01 / Responsibility
Who handles your data?
Alec Waumans, based in Belgium, publishes The World of Kyra, a personal engineering portfolio, and is responsible for the personal data processed through this site.
For any privacy request, write to Kyra.developpeur@gmail.com.
The learning shop is not open for sales. The site does not currently collect payments or customer accounts.
02 / Collection and use
Only what the exchange needs.
Contact messages
The form collects your name, email address and message. These fields are required to use it: without them, your message cannot be sent. They are used to read your enquiry, respond and follow up on the discussion. Please avoid sending sensitive information or information about other people that is not needed.
There is no legal obligation to use this form or provide these details. The name can be the name you wish to use in the conversation; no official identity document is requested. You can also use the direct email link.
Ordinary correspondence relies on my legitimate interest in receiving and responding to enquiries about my work (GDPR Article 6(1)(f)). Where you request steps towards a contract, processing necessary for those steps may instead rely on Article 6(1)(b). Your details are not sold or added to a marketing list.
Security and spam prevention
The website processes an IP address and temporary submission counters to limit abuse. Technical logs may include the date, requested page, response status, IP address and browser information. Their purpose is to keep the site available and investigate errors or attacks, based on the legitimate interest in protecting the service and its visitors.
Links are not allowed in the name or message, even a single link. A local filter checks for links and common spam patterns before any email is sent, without opening those links. A blocked submission is not sent; its text stays in the form so you can correct it or contact me directly. The filter can make mistakes and cannot stop every kind of spam. It does not profile you or make decisions with legal or similarly significant effects.
The site checks the email address format and the domain’s mail-routing configuration through DNS. It then emails you a six-digit code, valid for ten minutes with up to five attempts. Alec receives your message only after successful confirmation. After the outgoing mail service accepts the message, the site also sends an automatic acknowledgement in the language of the form. Failure of that acknowledgement does not cancel the original delivery. The code checks access to the mailbox; it does not establish your formal identity or guarantee that a message is legitimate.
Form submissions, including code requests and confirmation attempts, are limited to five per minute and twenty per hour per IP address, shared by both languages. Code requests are also limited to three per fifteen minutes for the same recipient; equivalent Gmail addresses using dots or a plus suffix share this limit.
03 / Recipients and transfers
The services involved.
- Scaleway
Hosts the website on a server in Paris, France. Hosting involves processing the technical data needed to serve and secure the site.
- Cloudflare
Manages the domain’s DNS records in DNS-only mode. In this configuration, it answers DNS queries but does not proxy the website’s HTTP traffic or the contact form.
- Google / Gmail
Gmail sends verification codes, confirmed contact messages and automatic acknowledgements. Contact correspondence is received and managed in a personal Gmail mailbox used by Alec. Google’s consumer terms and privacy policy apply. Google does not offer a data-processing agreement for consumer Gmail; this mailbox is not a Google Workspace account.
The email-domain check uses the DNS resolver configured on the server. Only the domain is queried, not your full email address or message. No external email-validation API is used.
Access to correspondence is intended for Alec and the services required to deliver and store it. Provider operations can involve processing outside the European Economic Area. A server in Paris does not mean all data stays in France.
Google describes processing in other countries, including the United States, and the transfer mechanisms it uses: adequacy decisions, including the EU–US Data Privacy Framework where applicable, and standard contractual clauses for transfers requiring them. Details and ways to obtain a copy of the safeguards are available in its data-transfer framework. You can also contact me to request information about the safeguards applicable to your data.
04 / Retention periods
A defined retention policy.
Daily cleanup is enabled for the portfolio’s current mailbox, dedicated server logs and historical system and web-server logs. Older correspondence in a previous mailbox and copies outside the server, including backups, are still being reviewed. Those copies may remain beyond the periods below until this work is complete. You can request deletion by email.
- Contact correspondence and acknowledgements
- In the current mailbox, contact messages, replies and acknowledgements become eligible for Trash 365 days after the last received or sent message in the conversation. A daily cleanup routine is enabled. Gmail keeps trashed messages for up to another 30 days before deletion.
- Verification-code emails
- Code-only conversations in the website’s mailbox become eligible for Trash seven days after their last message and are covered by the daily cleanup routine, followed by up to 30 days in Gmail Trash. Threads with a personal reply follow the correspondence rule. The code itself stops working after ten minutes. The website cannot remove the copy in the visitor’s mailbox.
- Website technical logs
- A maximum target of 30 days for routine logs, with daily rotation and cleanup enabled for the website logs and the server’s system and historical web logs. Separate provider logs and backup copies must be covered by their own verified settings.
- Pending confirmation
- For up to ten minutes, Redis stores keyed fingerprints of the submitted fields, the session token and the code, plus an attempt counter. It does not store the message text or readable code. The record is removed earlier when used or cancelled. Failed attempts do not extend its expiry. The original text remains in your form during confirmation.
- Temporary anti-abuse data
- IP submission counters expire with their rate-limit window of one minute or one hour. Recipient limits use a keyed fingerprint of the address and request timestamps; their record expires fifteen minutes after its last update. Form contents are not archived in a website database. The spam filter does not store rejected messages.
Daily processing normally occurs on the next scheduled run. An outage, a quota or a conversation requiring manual review can delay cleanup; execution failures are monitored. These periods are not a guarantee of deletion at an exact time.
A specific legal obligation or the handling of a dispute may justify keeping limited information longer. The reason, scope and review date must be recorded; this is not a blanket exception for keeping every message. Provider backup deletion follows their applicable policies.
06 / Your choices
Access, correct, delete.
Depending on the applicable conditions, you can request access, correction, deletion or restriction of your personal data. You can object to processing based on legitimate interests. Data portability applies where its legal conditions are met, notably for automated processing based on consent or a contract. If a future use relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.
Send your request to Kyra.developpeur@gmail.com. I normally respond within one month. If an extension is permitted because of the complexity or number of requests, I will tell you within that first month. Additional identity information will only be requested where needed to avoid disclosing data to the wrong person.
You can also lodge a complaint with the Belgian Data Protection Authority or your competent supervisory authority. Contact the Belgian authority
This notice will be updated if the service providers, uses of data or features of the portfolio change, including before any shop opens.