Privacy policy

This notice is given under arts. 13 and 14 of Regulation (EU) 2016/679 (the GDPR) to anyone who visits this site and to anyone who writes to the published address.

The most important part comes before everything else: this site sets no cookies, runs no analytics, has no contact form and automatically collects no email addresses. The only information processed through the site is what any web server records technically in order to deliver a page.

1. Data controller

The data controller is Edoardo Bambini, a natural person, reachable at info@undecidable-research.com.

For this collaboration no company has been incorporated and no legal person has been recognised. Regardless of how the group may be classified, the controller is Edoardo Bambini and is personally answerable for the processing.

No Data Protection Officer has been appointed, because none of the cases in art. 37 GDPR applies.

2. What data is processed

2.1 Web server logs

Like every web server, the infrastructure hosting this site automatically records some technical information on each request:

• the IP address the request came from
• the date and time of the request
• the address of the resource requested
• the response code returned by the server
• the browser and operating system the client reports

This data is not used to identify anyone and is not combined with any other information. It is what is needed to run and protect the service.

2.2 Email you send

The site publishes one address, for ordinary correspondence. There is no channel open for reports concerning a community, because the community is not open yet. Nothing on the site collects your address for you: there is no form, so writing is a deliberate act and the only data processed is what you chose to put in the message.

What is processed is the address you write from, the content of the message and anything you attach, for as long as section 4 says.

The message passes through two parties, which is worth saying because it is not obvious. Porkbun, which runs the domain, handles the forwarding of mail sent to the published address on to the final mailbox. The mailbox the message is delivered into and kept in belongs to Google (Gmail). Who they are and what each does is in section 5, and where the data sits is in section 6.

What goes in the message is your decision. It is worth leaving out personal data that the exchange does not need, your own or anyone else’s. Any further information that does arrive is used only to the extent handling the message or meeting an applicable obligation requires.

2.3 What is NOT processed

For clarity, and because it is unusual enough to be worth writing down:

• no cookies of any kind, not even technical ones
• no localStorage, sessionStorage or any other storage on your device
• no analytics, first party or third party
• no contact form and no newsletter
• no resources loaded from third parties: the typeface is hosted on this same domain, there are no remote images, no iframes, no social widgets and no tracking pixels
• no profiling and no advertising

3. Purposes and legal basis

Processing	Purpose	Legal basis
Web server logs	Deliver pages, keep the service secure, diagnose faults and prevent abuse	Legitimate interest of the controller, art. 6(1)(f) GDPR
Email correspondence	Read and reply to messages sent to the published address	Legitimate interest of the controller, art. 6(1)(f) GDPR

The legitimate interest relied on is keeping the site working and secure and replying to anyone who writes. Processing is limited to what those purposes require. You have the right to object, as set out in section 7.

There is no other processing, because there is nothing to produce any: no accounts, no content uploaded by readers, no community, and no reporting channel in operation.

4. Retention

• Railway HTTP logs: for the period attached to the active Railway plan. The provider publishes different periods in its log documentation; when that period expires, the logs are no longer available in its log system.
• Email: for as long as handling the exchange and anything directly connected with it requires, and then deleted.

There are no other archives, because there is nothing else to archive.

5. Technical providers and recipients

Data is not sold and not published. Some data may be processed by the technical providers used to make the site and the email available:

• Railway, the processor used for hosting under the DPA concluded with the controller;
• Porkbun, which runs the domain and the forwarding of the published email address;
• Google, which supplies the final mailbox.

Each provider processes the data involved in supplying its own service under the applicable role, terms and privacy documentation.

There is currently no dedicated community platform: no chat server and no forum. A space on Discord is planned and is not open yet. On the day it is, Discord becomes a further party to be named here, and this notice says so before that happens rather than after.

6. Transfers outside the European Union

The two have different answers, and they are better said separately.

The site. The deployment is configured in the Amsterdam region, in the Netherlands. Railway may nonetheless carry out further technical processing within its own infrastructure and organisation, under the DPA, its own terms and privacy documentation. The location of the deployment is therefore not presented here as an absolute guarantee that every processing operation stays within the European Economic Area. For whatever does leave it, the DPA concluded with the controller covers the transfer by the adequacy decision for the United States, to the extent the recipient is certified under it, and in any event by the European Commission’s standard contractual clauses (implementing decision (EU) 2021/914, module two). You can ask the controller for a copy.

The mail. The forwarding runs through Porkbun, which is established in the United States, so what you write to the published address leaves the European Economic Area at that hop already. No data processing agreement and no standard contractual clauses have been concluded with Porkbun, so for this hop there is no safeguard of which the controller can give you a copy. Porkbun handles the mail under its own privacy policy, in which it describes itself as the controller of the personal data it processes. Forwarding is the function described here; this notice does not claim that Porkbun keeps no logs, metadata or transient technical copies.

The message is then kept by Google, in a Gmail mailbox dedicated to this project and separate from the personal mail of whoever reads it. For people in the European Economic Area the entity Google names is Google Ireland Limited, in Ireland, but messages are kept in Google’s infrastructure, which includes servers outside the EEA. That transfer also relies on the Chapter V GDPR safeguards Google states for the service, that is the adequacy decision for the United States, the EU-US Data Privacy Framework, and the European Commission’s standard contractual clauses.

If that matters to you, bear it in mind before writing: what goes in a message is your decision, and nothing on the site collects anything on your behalf.

7. Your rights

Under arts. 15 to 22 GDPR you have the right to:

1. access the data concerning you and obtain a copy (art. 15)
2. ask for rectification if it is inaccurate or incomplete (art. 16)
3. ask for erasure in the cases provided for (art. 17)
4. ask for restriction of processing (art. 18)
5. obtain portability of the data where applicable (art. 20)
6. object to processing based on legitimate interest, on grounds relating to your particular situation (art. 21)

On the right to object, separately, because art. 21(4) GDPR asks for it to be put this way. Both of the processing operations described here rest on legitimate interest. You can object at any time, on grounds relating to your particular situation, by writing to info@undecidable-research.com: the processing stops, unless there are compelling legitimate grounds which override your interests, rights and freedoms.

To exercise the other rights, write to the same address. A reply follows within one month of the request, as required by art. 12(3) GDPR.

An honest note on a practical limit: for server logs, which hold an IP address and no identifier, the controller may be unable to link a request to a person without further information you would have to supply yourself, as art. 11 GDPR contemplates.

8. Complaint to the supervisory authority

If you believe the processing of your data breaches the law, you have the right to lodge a complaint with the Garante per la protezione dei dati personali, the Italian supervisory authority, under art. 77 GDPR: www.garanteprivacy.it.

You can also go to the courts.

9. Automated decision-making

There is no automated decision-making within the meaning of art. 22 GDPR and no profiling is carried out. No data is used to make decisions about you.

10. Minors

The discussion space is not open yet. When it is, getting into it will take being at least 18, self-declared on joining. This is an organisational rule of the project. The site is not specifically directed at minors and does not knowingly collect data about them.

If you believe a minor has given the controller data, write to info@undecidable-research.com and it will be deleted.

11. Changes

If the site changes, this notice changes with it. The date at the foot of the page is the last revision. If cookies, analytics or forms were ever introduced, this page would say so before it happened.