The one thing on this page that is true

The contact form on this site collects a name, an email address, an optional room name, an optional number of tables, and a message. It emails them to the demo mailbox and stores them nowhere else — no database row, no log line, no third party.

It also writes one short-lived counter keyed to a hash of your IP address, so that the form cannot be used more than three times an hour from one address. That counter holds a count and an expiry time, nothing else, and it deletes itself after an hour.

What a real policy would have to cover

Who is responsible

The named controller, a postal address a letter can actually reach, and a way to contact whoever is accountable for the answer.

What is collected and why

Each category of data, the specific purpose it is collected for, and the lawful basis for that purpose — per purpose, not one basis for the whole site.

How long it is kept

A retention period per category, and what happens at the end of it. “As long as necessary” is not a retention period.

Who else sees it

Every processor, every sub-processor, and every transfer outside the jurisdiction, including the safeguard relied on for each transfer.

What you can ask for

Access, correction, erasure, portability, restriction and objection — and the route to exercise each, plus the supervisory authority to complain to.

Cookies and similar

What is set, by whom, for how long, and which ones are strictly necessary. This theme sets none of its own.

Reminder

None of the above is advice and none of it is a policy. It is a list of headings. Delete this page and commission a real one before this theme is used for anything that is not a demo.