What we collect, and why.

Reading a page

The site is static pages served by Cloudflare. Serving a page means Cloudflare receives your IP address and the headers your browser sends, and uses them to deliver the page, to protect the site against abuse and to keep aggregate traffic figures. The typefaces are served with the pages, so no font service is involved. We do not receive these logs and set no cookies of our own on a page view. The AI Act page also loads an assistant widget from euaiact.weavrcore.com, which is the DataWeavrs platform on our own stack; that request carries your IP address and browser type like any page load.

Data

• IP address and browser identification, processed by Cloudflare to serve the page and detect abuse

Purpose

Delivering the site securely.

Legal basis

Legitimate interest (Article 6(1)(f) GDPR) in serving the site and keeping it available.

Retention

We keep nothing. Cloudflare keeps its own request logs for the period set in its privacy notice.

The AI Act Readiness Assessment

When you finish the assessment and ask for your report, we store your answers and your contact details, compute a risk category and a readiness score from fixed rules, email you the report, and email our team a notification so that one person can follow up once. The consent box on the form says exactly that: your report, and one contact to discuss the results. Nothing goes into a mailing list.

Data

• Name, email address, company and role
• Your 27 answers (six on the risk category of your use case, 21 on readiness), the computed risk category, whether general-purpose AI applies, the readiness score and status per domain, the overall score and level, and the number of open items
• The country derived from your IP address (not the address itself), the page that sent you to the assessment and your browser identification
• Whether the two emails were delivered, and the error if one was not

Purpose

Producing and sending the report, and one follow-up conversation about the results if you want it.

Legal basis

Your consent for the report and the follow-up (Article 6(1)(a) GDPR), and our legitimate interest in answering a business enquiry (Article 6(1)(f)). You can withdraw consent at any time by writing to us.

Retention

Until you ask us to delete the submission, and in any case reviewed and pruned once a year. Write to us and it is deleted within one month.

The contact form

When you send a message through the contact page, we store it with your name and email address, email our team, and email you one confirmation. We answer personally and there is no automated follow-up beyond that confirmation.

Data

• Name, email address, the message and the topics you ticked
• Your browser identification at the time of sending

Purpose

Answering your message.

Legal basis

Steps at your request before entering into a contract (Article 6(1)(b) GDPR), or our legitimate interest in answering correspondence (Article 6(1)(f)).

Retention

Until the conversation is closed and in any case reviewed and pruned once a year. Write to us and it is deleted within one month.

Rate limiting

To keep the two forms from being flooded, the service that receives them records the IP address of every attempt and refuses more than three submissions per address per hour. This is the only place where the IP address of a submission is kept.

Data

• IP address and time of each submission attempt

Purpose

Preventing abuse of the forms.

Legal basis

Legitimate interest (Article 6(1)(f) GDPR) in keeping the service available.

Retention

Rows older than 24 hours are deleted the next time the service writes to the table, so no attempt is kept longer than a day.

We use Google Analytics 4 to see which pages are read and whether the two forms are used. Google Analytics is not loaded until you accept on the banner: the consent default is denied, and the tag is only loaded after you choose Accept. Your choice is stored in your browser under one key and stays until you change it through the Cookie settings link in the footer or clear the site's data. If you decline, the site works exactly the same and nothing is sent to Google. If you withdraw an earlier Accept, the page reloads without Google Analytics and its cookies are deleted.

Data

• Page views, with the page, the referrer, the approximate location Google derives from your IP address and the device and browser type
• Events, when they happen, with no personal data attached: your progress through the assessment (opening it, starting it, each question you answer and section you complete, reaching the contact step, a send that fails), never your answers; an assessment sent, with its readiness level and risk category; and a contact message sent, with the topics ticked
• The cookies Google Analytics sets to recognise a returning browser

Purpose

Understanding which content is read, where visitors stop in the assessment and whether the forms work.

Legal basis

Your consent (Article 6(1)(a) GDPR), asked on the banner and withdrawable at any time.

Retention

Event data is kept in Google Analytics for the period configured in our property, at most 14 months. The consent choice stays in your browser until you clear it.

We use Cloudflare Web Analytics to count page views. It runs without cookies and stores nothing on your device, does not follow you across sites and builds no profile, so it does not need your consent: it runs the same whether or not a consent banner is shown, and whatever you choose on one.

Data

• Page views with the page, the referrer, the country and the browser type, aggregated by Cloudflare

Purpose

Understanding which content is read.

Legal basis

Legitimate interest (Article 6(1)(f) GDPR) in measuring the use of the site without identifying anyone.

Retention

Aggregated by Cloudflare; no data about an individual visitor is kept.