Who this notice covers
This notice covers visitors to hu.ci, email correspondence and users of hu.ci and Control accounts. You can contact hu.ci about this processing at hi@hu.ci.
Information a customer processes within a module is also covered by the arrangements with that customer. The customer decides how that information is used. For questions about it, contact that organisation; you can also ask us to forward your request.
Information and purposes
- Contact: your email address, your name if provided, and the contents of your message. We use these to reply and handle your enquiry or work with you.
- Accounts: name, email address, organisation, role, permissions and account status. This information comes from you or the administrator who creates your account. It is needed to provide and manage access.
- Sign-in: the email address, a temporary verification record for the code, attempts and session information. Codes are single-use and valid for up to 10 minutes. They are used to verify access to your email address.
- Security: IP address, browser information (user-agent), an indication of country, timestamps, requested paths and access outcomes may be recorded. These help identify misuse, investigate incidents and protect accounts.
- Appearance: your selected palette and light or dark appearance are remembered in your browser. The marketing website contains no advertising pixels or client-side analytics code. Fonts are served from our own domain.
Legal grounds for processing
For an enquiry or a service provided to you, we use the necessary information to take steps towards or perform a contract. For business contacts and users acting on behalf of an organisation, contact and access management rely on our legitimate interest in serving that organisation.
Security records and abuse prevention serve our legitimate interest in protecting the website, accounts and information. Where a legal obligation requires information to be retained, that obligation is the basis for that use. An email address is required to sign in with a code; without it, we cannot send a code.
Automated security checks may temporarily block a request. If this prevents you from accessing your account, contact hi@hu.ci.
Who receives information
These providers may process information outside the European Economic Area. Resend states that processing takes place in the United States. Resend’s and Cloudflare’s data processing terms describe international transfers and the safeguards they use, including European Standard Contractual Clauses. You can ask us about the arrangements that apply to your information.
- Cloudflare delivers and protects web traffic, provides the Turnstile security check and forwards mail addressed to our domain.
- Resend sends sign-in codes and processes the recipient address, message contents and delivery information for that purpose.
- Proton hosts our contact mailbox. Messages to hi@hu.ci are forwarded to that mailbox.
- The hosting provider operates the infrastructure for the website and applications. Authorised administrators may access information to perform their duties.
How long information is kept
Account information is retained while needed for the account and related services. Disabling access does not delete the account. You can request deletion at hi@hu.ci.
A sign-in code expires after 10 minutes and can be used once. A session lasts up to 24 hours and may be revoked earlier. These validity periods are not the retention periods for all associated security records.
Retention of correspondence and security records depends on handling your enquiry, the duration of the working relationship, the need to investigate an incident and any legal obligations or disputes. Ask us which retention period and reason apply to your information.
Your rights and questions
You may request access, correction, deletion or restriction of the use of your personal information. You may object to processing based on legitimate interests. Where the GDPR provides for it, you may request data portability or withdraw previously given consent. These rights are subject to conditions.
Send your request to hi@hu.ci. We may ask for further information to verify that the request comes from you; do not send a copy of your identity document unless asked. You may also complain to the Dutch Data Protection Authority or the supervisory authority in your EU country.