Privacy policy.

02What I collect

When you send a message through the contact form, I collect:

• Your name
• Your email address
• Your company, if you give it
• What your message is about, if you pick an option
• Your message

I also record that you gave consent, and when.

When you browse the site, the hosting provider may keep server logs that include IP addresses, as most web hosts do, for security and to keep the site running. When you send the contact form, Supabase’s logs record the same kind of data.

The site sets no cookies.

The site’s fonts are served from this site, not from a third party. There are no analytics or advertising cookies, and nothing on the site tracks you across other websites.

03Why I use it

I process contact form data on the basis of your consent (GDPR Article 6(1)(a)), which you give by ticking the consent box before you send the form. I use it to reply to your message and to continue the conversation you started. I won’t add you to a mailing list.

The server logs are part of delivering the site to you. The basis for those is my legitimate interest in running a website that works and stays secure (Article 6(1)(f)).

04Who else handles it

I don’t sell your data or share it with anyone for marketing. These services handle it only to run this website and to get your message to me:

Supabase

Receives contact form submissions through a server function and stores them in a database hosted in Switzerland. Its network logs record your IP address and browser details when you send the form.

Resend

Sends me an email notification with the contents of each submission.

one.com

Hosts my email inbox, where those notifications and my replies to you are kept.

Google

Hosts the Gmail account where I also receive those notifications.

Cloudflare

Hosts this website (Cloudflare Pages).

The database is in Switzerland, which the EU recognizes as giving personal data adequate protection, and my inbox is hosted in the EU. Supabase and Resend are US companies, and Resend processes the notification emails in the United States. Their data processing agreements cover any transfer to the US, or access from there, with the EU Standard Contractual Clauses. Resend’s agreement also relies on the EU-US Data Privacy Framework. The server function that receives the form runs in whichever Supabase region is closest to you, so it may run outside the EU; the database itself stays in Switzerland. Cloudflare, a US company, hosts the website and sits in front of Supabase, and handles your IP address to deliver the site and block bots. Cloudflare is certified under the EU-US Data Privacy Framework. Google is also a US company, and Gmail may store the notifications outside the EU. Google is certified under the EU-US Data Privacy Framework.

05How long I keep it

I keep contact form submissions for up to 24 months, and the same limit applies to the notification emails that copy them to my inbox and to Gmail. You can ask me to delete yours sooner at any time. Resend, which sends those notifications, keeps its own copy of each one for 30 days. If we keep talking by email, I keep that correspondence for up to 24 months after your last message, unless it becomes a client engagement, in which case I keep what bookkeeping law requires.

06Your rights

Under the GDPR, you have the right to:

• Access the personal data I hold about you.
• Correct data that is wrong or incomplete.
• Erase your data.
• Restrict how I use your data while a correction or objection is being sorted out.
• Object to processing I base on legitimate interests.
• Withdraw your consent at any time. This doesn’t affect anything I did with your data before.
• Receive your data in a portable format, to take to another service.
• Complain to a data protection authority. In Sweden, that is Integritetsskyddsmyndigheten (IMY).

To use any of these rights, email me at info@pontensolutions.com.

07Security

The site and the contact form use encrypted connections (TLS). The website can add a contact form submission to the database but can’t read any back. Reading them takes admin access to the database.