Privacy Policy
Last updated:
Controller
The data controller for the processing described on this page is Bulkhead Logic spółka z ograniczoną odpowiedzialnością, ul. Domaniewska 17/19 lok. 133, 02-672 Warszawa, Poland (National Court Register, KRS: 0001255553; tax ID, NIP: 5214173597), except where this page says Cloudflare acts as a controller in its own right. Contact: contact@bulkheadlogic.com, or by post at the address above.
Overview
This website sets no cookies and uses no analytics trackers or third-party tracking scripts. We collect nothing passively when you visit; our host, Cloudflare, processes connection data to deliver the pages (see Hosting). The only personal data we receive is what you send us — by email, or through the architecture review form together with the technical details your browser sends with it (see Form Submissions).
Fonts & External Resources
This website uses system fonts installed on your device. No fonts are loaded from Google Fonts, Adobe Fonts, or any other external server. Until you tick the privacy box on the architecture review form, no external stylesheets, scripts, images, or other resources are loaded. The site runs a small amount of first-party JavaScript, served from this domain, to validate and submit the contact form; it sets no cookies and no browser storage.
Ticking that box loads one external script: Cloudflare Turnstile, from
challenges.cloudflare.com (see Form Submissions). It is loaded only then,
because protecting the form you are about to use depends on it: the storage of and access
to information on your device that it involves is strictly necessary for that purpose.
Turnstile runs in a frame served from Cloudflare's domain, and that frame keeps data in
your browser's storage for that domain (a local storage entry cf.turnstile.u
on challenges.cloudflare.com). Cloudflare may also place cookies it describes
as strictly necessary for its challenge products (see
Cloudflare's Cookie Policy).
Our own pages cannot read either. Cloudflare also uses the signals Turnstile collects to
improve Turnstile (see Form Submissions).
Email Contact
When you contact us by clicking an email link on this site, your email client opens a new message addressed to us. We receive your email address and whatever you choose to write, in our mailbox (see Our Mailbox). We use it to answer you and, if we go on to work together, for that business relationship. We do not sell it or use it for marketing, and we share it with no one but the processors named on this page. We answer on the same legal basis, and keep your email for the same period, as a form submission (see Form Submissions).
Form Submissions
The architecture review form on this site posts to our own API at
api.bulkheadlogic.ai. There is no third-party form service involved.
The submitted fields are: your email address, an optional product link, your selected
challenge, an optional free-text message, your confirmation that you have read this
policy, and a verification token from Cloudflare Turnstile (see below).
To keep automated spam out of our inbox, the form uses Cloudflare Turnstile. It loads only after you tick the privacy box. Cloudflare then processes your IP address and signals from your browser — in Cloudflare's words, "client IP address, TLS Fingerprint, User-Agent Header and Sitekey and associated origin" — to tell people from bots, usually without you having to do anything; occasionally it asks you to tick a box. According to Cloudflare's Turnstile documentation, Turnstile "does not access, store, or transmit user communications, form entries, or other page inputs". It gives the form a single-use verification token, which is sent with your fields. If the check fails, the form is not sent; you can write to contact@bulkheadlogic.com instead.
Cloudflare's Turnstile Privacy Addendum gives it two roles: it processes these signals as our processor to protect this form, and as a controller in its own right, relying on its own legitimate interest, to improve Turnstile's bot detection. We use Turnstile on the basis of our legitimate interest in protecting the form and our mailbox from automated abuse (Art. 6(1)(f) GDPR). Where Cloudflare processes Turnstile data as our processor, the transfer mechanisms under Hosting apply. For its own purpose, Cloudflare is responsible under its privacy policy; you can contact Cloudflare's Data Protection Officer at dpo@cloudflare.com.
Requests to that address pass through Cloudflare (see Hosting below). Cloudflare decrypts each request and passes it to our server over a separate encrypted connection, together with your IP address and the technical details your browser sends, such as its type; it handles your submission and your IP address as our processor. Our server, which we operate ourselves in the European Economic Area, uses those details only to deliver the request, and uses your IP address (for an IPv6 address, often only its first half), in memory only, to limit how often one address can submit. It is removed once the limit no longer applies and later traffic needs the room, or when the server restarts — on a quiet day that can take several days. It is never written to disk, logged or passed on.
