Privacy

Who is responsible for it

Umbra Eclipse is the studio behind this site. It is based in Greece and works remotely, and for any personal data that reaches us through this site it is the controller — the one answerable for it.

Everything below is answered at contact@umbraeclipse.net. There is no privacy team, no ticket queue and no portal: it is the same address as everything else here, and a person reads it.

What the site itself collects

Nothing. There is no form, no account, no cookie, no local storage, no analytics, no tracking pixel, no embedded video or map, and no font or script loaded from anywhere else.

That is enforced rather than promised. Every page is served with a Content-Security-Policy that permits the document to load from its own address and from nowhere else, so a script that tried to send something to a third party would be refused by your browser rather than trusted not to.

What our host records

The site is served by Cloudflare Pages. Like any web server, it records the request itself: the address it came from, the time, the page asked for, and the browser string your browser sends. That is how a page gets delivered and how the service is kept available and protected from abuse.

We do not use it to identify anyone, we do not combine it with anything else, and we do not build a profile from it. The lawful basis is our legitimate interest in serving the site and keeping it standing — Article 6(1)(f) of the GDPR.

If you email us

The address on this site is an ordinary mailbox. If you write to us, we hold your message and your address for the obvious reason: to answer you, and to keep a record of what was discussed if work follows.

Writing to us is voluntary and nothing here requires it — but without an address we cannot answer you, and without the detail you choose to include we cannot quote. Answering an enquiry rests on Article 6(1)(b), the steps taken at your request before a contract, and on 6(1)(f) where what you asked is not about work for you. Once there is a contract, the records belonging to it rest on 6(1)(b) and on 6(1)(c) — the accounting and tax duties the law puts on us.

There is no mailing list, so you are not added to one, and we do not pass your message to anyone else.

Where legitimate interest is the reason

Three things above rest on it: answering what you asked, keeping the site available and unabused, and being able to defend a claim. We have weighed each against your own interests and rights and consider that they do not override them, because the processing is narrow, it is what anyone writing to a studio would expect, and it carries little risk to you.

You can object to any of it at any time on grounds relating to your situation, and we will stop unless we can show compelling grounds that override yours, or the data is needed for a legal claim.

Who else sees it

Our hosting provider, which serves the site and records the requests described above. The provider of our mailbox, which carries the mail. Where a contract follows, whoever handles our accounting, because an invoice is a legal record before it is anything else. And a public authority, where the law requires us to hand something over.

That is the entire list. Nothing is shared with anyone for their own purposes.

Where it is held

The site is served from a global network, so a request for a page may be answered by a machine outside the European Economic Area. Where a provider processes personal data outside the EEA, the transfer rests on a European Commission adequacy decision or on the Commission standard contractual clauses in that provider’s agreement, and on nothing looser.

How long we keep it

An enquiry that leads to no contract: up to twelve months, and then it goes. Records belonging to a contract: as long as Greek tax and accounting law requires — at least five years, and longer for some of them — and for as long as a claim arising from the work could still be brought.

Server logs are held by our host on its own schedule, which is measured in days rather than years.

What we never do

We do not sell, rent or trade anything you send us. We do not share it with advertisers or data brokers. We do not make automated decisions about you, we do not profile you, and we do not track you from one site to another.

We collect personal data from you and from nobody else. If a person refers you to us, that person is the only other source there has ever been.

Your rights

You can ask what we hold about you and for a copy of it, ask for it to be corrected or erased, ask us to restrict how we use it, ask for it in a portable form, and object to any use that rests on legitimate interest. Where anything ever rests on your consent you can withdraw it at any time, and withdrawing it does not unpick what was lawful before.

Ask at contact@umbraeclipse.net. A person answers these — there is no form to fill in and no portal to sign into — and the answer comes within a month.

If you think we have it wrong, you can complain to the Hellenic Data Protection Authority: Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα, Kifisias 1-3, 115 23 Athens, +30 210 6475600, contact@dpa.gr, www.dpa.gr. If you live in another EU country you can go to your own authority instead.

When this changes

The date at the top changes with it. If we ever add something that does collect — a contact form, an analytics tool, an embedded service — this notice is updated before that ships, not after.

If analytics is ever added it will be a cookieless tool that sets no identifier and follows nobody between sites, which needs no consent banner and is disclosed here instead. Anything that did set a non-essential cookie would need your consent first, asked for in a banner where refusing is exactly as easy as accepting, and it would not run until you had accepted.

If something here is not covered, or is not clear, write to us and a person will answer it.