Legal
Privacy policy
This site collects very little. The short version: if you send us a message we keep it so we can reply; the server keeps ordinary request logs for a short while; and nothing measures how you use the site unless you have said yes. The rest of this page is the long version.
Who we are
Drasyo is a software and design studio based in Sliema, Malta. We are the data controller for the personal data described on this page. You can reach us athello@drasyo.com or on+356 9998 6326.
What we collect
What you send us. The contact form asks for what you are building, your name, your email address, and optionally your company and website. We receive exactly what you type, and nothing else from the form.
What the server records. Like every website, ours receives your IP address, browser type, the page you asked for and the time you asked for it. Our host keeps these request logs briefly for security and to keep the site running. We do not use them to identify you.
What we do not collect. There are no accounts, no logins and no payments on this site. The site search runs entirely in your browser and sends nothing to us. Fonts are served from our own domain, so no font provider sees your visit.
Why, and on what basis
We use the details you send through the form to reply to you and, if the conversation goes further, to prepare a proposal. The legal basis is that this is a step you have asked us to take before a possible contract (GDPR Article 6(1)(b)), and our legitimate interest in answering people who contact us (Article 6(1)(f)).
Request logs are kept on the basis of our legitimate interest in running a secure, working website (Article 6(1)(f)).
Measurement, where it runs, is based solely on your consent (Article 6(1)(a)), which you can withdraw at any time from the section below.
We do not sell personal data, and we do not use it for automated decisions about you.
Who processes it for us
A small number of providers handle data on our behalf, under contracts that bind them to use it only for the purpose we set:
- Brevo (Sendinblue SAS, Paris, France) delivers the contact form to our inbox as an email. The form contents pass through Brevo's servers in the European Union.
- Vercel (Vercel Inc., United States) hosts the site and its contact endpoint, and keeps the request logs described above. Transfers to Vercel are covered by the EU–US Data Privacy Framework and standard contractual clauses.
- Our email provider stores the messages we receive, in the same way as any business mailbox.
When you allow analytics, Google (Google Ireland Limited) and Microsoft (Microsoft Ireland Operations Limited) also process usage data as described in the next section.
Nobody else receives your data unless the law requires it.
Cookies and measurement
We set no cookies of our own. The site works fully without any.
We would like to know which pages help people and which do not, so the site offers analytics that run only after you have agreed. A small panel asks you the first time you visit. Until you answer, nothing loads, and declining is one tap.
If you allow analytics, the following run:
- Google Analytics 4, loaded through Google Tag Manager: page views, the pages you move between, roughly where you came from, and the country and device type you are using. IP addresses are truncated. Cookies:
_gaand_ga_*, kept for up to 13 months. - Microsoft Clarity: heat maps and anonymised session recordings showing where people scroll, click and hesitate. Text you type into forms is masked and never recorded. Cookies:
_clckand_clsk, kept for up to 13 months.
Advertising measurement is a separate switch, off by default, and we do not currently run advertising. If that changes, this page will say so before any advertising tag is added.
Your answer is stored in your browser only, under the key drasyo:consent, so we can respect it on your next visit. It is not a cookie and it is not sent to us. Browsers that send a Global Privacy Control signal are treated as having declined.
How long we keep it
- Messages you send: for as long as the conversation is live, and, if we end up working together, for the length of the engagement and the period afterwards that Maltese law requires us to keep business records. If nothing comes of it, we delete the thread within 24 months.
- Request logs: our host retains them for a short, rolling period, typically days rather than months.
- Analytics data: up to 14 months in Google Analytics and up to 13 months in Clarity, after which it is deleted or aggregated.
Your rights
Under the GDPR you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct it if it is wrong;
- delete it, where we have no continuing reason to keep it;
- restrict or object to how we use it;
- hand it over in a portable format;
- withdraw consent, where consent is the basis — without affecting anything done before you withdrew it.
Write to hello@drasyo.com and we will answer within one month. If you are not satisfied with how we handle your request, you can complain to the Information and Data Protection Commissioner in Malta (idpc.org.mt) or to the supervisory authority in your own country.
Security
The site is served only over HTTPS. The contact form is delivered by an authenticated email service rather than stored in a database on the site, and access to the mailbox that receives it is limited to the people who reply. There is no such thing as perfect security, but there is very little here to lose, and we keep it that way on purpose.
This site is not aimed at children, and we do not knowingly collect data from anyone under 16.
Changes to this policy
When the site starts doing something new with personal data, this page changes at the same time and the date at the top moves. Material changes will also be noted here for a period after they take effect.