Privacy Notice

01Summary

This website is a set of static pages. It contains no contact form, no login, no advertising cookies and no behavioural profiling, and it loads no fonts, scripts, images or other resources from external hosts.

In ordinary use, the only personal data processed is what any web server necessarily receives in order to answer a request, plus whatever you choose to write to us by email.

02Server logs

When a page is requested, the web server and the network provider in front of it may record:

• the IP address of the requesting client;
• the date and time of the request;
• the requested resource and the HTTP method and status code;
• the volume of data transferred;
• the user agent string reported by the browser, including browser and operating-system version;
• the referring URL, where the browser sends one;
• protocol and TLS details of the connection.

These records are used to deliver the website, to keep it available, to diagnose faults and to detect and investigate attacks and abuse. They are not used to build a profile of you and are not combined with other data sources for that purpose.

03Email correspondence

If you write to ai@dst9.tech, we process the content of your message and everything your mail client transmits with it, including your email address, name where given, signature details and mail-header metadata.

We use this to answer your enquiry and, where relevant, to assess and document a possible engagement. Please do not send confidential material, credentials, special categories of personal data or personal data about other people in an initial enquiry.

04Cookies, analytics and trackers

This website sets no cookies and uses no local storage, session storage or similar client-side storage. It runs no analytics product, no tag manager, no advertising pixel, no session recording and no fingerprinting.

The only script served is a small file from this same domain that reveals figures on scroll and highlights the section you are reading. It transmits nothing and stores nothing.

No consent banner is shown because nothing is stored on your device that would require consent.

05Legal basis

Server logs

Legitimate interests (Article 6(1)(f) GDPR) in operating a secure and available website. Our assessment is that this processing is limited, expected by users, and cannot reasonably be achieved by less intrusive means.

Email correspondence

Legitimate interests (Article 6(1)(f) GDPR) in responding to enquiries; and, where the exchange concerns a possible or existing engagement, steps taken at your request prior to entering into a contract or performance of a contract (Article 6(1)(b) GDPR).

Retention of legal records

Compliance with a legal obligation (Article 6(1)(c) GDPR) and the establishment, exercise or defence of legal claims (Article 9(2)(f) GDPR where applicable).

06Retention

Server access logs

Up to 30 days, then deleted or aggregated into non-identifying statistics.

Security and incident logs

Up to 12 months where required to investigate or document an incident.

Enquiry correspondence with no follow-up

Up to 12 months from the last message.

Correspondence relating to an engagement

For the term of the engagement and thereafter for the period required by the applicable agreement and by statutory retention and limitation periods.

Where data must be kept to establish, exercise or defend a legal claim, it is retained until that purpose ends, and is restricted from other use in the meantime.

07Recipients

Personal data is not sold, rented or used for advertising. It may be disclosed to:

• the hosting and network providers that serve this website, acting as processors under a data-processing agreement;
• the email service provider that operates the ai@dst9.tech mailbox, acting as a processor;
• professional advisers, including legal and accounting advisers, bound by professional confidentiality;
• competent authorities and courts, where disclosure is required by law or necessary to establish, exercise or defend legal claims.

Processors act only on documented instructions and may not use the data for their own purposes.

08International transfers

Hosting, network and email services may be operated from, or supported from, countries outside the European Economic Area. Where personal data is transferred outside the EEA, the transfer is made on the basis of an adequacy decision or of Standard Contractual Clauses adopted by the European Commission, together with any supplementary technical and organisational measures indicated by a transfer risk assessment.

You may request information about the safeguards applied to a specific transfer by writing to ai@dst9.tech.

09Your rights

Subject to the conditions and exceptions in applicable data protection law, you have the right to:

• request access to the personal data we hold about you;
• request rectification of inaccurate or incomplete data;
• request erasure of your data;
• request restriction of processing;
• object to processing based on legitimate interests, on grounds relating to your particular situation;
• receive data you provided in a structured, commonly used, machine-readable format, where the processing is based on consent or contract and is carried out by automated means;
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

How to exercise them. Write to ai@dst9.tech stating the right you wish to exercise. We respond within one month of receipt, which may be extended by two further months for complex requests; if we extend, we tell you within the first month and explain why. We may ask for information reasonably needed to confirm your identity, and we use that information for no other purpose.

Complaints. You may lodge a complaint with the supervisory authority of your habitual residence or place of work, or with the supervisory authority competent for the controller identified in section 12. We would prefer the chance to address your concern first.

No decision producing legal or similarly significant effects concerning you is made about you on this website by automated means, and no profiling is carried out.

10Security

This website is served over HTTPS with modern transport security, is generated as static files without a content management system or database, and applies HTTP response headers that restrict content sources, framing and referrer disclosure. Administrative access to the hosting and DNS configuration is limited to authorised personnel and protected by multi-factor authentication.

No system is perfectly secure. If you believe you have found a security issue affecting this website, please write to ai@dst9.tech with the details and give us a reasonable period to respond before disclosing it.

11Changes and version record

This notice may be updated when the website changes or when legal requirements change. The current version and its date are stated below, and the change history is maintained in the site's version-control repository.

Document

Privacy Notice, version 1.0.0

First published

2024-10-15

Supersedes

None — first published version

12Controller identification

Contact for privacy matters

ai@dst9.tech

Scope of this notice

The public website at dst9.tech