Privacy policy

1. Data controller

Iberix Dynamics LLC, a limited liability company organised in New Mexico, United States (New Mexico Business ID 7405251) is the controller of the personal data described here. Iberium is a brand operated by Iberix Dynamics LLC.

For anything in this policy — including to exercise the rights in section 7 — write to privacy@iberiumworks.com.

2. What we collect

Two things always, and a third only if you agree to it:

• What you type into the enquiry form. That is your name, your work email address, your company, its size and industry, and your answers about how your business currently operates. Everything except name, email, company and company size is optional, and you decide how much detail to give.
• Ordinary technical data created by visiting any website: IP address, browser and device type, pages requested, and timestamps. Our hosting provider records these in server logs to keep the site running and secure.
• If you accept analytics: which pages you look at, how long you actually spend reading them, how far down each page you get, roughly where you arrived from, your device and browser, and whether you started or finished the enquiry form. Two systems record this at the moment: Google Analytics, and analytics we run ourselves on a database in Frankfurt. We currently use both in parallel so we can validate the measurements produced by our own analytics against Google Analytics. Neither analytics system stores your IP address in our analytics data. Approximate country and region are derived by our hosting provider before the request reaches our analytics code. The cookie policy sets out exactly what is stored and for how long.

For the analytics we run ourselves we are the controller, not just a customer of somebody else's tool — which is the point of running it. It is designed to measure how the site is used without identifying you directly. It works from random identifiers we generate, tied to nothing about you, and it never records what you type, where your pointer goes, or anything you enter into a form. We do not build advertising profiles, we do not sell anything about you, and we make no automated decisions about you. Analytics does not load until you accept it, and the advertising features of Google Analytics are switched off. Your browser also stores a single sessionStorage entry, created by the site's router purely to restore your scroll position as you move between pages: it holds no identifier, is never sent to us or to anyone else, and your browser clears it when you close the tab.

3. Why we use it, and on what legal basis

• To read your enquiry and reply to it — Article 6(1)(b) GDPR, steps taken at your request before entering into a contract.
• To assess whether we are a suitable fit for the work described, and to keep a record of the exchange — Article 6(1)(f), our legitimate interest in running and documenting our business, balanced against your interests.
• To keep the site available and defend it against abuse — Article 6(1)(f), our legitimate interest in the security of our own systems.
• To keep a record that you were shown, and confirmed you had read, the terms and this policy — Article 6(1)(f), our legitimate interest in being able to show on what basis data was provided.
• To understand how this website is used — Article 6(1)(a), your consent, given through the cookie prompt. This is the only thing here that runs on consent, and nothing is collected for it unless you accept.

Everything apart from analytics rests on the bases above rather than on your consent. Where we do rely on consent, you can withdraw it whenever you like through the Cookie settings link at the foot of any page; withdrawing stops any further collection and does not affect what was collected while it applied. The boxes on the enquiry form record that you accept the terms and that you have read this policy — nothing more, and they are not analytics consent.

We do not use your enquiry to add you to a marketing list. If we ever want to send you something that is not a reply, we will ask you first.

4. Who else sees it

Your enquiry is emailed to one inbox and read by us. These providers process data on our behalf, under contracts that restrict them to our instructions:

• Vercel Inc. — hosting and delivery of this website, including the server logs described above.
• Resend (Plus Five Five, Inc.) — the service that delivers the enquiry email.
• Google LLC (Google Workspace) — the email service that hosts the inbox your enquiry is delivered to, and the privacy@iberiumworks.com address.
• Google Ireland Limited and Google LLC (Google Analytics) — measurement of how this site is used, and only where you have accepted analytics. Your enquiry is not sent to Google Analytics.
• Supabase, Inc. — the database that stores the analytics we run ourselves, hosted in Frankfurt, Germany, and written to only where you have accepted analytics. It holds no enquiry data of any kind.

We do not sell personal data, and we do not share it with anyone else unless the law requires it.

5. International transfers

We are established in the United States, and so are the providers above, so the personal data described in this policy is processed there. Where the data protection law that applies to you requires a transfer mechanism, these are the safeguards relied on:

• Vercel Inc. — international transfers are governed by Vercel's data processing addendum, including the European Commission's Standard Contractual Clauses where required.
• Resend (Plus Five Five, Inc.) — international transfers are governed by Resend's data processing addendum, including the European Commission's Standard Contractual Clauses where required.
• Google Workspace — international transfers are governed by Google's Cloud Data Processing Addendum, including the applicable transfer mechanism or Standard Contractual Clauses where required.
• Google Analytics — international transfers are governed by Google's data processing terms for that service, which rely on Google's certification under the EU–US Data Privacy Framework and on the Standard Contractual Clauses where required.

You can ask us for a copy of the mechanism relied on.

6. How long we keep it

If an enquiry does not lead to a conversation, we delete it within 12 months. If it leads to a proposal or an engagement, we keep it for the life of that relationship and then for as long as the commercial and tax law that applies to us requires business records to be retained. Server logs are kept for a short operational period and then discarded.

Analytics, where you have accepted it: Google Analytics is set to retain its data for 14 months. In the analytics we run ourselves, the detailed records — which pages were viewed, in what order, and what happened on them — are deleted after 14 months. The random visitor identifier and its record are deleted 180 days after your last visit, and once that happens the earlier sessions can no longer be connected to any visitor at all. What we keep beyond that is daily totals: counts by page, language, country and device, with no identifier in them and nothing that could be traced back to a person.

7. Your rights

Under the GDPR you can ask us to:

• give you a copy of the personal data we hold about you;
• correct it if it is wrong or incomplete;
• delete it;
• restrict what we do with it, or object to processing based on our legitimate interests;
• send it to you, or to another provider, in a portable format.

Write to privacy@iberiumworks.com and we will respond within one month. If you are not satisfied with how we have handled it and you are in the EU or the EEA, you can complain to the supervisory authority of the country where you live or work, or where the issue arose.

8. Security

The site is served over HTTPS, the enquiry inbox is access-controlled, and the recipient address is held as a server-side secret rather than published on the site. No transmission over the internet is completely secure, which is why we ask you not to send confidential material through the form.

9. Changes

If this policy changes we will publish the new version here and update the date at the top. Where a change is significant and we hold your contact details, we will tell you directly.