Privacy policy for the request form
Under legal review. This text is published while its legal review is completed. The details still missing will be added after that review, and any change will carry a new version.
Version 2026-10-13.7
This policy explains what we do with the data of anyone who sends the request form on this site: what you type and what your browser transmits when you send it. Analytics and cookies are explained in the Cookie policy.
Who is responsible
The controller is Sondeon. Company name, tax identification number and registered address: to be completed after the legal review.
For any question about your data you can write to hello@sondeon.com. Dedicated privacy address: to be completed after the legal review.
Data protection officer: to be completed after the legal review.
What data we process
What you type in the form: name, email address and, if you provide them, company, website or repository, the services you tick and your message. Name, email and the checkbox of this policy are required: without them the form is not sent and we cannot reply to you. Everything else is optional.
What is added when you send it: the language and the page you send it from, the date and time, the version of this policy you were shown and a fingerprint of the text published at that moment, your browser user agent and a request identifier.
We do not store your IP address in plain text with the request: we store the network it was sent from (for IPv4, the address without its last octet, /24; for IPv6, the first 48 bits, /48) and a fingerprint of the IP computed with a secret key kept by the controller. Without that key, the fingerprint does not reveal the IP; with it, it is possible to check whether a given IP is the one that sent the request and, for IPv4, to find it by trying the addresses of that network. Notices of rejected submissions keep only that network, the error records of the form keep neither your full IP nor the content of the request, and the process that receives the form writes no access log of its own.
The web server does record the full IP of every request, including the one that sends the form, together with the details of that request, in its access log. That log and your request share the request identifier, so they can be linked.
To protect the site the full IP is also kept in three other places: the approximate location and network of each address (country, city and operator), the address of anyone blocked for abusive behaviour and, for a short time, counters tied to the IP that detect probing, apply blocks and limit repeated submissions of the form.
Why we use it
To reply to your request and to be able to prove that we received it, when, from which page and with which text of this policy on display.
To protect the form and the site: limit repeated submissions, detect and block abuse, investigate security incidents and handle complaints. That requires the full IP of the access log.
We do not use it to send you advertising or to build profiles.
Some decisions are automatic: the form rejects submissions that exceed the per IP limit or that fill in a hidden field meant for robots, and the site blocks addresses that behave abusively. None of them produces legal effects on you or similarly significantly affects you. If you think you were blocked by mistake, write to us.
Legal basis
Replying to your request is a pre-contractual step taken at your request (Article 6(1)(b) of the General Data Protection Regulation). Keeping proof that we received it, the access log and the measures against abuse rely on our legitimate interest in proving what we received and in keeping the site secure (Article 6(1)(f)).
These legal bases are a proposal. Validation by the controller: to be completed after the legal review.
How long we keep it
The request and the record of the email that notifies it: 730 days from receipt. When that period ends they are erased.
The access log of the web server, with the full IP: 730 days, both in the log file and in the access index. If your browser identifies itself as a recognised crawler, the request goes to the crawler log, kept for 90 days.
The approximate location and network of an IP: 730 days from the last time it was looked up. The counters tied to the IP expire on their own after a short time.
Retention period of the IP of anyone blocked: to be completed after the legal review.
Security notices, such as a rejected submission, which keep only the network of the IP: 365 days. The error records of the form, without your full IP or the content of the request: 90 days.
The email with your request also reaches the controller's mailbox. Retention period of that copy: to be completed after the legal review.
Who receives it
Your request is sent by email to the controller. To send it we use Resend, an email delivery provider acting as a processor. The controller's mailbox is provided by Google (Gmail).
To learn the approximate location and network of the IP addresses that reach the site we use ipinfo, which receives those addresses.
Hosting of the site and the server: to be completed after the legal review.
If measurement is switched on and you accept measurement cookies, the page loads Google Analytics 4 with Google's consent mode: analytics cookies are stored and, in the requests to Google, your IP address reaches Google. Before you decide, and if you reject, the page does not load Google Analytics and sends nothing to Google. It is not used for advertising. The Cookie policy explains it.
Data processing agreement with each processor: to be completed after the legal review. We do not disclose your data to anyone else, except where the law requires it.
International transfers
Processors that handle the data outside the European Economic Area and the applicable Chapter V GDPR safeguard: to be completed after the legal review.
Your rights
You can request access to your data, its rectification or erasure, the restriction of its processing and its portability, and object to the processing based on our legitimate interest, by writing to the contact address in the first section.
Exercising them is free. We have one month to reply, which can be extended by two further months if the request is complex, in which case we tell you within the first month.
If you think we have not handled your request properly, you can lodge a complaint with the supervisory authority. Competent supervisory authority: to be completed after the legal review.
Changes to this policy
If this policy changes, its version changes too. With each request we keep the version you were shown and a fingerprint of the text published at that moment, so we can prove which text was shown.