Who we are
Quiet Harbor Lab (“we”, “us”) is a small infrastructure consultancy working remotely from the European Union. We are the controller for personal data you send us through quietharbor-lab.com and its subdomains.
For anything related to this notice, write to us through the contact form and mention “privacy” in your message.
What we collect
When you use the contact form: your name, the contact details you give us (an email address, a Telegram username or a phone number) and the content of your message.
When you visit any of our pages: our web server keeps standard access logs — IP address, date and time, requested address, response code and browser user agent.
When you are a client: the information needed to deliver the service, as described in your contract and data processing agreement. Files sent through our file exchange are covered by those documents, not by this notice.
Please don’t send passwords, health information or payment details through the contact form.
Why, and on what basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Replying to your enquiry | Name, contact details, message | Steps at your request before entering a contract — Art. 6(1)(b) |
| Delivering our services | Contact and project information | Performance of a contract — Art. 6(1)(b) |
| Keeping the site secure | Server access logs | Our legitimate interest in preventing abuse — Art. 6(1)(f) |
| Accounting records | Invoicing details | Legal obligation — Art. 6(1)(c) |
We do not use your data for marketing, profiling or automated decision-making, and we never sell it.
How long we keep it
- Enquiries that don’t lead to a project: deleted after 12 months.
- Client correspondence: for the duration of the contract and up to three years after it ends.
- Server access logs: 14 days.
- Accounting records: as long as tax law requires.
Who else sees it
Only the people at Quiet Harbor Lab who handle your enquiry or project. We rely on a small number of processors — our hosting provider and email provider — under written data processing agreements. We disclose data to authorities only where the law requires it.
Where it is stored
We store data within the European Economic Area wherever we can. If a processor needs to transfer data outside the EEA, we make sure appropriate safeguards are in place, such as the European Commission’s Standard Contractual Clauses.
Cookies and tracking
Our websites set no cookies and use no analytics, advertising pixels, fonts or scripts from third parties. Everything you load comes from our own servers.
Your rights
You can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct data that is inaccurate or incomplete;
- delete your data, or restrict how we use it;
- send your data to you or another organisation in a portable format;
- stop processing based on our legitimate interests.
We will respond within one month. You also have the right to lodge a complaint with the data protection authority in your country of residence.
Security
All our sites are served over HTTPS. Access to enquiries and client data is limited to the people who need it, protected by individual accounts with multi-factor authentication, and our servers are patched on a regular schedule — the same practices we set up for our clients.
Changes
If we change this notice, we will update the date at the top. Significant changes affecting existing clients will also be communicated directly.