonts are served from our own domain. The single piece of browser storage we use is a session flag (fyzno:preloaded) that remembers the intro animation already played; it contains no personal data, never leaves your browser, and dies with the tab session. Under the Telecommunicatiewet art. 11.7a such strictly functional storage requires no consent banner, which is why you don't see one.
08 · Your rights
GDPR art. 15–21, 77Access, correction, erasure, the lot
You can ask us at any time for access to the data we hold on you, a correction, erasure, restriction of processing, a portable copy, or you can object to processing based on our legitimate interest. Write to info@fyzno.com; we answer within one month, GDPR art. 12(3), and we may ask you to confirm you are who you say you are before releasing anything. If you believe we handled your data badly, you have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). We'd appreciate the chance to fix it first, but that is your call, not ours.
09 · Security
How it is protected
Transport is TLS-only with HSTS pinned for two years. Operator replies are S/MIME-signed so you can verify it is really us. The contact endpoint validates and length-caps every field, rejects cross-origin posts, and rate-limits per IP and per email. The server is patched weekly, backups are encrypted at rest, signing keys live with restricted file permissions, and access to the ledger is limited to the partners who answer your brief. No security is absolute; ours is documented, small-surface, and honestly described.
10 · Changes & contact
full terms § 13When this page changes
If we start collecting something new, or keep something longer, this page changes before the practice does, and the date below the headline moves. Material changes to how briefs are handled will be mentioned in the reply you get when you write to us. Questions, requests, complaints: info@fyzno.com, subject Privacy. Signed reply within forty-eight hours, resolution within the legal month.
Annex · Sub-processors
Everyone who can touch your data
The complete list, not a representative sample. Mail is run by us on the same machine, so there is no mail provider on it; there is no analytics vendor, no CDN, and no font host, because the site loads nothing from another origin. Each entry is engaged under a GDPR art. 28 processing agreement and processes inside the EEA.
OVHcloud
- Role
- Hosting. The physical machine the site, the contact ledger and the mail server run on.
- Location
- Gravelines, France (RBX9)
- Basis
- GDPR art. 28 data processing agreement. EEA only.
OVHcloud
- Role
- Backup storage. Encrypted daily snapshots of the same machine.
- Location
- Strasbourg, France
- Basis
- GDPR art. 28 data processing agreement. EEA only.
A signed copy of our data processing agreement, and notice before anything is added to this list, comes with an engagement. Ask for either at info@fyzno.com.
To exercise a right, or just to ask what we hold on you, write to info@fyzno.com. A signed reply comes back within 48 hours.
Payment, renewal and liability live in the terms. Where the two documents touch data, this one governs.