Only the fields above, their content type and the address of this website are passed on to the application that sends the email. Of these, only the verification token goes back to Cloudflare, which our server sends there to confirm it; nothing else from your submission, and not your IP address, goes with it. Your IP address and browser type are not recorded (see below). That application does not store submissions in a database — it formats the fields into an email and relays it through Google Workspace (Google Cloud Poland Sp. z o.o., our processor) to our mailbox over an encrypted connection, with your address set as the reply-to.
Our server records these requests in technical logs: the time, the web address requested, whether the request succeeded and, when one fails, the address of this website. They do not contain your IP address, your browser type, your email address or your message. We keep them to run and secure the service, which is our legitimate interest (Art. 6(1)(f) GDPR). They are stored in Google Cloud Storage in Belgium (Google Cloud Poland Sp. z o.o., Warsaw, Poland, our processor — see Google Cloud's Data Processing Addendum) and deleted automatically after 14 days; Google's recovery copies of deleted logs expire within a further 7 days. The server itself holds only its most recent logs, overwriting the oldest as new ones arrive.
Once delivered, the submission lives as an email in our mailbox. We keep it for as long as it is needed for the business relationship, and no longer than 24 months after our last contact, unless a contract requires otherwise. To have it deleted sooner, email contact@bulkheadlogic.com and we will remove it from the mailbox.
Legal basis: we process your submission to take steps at your request before a possible contract (Art. 6(1)(b) GDPR), and on our legitimate interest in answering business enquiries (Art. 6(1)(f) GDPR). Ticking the privacy box confirms that you have read this policy; we do not rely on it as consent.
Our Mailbox
Emails you send us, and the messages the form delivers, are kept in our mailbox, which Google Workspace hosts for us (Google Cloud Poland Sp. z o.o., our processor, under Google's Cloud Data Processing Addendum). Under that addendum, Google may process them in any country where Google or its subprocessors have facilities, including outside the European Economic Area. For transfers to the USA, Google relies on the European Commission's adequacy decision for the EU–U.S. Data Privacy Framework, under which Google LLC is certified. For other countries without an adequacy decision, and wherever no other transfer solution applies, the addendum provides for the EU Standard Contractual Clauses.
Hosting
This website is served by Cloudflare Workers (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). Cloudflare may process your IP address and request metadata as part of its hosting and CDN infrastructure, as our processor, on the basis of our legitimate interest in delivering and securing this site (Art. 6(1)(f) GDPR). See Cloudflare's Privacy Policy for details.
Cloudflare also carries your form submissions to our API and runs Turnstile, the check on the form (see Form Submissions). Cloudflare, Inc. is based in the USA, so all three services may involve transferring your data outside the European Economic Area. For these transfers we rely on the European Commission's adequacy decision for the EU–U.S. Data Privacy Framework, under which Cloudflare, Inc. is certified. Should the framework not apply, the EU Standard Contractual Clauses in Cloudflare's Data Processing Addendum cover them.
What You Have to Provide
No law or contract requires you to give us personal data. To send the form, you have to give your email address, so that we can reply, choose your biggest challenge, tick the privacy box and pass the Turnstile check; without them the form is not sent. The product link and the message are optional. You can write to contact@bulkheadlogic.com instead, with only what you choose to share. Your browser's connection data (see Hosting) is needed to deliver these pages to you.
Your Rights (GDPR)
Wherever you are, you have the right to access, rectify, or erase personal data we hold about you, to object to or restrict its processing, and to data portability. To exercise these rights, contact us at:
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU or EEA country where you live or work, or where you believe your rights were infringed. Ours is the Personal Data Protection Office (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland.
Your Right to Object
Where we rely on legitimate interest, you may object at any time by writing to contact@bulkheadlogic.com.
Changes
We may update this policy as the site evolves. The date at the top of this page reflects the most recent revision.