--- title: "Privacy policy | DataWeavrs" description: "What DataWeavrs collects on dataweavrs.com, through the AI Act Readiness Assessment and the contact form, why, for how long, who processes it, and your rights." url: "https://dataweavrs.com/privacy" lang: "en" --- Privacy · Last updated 23 September 2026 # What we collect, and _why._ This page describes what happens to personal data on dataweavrs.com: when you read a page, when you take the AI Act Readiness Assessment, and when you send us a message. It is written to match the code that runs the site, and it changes when that code does. ## Who is responsible DataWeavrs, with offices in Brussels (Belgium) and Madrid (Spain), is the controller of the personal data described on this page. You can reach us at [hello@dataweavrs.com](mailto:hello@dataweavrs.com) for any question about your data. ## What we process, and why Four things happen on this site that involve personal data. Each one is described with the data involved, the purpose, the legal basis under the General Data Protection Regulation (GDPR) and how long we keep it. ### Reading a page The site is static pages served by Cloudflare. Serving a page means Cloudflare receives your IP address and the headers your browser sends, and uses them to deliver the page, to protect the site against abuse and to keep aggregate traffic figures. The typefaces are served with the pages, so no font service is involved. We do not receive these logs and set no cookies of our own on a page view. The AI Act page also loads an assistant widget from euaiact.weavrcore.com, which is the DataWeavrs platform on our own stack; that request carries your IP address and browser type like any page load. Data - IP address and browser identification, processed by Cloudflare to serve the page and detect abuse Purpose Delivering the site securely. Legal basis Legitimate interest (Article 6(1)(f) GDPR) in serving the site and keeping it available. Retention We keep nothing. Cloudflare keeps its own request logs for the period set in its privacy notice. ### The AI Act Readiness Assessment When you finish the [assessment](https://dataweavrs.com/assessment) and ask for your report, we store your answers and your contact details, compute a risk category and a readiness score from fixed rules, email you the report, and email our team a notification so that one person can follow up once. The consent box on the form says exactly that: your report, and one contact to discuss the results. Nothing goes into a mailing list. Data - Name, email address, company and role - Your 27 answers (six on the risk category of your use case, 21 on readiness), the computed risk category, whether general-purpose AI applies, the readiness score and status per domain, the overall score and level, and the number of open items - The country derived from your IP address (not the address itself), the page that sent you to the assessment and your browser identification - Whether the two emails were delivered, and the error if one was not Purpose Producing and sending the report, and one follow-up conversation about the results if you want it. Legal basis Your consent for the report and the follow-up (Article 6(1)(a) GDPR), and our legitimate interest in answering a business enquiry (Article 6(1)(f)). You can withdraw consent at any time by writing to us. Retention Until you ask us to delete the submission, and in any case reviewed and pruned once a year. Write to us and it is deleted within one month. ### The contact form When you send a message through the [contact page](https://dataweavrs.com/contact), we store it with your name and email address, email our team, and email you one confirmation. We answer personally and there is no automated follow-up beyond that confirmation. Data - Name, email address, the message and the topics you ticked - Your browser identification at the time of sending Purpose Answering your message. Legal basis Steps at your request before entering into a contract (Article 6(1)(b) GDPR), or our legitimate interest in answering correspondence (Article 6(1)(f)). Retention Until the conversation is closed and in any case reviewed and pruned once a year. Write to us and it is deleted within one month. ### Rate limiting To keep the two forms from being flooded, the service that receives them records the IP address of every attempt and refuses more than three submissions per address per hour. This is the only place where the IP address of a submission is kept. Data - IP address and time of each submission attempt Purpose Preventing abuse of the forms. Legal basis Legitimate interest (Article 6(1)(f) GDPR) in keeping the service available. Retention Rows older than 24 hours are deleted the next time the service writes to the table, so no attempt is kept longer than a day. ## Analytics and cookies We use Google Analytics 4 to see which pages are read and whether the two forms are used. Google Analytics is not loaded until you accept on the banner: the consent default is denied, and the tag is only loaded after you choose Accept. Your choice is stored in your browser under one key and stays until you change it through the Cookie settings link in the footer or clear the site's data. If you decline, the site works exactly the same and nothing is sent to Google. If you withdraw an earlier Accept, the page reloads without Google Analytics and its cookies are deleted. Data - Page