Privacy Policy

1. Who we are and who is responsible for your data

RSO operates this website and is the controller of the personal data described here, within the meaning of Article 4(7) GDPR. The controller is the company that operates rso.dev, and its details are listed below. Every question about this policy, and every request under the section on your rights, goes to the address under Contact points at the end of this page. You do not need to find a department or a named person: that one address reaches the people responsible for data protection here.

Legal entity

Company registration number

VAT number

Registered address

2. What this policy covers

This policy covers the RSO website at rso.dev. Where we have signed a separate written agreement with you, that agreement and any data processing agreement under it govern the data we handle for you, and not this page.

3. What information we collect

We collect what you type into a form, and beyond that only what the sections below name. The contact form collects your first and last name, your email address, your company name where you give one, and your message. The start a project form collects your company name, size and type, your first and last name, your email address, a phone number where you give one, and your message. The careers form collects your first and last name, your email address, the address of your public code profile, your LinkedIn address where you give one, and your application message. The integration request form collects the integration you are asking for, your email address and any details you add. The newsletter form collects your email address. Every form also sends a Google reCAPTCHA token, and Google receives your IP address and device and interaction signals in order to tell a person from a bot. If you accept analytics in the consent banner we collect usage data about your visit: a pseudonymous identifier, the pages you view, an approximate location derived from your IP address, and browser and device characteristics. Where an error collector is configured for a deployment, a JavaScript error on a page sends it the error message and stack trace the browser produced, the address of the page and the identifier of the build.

4. Why we process it, and on what legal basis

We answer what you send through the contact, start a project and integration request forms in order to take steps at your request before entering into a contract, and in our legitimate interest in responding to business enquiries (Article 6(1)(b) and 6(1)(f) GDPR). We handle a careers application in order to take steps at your request before entering into an employment contract (Article 6(1)(b) GDPR). We add you to the newsletter list only when you tick the consent box on the newsletter form yourself, which is consent under Article 6(1)(a) GDPR, and every message we send carries an unsubscribe link. We load analytics, and any marketing tag, only after you accept the matching category in the consent banner, which is also consent under Article 6(1)(a) GDPR. We run the anti-spam challenge on every form, and record a technical error entry when a page or a submission fails, in our legitimate interest in keeping the site available, free of abuse and working (Article 6(1)(f) GDPR). The cookie that remembers the language you are reading in and the cookie that records your consent decision are strictly necessary for a service you asked for, so they are set without consent.

5. How long we keep it

We keep each category of personal data only as long as is necessary for the purpose it was collected for, and delete it once that purpose is spent. Where a statutory retention obligation applies, that obligation sets the period instead, and it overrides the purpose test for as long as it runs. Applied to what section 3 lists, that means: an enquiry is kept while we are handling it and for as long as we may still need it to answer a follow-up or to establish, exercise or defend a legal claim; a careers application is kept while the application is open and for as long as we may still need it for the same reasons; a newsletter subscription is kept until you unsubscribe, and every message we send carries the unsubscribe link; analytics data and error reports are kept only as long as they serve the measurement and reliability purposes named in section 4. We would rather publish the criterion we actually apply than a number we do not. Ask us at the address under Contact points and we will tell you the period that applies to your data.

6. Who we share it with

We do not sell personal data, and we do not share it for advertising beyond the marketing category you switch on yourself. We share it with the providers that operate parts of this site for us: Twilio SendGrid, which delivers the email carrying a contact, start a project, careers or integration request submission to us; MailerLite, which holds the newsletter list; and Google, which runs the reCAPTCHA check on every form and, once you accept analytics, Google Analytics and Google Tag Manager. Where they are configured for a deployment, Microsoft Clarity receives analytics data once you accept analytics, and the LinkedIn Insight Tag receives marketing data once you enable the marketing category. Error reports go to a collector we run ourselves, so they reach no third party. Beyond that we disclose personal data only where the law obliges us to, or to establish, exercise or defend a legal claim.

Not published yet:

• The country each processor operates from

7. Transfers outside the EEA

Some of those providers process data outside the European Economic Area, in particular in the United States. A transfer of that kind is lawful only under a mechanism named in Chapter V GDPR, such as an adequacy decision or the European Commission's standard contractual clauses. We are not naming the mechanism for each recipient until it has been verified for that recipient, because a safeguard we have not checked is not a safeguard.

Not published yet:

• Transfer mechanism relied on for each recipient outside the EEA
• How to obtain a copy of those safeguards

8. Cookies and similar technologies

Nothing that is not strictly necessary is stored on your device before you agree to it. The consent banner on your first visit is the control: it records your choice, and no analytics tag and no marketing tag loads unless you accept. Our cookie policy lists every cookie and storage entry the site uses, what it is for, who provides it and how long it lasts, and it carries a button that forgets your decision and brings the banner back, so you can change or withdraw that choice at any time. Your browser settings are not how you switch this site's analytics off, and an earlier version of this policy was wrong to say they were.

9. Your rights

You have the right to ask us for a copy of the personal data we hold about you (Article 15 GDPR), to have inaccurate data corrected (Article 16), to have data erased (Article 17), to have processing restricted (Article 18), to receive the data you gave us in a portable, machine-readable form (Article 20), and to object to processing we base on our legitimate interests (Article 21). Where we rely on your consent you may withdraw it at any time, which does not affect processing carried out before you withdrew it (Article 7(3)). Write to the address under Contact points below. We answer within one month and tell you if we need longer, as Article 12(3) requires. Exercising a right costs you nothing.

10. Complaining to a supervisory authority

If you believe we are handling your data unlawfully you can lodge a complaint with a data protection supervisory authority under Article 77 GDPR, in addition to anything you take up with us. The authority to approach is the one in the country where you live, where you work, or where the alleged infringement took place. That is your choice and not ours, which is why we name no single authority here. The European Data Protection Board publishes the list of national authorities and their contact details at edpb.europa.eu. Raising the matter with us first is not a precondition for complaining, but the address under Contact points is usually the fastest route to a fix.

11. Data protection contact

Write to the address under Contact points below for anything to do with this policy, including any request under section 9. That address is monitored and reaches the people responsible for data protection here. We do not name an individual data protection officer, because we are not going to assert a role we have not appointed. If Article 37 GDPR comes to require us to designate one, or Article 27 to appoint a representative in the Union, we will publish those contact details here, and the address under Contact points will keep working either way.

12. Automated decision-making

This website does not take automated decisions that produce legal effects for you or similarly significantly affect you, and it does not profile you.

13. Third-party websites

Our website links to third-party websites. We are not responsible for their content, their policies or their practices, and this policy does not apply to them. Read their privacy policies before interacting with them.

14. Changes to this policy

We update this policy when what we do with data changes. The date at the top of the page is the date of the version you are reading. Where a change concerns processing we base on your consent, we ask for consent again rather than relying on the consent you gave for something else.

15. Contact points

Write to us about anything in this policy. The first address below is the one to use for a data protection question or a request under section 9.

• Data protection requests: [email protected]
• General enquiries: [email protected]
• Support: [email protected]