Privacy policy
2026-10-09T00:00:00.000Z
DRAFT — to be reviewed by a lawyer before publication. Fields in square brackets must be completed with the controller’s real details.
Data controller
[Legal entity], [full address], [VAT number]. Email: [[email protected]].
What we process
Browsing data. The site is hosted on Cloudflare Pages. To serve pages and protect the infrastructure, Cloudflare processes your IP address and technical request data (user agent, requested page, timestamp). This stays in the provider’s technical logs and is not used for profiling. The site uses no analytics or tracking tools.
Requests sent through the site form. If you fill in the form (“Join the Movement”, “Subscribe to Insights”, “Become a research partner”) we process your first and last name, email address, optional message, the page language and the country the request came from (country-level only). Nothing is stored on the site: the request reaches us by email. First name, last name and email are needed to reply; without them we cannot follow up on your request.
Email updates. Only if you tick the dedicated optional box, we also use your name and email to send you updates on research, Stories, Insights and Future Origins activities. We record the date and time of your consent. Leaving the box unticked has no effect on your request.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Serving and protecting the site | Legitimate interest (Art. 6.1.f GDPR) |
| Replying to requests sent through the form | Pre-contractual steps at your request and legitimate interest (Art. 6.1.b and 6.1.f GDPR) |
| Sending email updates | Consent (Art. 6.1.a GDPR), revocable at any time |
Who we share data with
- Cloudflare, Inc. — hosting and security. Processor.
- Resend (Plus Five Five, Inc.) — email delivery of form requests. Processor.
If we use an email delivery service for updates, it will be appointed as a processor and listed on this page.
We do not sell or share data with third parties for commercial purposes.
Transfers outside the EU
Cloudflare operates a global network, so traffic may transit servers outside the EU. Resend is based in the United States. Transfers are covered by the EU-US Data Privacy Framework certification and/or standard contractual clauses.
Retention
- Technical logs: per the provider’s retention schedule.
- Form requests: as long as needed to handle the contact, and in any case no longer than [24 months] after the last exchange.
- Email updates: until you withdraw consent.
Your rights
You may request access, rectification, erasure, restriction, portability, and object to processing (Arts. 15-22 GDPR), and withdraw consent at any time without affecting the lawfulness of prior processing. To stop receiving updates, use the link in any email or write to us. For anything else, write to [[email protected]].
You also have the right to lodge a complaint with your supervisory authority.
Cookies
This site uses no cookies, neither technical nor for profiling, and stores nothing in your browser’s local storage.