Privacy policy

Who is responsible

This site is run by Sébastien Durandeau, based in Malta, as a personal portfolio. For anything on this page, write to info@durandeau.com.

If you use the contact form

The form stores the name, email address and message you type, along with the date you sent them. They are used for one purpose: reading your message and replying to it. Nothing is added to a mailing list, and nothing is passed to anyone else.

The message is stored in a database on the server and a copy is emailed to my own address so that I see it. The legal basis is my legitimate interest in answering people who choose to write to me.

To keep robots out, the form also checks how quickly it was submitted and limits how many messages one connection can send in a quarter of an hour. Your IP address is held in memory for that check and is never written to the database.

Server logs and visitor numbers

Like any web server, this one records the pages it serves: the address requested, the date and time, the response code, the browser's user agent and the page you came from. This is how I count visits — there is no tracking script, so nothing runs on your device and no ad blocker is needed.

IP addresses are shortened before they are written down, to the first three groups (a /24 block in IPv4, /48 in IPv6). The full address is never stored, which means these logs cannot be traced back to you individually. A copy is kept on my own computer to produce visitor statistics.

Cookies

None are set on your device. No analytics cookie, no advertising cookie, no third-party embed. That is why you are not being asked to accept anything. The only cookie this site can issue is the one that keeps me signed in to my own administration area.

How long things are kept

• Messages from the form: 12 months, then deleted automatically. I may delete one sooner.
• Server logs: up to 90 days on the server.
• Nightly backups: kept 14 days, so a deleted message can survive that long in a backup before disappearing for good.

Who else is involved

Two suppliers, both within the European Union, and neither of them uses this data for their own purposes:

• Hostinger — the server hosting the site and its database, located in Frankfurt, Germany.
• OVHcloud — the email service that carries messages from the form to my inbox, in France.

Nothing is sold, and no data is transferred outside the EU. There is no automated decision-making of any kind.

Your rights

Under the GDPR you may ask for a copy of what I hold about you, have it corrected or erased, ask me to restrict or stop using it, or receive it in a portable format. Write to info@durandeau.com and I will answer within a month. Asking me to erase your message takes one email and needs no justification.

If you are not satisfied with how I handle it, you can complain to the Maltese supervisory authority, the Information and Data Protection Commissioner, or to the authority in your own country.