Privacy Policy
This policy explains how personal data is processed when you visit this website (itsmx.eu) or use its contact forms. It covers the marketing website only — the TENSOR product has its own privacy documentation and data-processing agreement.
1. Controller
[[ to be supplied: legal entity name ]]
[[ to be supplied: postal address ]]
Contact: Haris Dizdarević, hello@itsmx.eu
2. Hosting and content delivery
This website is a static site served by Cloudflare (Cloudflare, Inc. / Cloudflare Germany GmbH). When you access it, Cloudflare processes connection data technically required to deliver the pages — your IP address, the requested URL, date and time, browser user-agent, and referrer — in short-lived server logs used for security (e.g. DDoS mitigation) and operation of the network. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in securely and reliably delivering the website). Cloudflare participates in the EU–US Data Privacy Framework; delivery may involve Cloudflare edge locations outside the EU.
3. Analytics (only with your consent)
We use Plausible Analytics, a privacy-focused, cookie-free web-analytics service, and we load it only after you click "Accept all" in the cookie banner. If you reject or ignore the banner, no analytics script is loaded at all. Plausible does not use cookies, does not store your IP address, and does not track you across sites; we see aggregate page-view and event counts only. Legal basis: Art. 6(1)(a) GDPR (consent). Your choice is stored in your browser's local storage ("cookie-consent"); you can withdraw consent at any time by using the preference controls on the Cookie Policy page.
4. Demo and access-request forms
When you submit the "Book a demo" or "Request access" form, we process the data you enter (name, work e-mail, company, and the optional fields you fill in) to respond to your request, schedule the demo, or evaluate your design-partner application, and to follow up on it. Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract, taken at your request).
Depending on configuration, the form either opens your own e-mail client with a pre-filled message (nothing is transmitted until you send it yourself) or submits the data to our form service. The form service runs on Cloudflare Workers and stores the submission in a Cloudflare D1 database created with EU jurisdiction. A notification containing your submission is then sent to our sales inbox through Resend (Resend, Inc., USA), our e-mail delivery provider. We send from Resend's EU region, but Resend stores message content, delivery logs and account data in the United States. [[ to be supplied: transfer mechanism for Resend (e.g. DPF certification or SCCs) ]]
Stored submissions are deleted automatically 365 days after they are received. Data that has become part of a business relationship is kept for as long as that relationship and statutory retention duties require.
4a. Bot protection
To keep automated submissions out, the forms use Cloudflare Turnstile. Turnstile evaluates technical signals from your browser (such as IP address and browser characteristics) and returns a token that our form service checks with Cloudflare before accepting a submission. [[ to be supplied: legal basis for Turnstile ]]
4b. Newsletter
If you subscribe to product updates, we store your e-mail address and send you a confirmation link (double opt-in). You are added to the mailing list only after you click that link; an unconfirmed request is deleted about a week after the link expires (48 hours after it was sent). We keep the time of your confirmation as the record of your consent. The mailing list is held by Resend (see section 4). Legal basis: Art. 6(1)(a) GDPR (consent), which you can withdraw at any time through the unsubscribe link in every issue or by e-mailing hello@itsmx.eu.
5. E-mail contact
If you e-mail us directly (hello@itsmx.eu, sales@itsmx.eu, support@itsmx.eu), we process your message and address to answer you. Legal basis: Art. 6(1)(b) or (f) GDPR.
6. No profiling, no sale of data
We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR, and we do not sell personal data.
7. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing based on legitimate interest (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future. You also have the right to lodge a complaint with a data-protection supervisory authority.
8. Changes
We will update this policy when the website's data processing changes. The current version is always available on this page.