Privacy notice

The controller of your personal data is Alex Andrushevich, who operates this website (see the legal notice). You can contact the controller about anything in this notice through the contact form.

Founding-community updates. Your email address and, if you give them, your first name and main interest, plus a record of when and how you consented. We use them to send occasional updates about the Forum: its launch, events, learning opportunities and ways to contribute. Legal basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time with the unsubscribe link in every email.

Enquiries from organisations. Your name, work email, organisation, role, the service you are interested in, your message and, if you give one, a timeframe. We use them to answer your enquiry and, if you ask, to prepare a proposal. Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). Enquiries are never added to the mailing list.

Contact messages. Your name, email, topic and message, used to reply to you. Legal basis: our legitimate interest in answering messages sent to us (Article 6(1)(f) GDPR).

Abuse protection. To stop automated abuse of the forms, we briefly use your IP address to limit repeated submissions. It is kept in memory for a few minutes and not stored. Legal basis: our legitimate interest in keeping the service secure (Article 6(1)(f) GDPR).

Visit statistics. We use Vercel Web Analytics to count page views. It sets no cookies, stores nothing on your device and does not identify you: visits are counted with a hash of request data that is discarded within a day. Legal basis: our legitimate interest in understanding how the site is used (Article 6(1)(f) GDPR).

• Vercel Inc. (United States) hosts the website and provides the visit statistics.
• Resend (United States) sends our emails and stores the mailing list.

Both act as processors under data processing agreements. Where data is transferred outside the European Economic Area, the transfer relies on the EU–US Data Privacy Framework where the provider is certified under it, or on the European Commission's standard contractual clauses.

We do not sell your data or share it with anyone else, except where the law requires it.

• Mailing list: until you unsubscribe or ask us to delete your data. Unconfirmed sign-ups are never added; confirmation links expire after seven days.
• Enquiries and contact messages: up to two years after our last exchange, unless they lead to a contract, in which case we keep what the law requires.
• Consent records: as long as we need to show that consent was given.

You can ask to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format. Where we rely on consent you can withdraw it at any time, without affecting what was done before. To exercise any of these rights, use the contact form.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency, the AEPD.

This website sets no cookies and uses no tracking that stores information on your device. The visit statistics described above are cookieless. If that ever changes, we will ask for your consent first and give you a real choice to refuse.

The site is served only over HTTPS. Form submissions are validated and rate-limited, and access to the systems that hold your data is restricted and protected with multi-factor authentication.

We update this notice when our tools or purposes change, and change the date at the top.