views, with the page, the referrer, the approximate location Google derives from your IP address and the device and browser type - Events, when they happen, with no personal data attached: your progress through the assessment (opening it, starting it, each question you answer and section you complete, reaching the contact step, a send that fails), never your answers; an assessment sent, with its readiness level and risk category; and a contact message sent, with the topics ticked - The cookies Google Analytics sets to recognise a returning browser Purpose Understanding which content is read, where visitors stop in the assessment and whether the forms work. Legal basis Your consent (Article 6(1)(a) GDPR), asked on the banner and withdrawable at any time. Retention Event data is kept in Google Analytics for the period configured in our property, at most 14 months. The consent choice stays in your browser until you clear it. We use Cloudflare Web Analytics to count page views. It runs without cookies and stores nothing on your device, does not follow you across sites and builds no profile, so it does not need your consent: it runs the same whether or not a consent banner is shown, and whatever you choose on one. Data - Page views with the page, the referrer, the country and the browser type, aggregated by Cloudflare Purpose Understanding which content is read. Legal basis Legitimate interest (Article 6(1)(f) GDPR) in measuring the use of the site without identifying anyone. Retention Aggregated by Cloudflare; no data about an individual visitor is kept. ## Who processes the data for us Three companies process personal data on our behalf, under contracts that bind them to our instructions. | Provider | What it does for us | Where it is | | --- | --- | --- | | Cloudflare, Inc. | Hosts the site, runs the service behind the two forms, stores the submissions in its database and protects the site against abuse. | United States, with data centres in the European Union. | | Resend, Inc. | Delivers the report, the confirmation and the notifications to our team by email. | United States. | | Google LLC | Provides Google Analytics, only if this site carries the tag and you have accepted it. | United States, with data centres in the European Union. | ## Transfers outside the European Union The three providers above are United States companies. Where a provider is certified under the EU-US Data Privacy Framework, the transfer rests on the European Commission's adequacy decision for that framework. Otherwise it rests on the Commission's standard contractual clauses, which the provider's data processing terms include. Write to us for a copy of the applicable terms. ## Your rights The GDPR gives you the following rights over the personal data we hold about you. None of them costs anything, and we answer within one month. - To access it, and to receive a copy - To have it corrected when it is wrong or incomplete - To have it deleted - To have its processing restricted while a question about it is settled - To receive the data you gave us in a machine-readable form - To object to processing based on our legitimate interest - To withdraw a consent you gave, without affecting what was done before the withdrawal To use any of these rights, write to [hello@dataweavrs.com](mailto:hello@dataweavrs.com) from the address you used with us, or tell us how we can confirm it is you. If you believe we handle your data unlawfully, you can complain to a supervisory authority: in Belgium the [Data Protection Authority](https://www.dataprotectionauthority.be/), in Spain the [Agencia Española de Protección de Datos](https://www.aepd.es/), or the authority of the country where you live or work. ## Automated decisions The risk category and the readiness score are computed automatically from your answers by fixed rules, and the report is written from them. This produces a document for you, not a decision with legal or similarly significant effect on you. A person reads every submission before any contact is made. ## Children The site and the forms are addressed to people acting for an organisation. We do not knowingly collect data from anyone under sixteen; if you believe a child has sent us data, write to us and we delete it. ## Changes to this page This page describes the site as it is built. When what we collect changes, the page changes in the same release and the date at the top moves. A substantive change is announced on the page itself for a month after it takes effect. ## Questions Anything unclear, or a request about your data: [hello@dataweavrs.com](mailto:hello@dataweavrs.com). ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://dataweavrs.com/#organization", "name": "DataWeavrs", "url": "https://dataweavrs.com/", "email": "hello@dataweavrs.com", "logo": "https://dataweavrs.com/dataweavrs-logo.png", "sameAs": [ "https://www.linkedin.com/company/dataweavrs" ], "location": [ { "@type": "Place", "name": "Brussels", "address": { "@type": "PostalAddress", "addressLocality": "Brussels", "addressCountry": "BE" } }, { "@type": "Place", "name": "Madrid", "address": { "@type": "PostalAddress", "addressLocality": "Madrid", "addressCountry": "ES" } } ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://dataweavrs.com/#website", "url": "https://dataweavrs.com/", "name": "DataWeavrs", "inLanguage": "en", "publisher": { "@id": "https://dataweavrs.com/#organization" } } ] ```