Privacy Policy & GDPR Compliance

1. Data Controller Information

This Privacy Policy outlines how Miscat.tech collects, processes, and protects personal data and manages website telemetry across https://miscat.tech.

The Data Controller under Article 4(7) of Regulation (EU) 2016/679 (GDPR) is:

2. Categories of Processed Data and Legal Grounds

• Contact Form & Meeting Scheduler (Google Meet / Cal):
  Collected data: Name, company name, email address, phone number, technical project brief, preferred meeting time.
  Legal basis: Taking steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR) and legitimate interest in B2B business correspondence (Art. 6(1)(f) GDPR).
• Engineering Newsletter:
  Collected data: Work email address.
  Legal basis: Voluntary consent (Art. 6(1)(a) GDPR).
• Cookieless Web Telemetry (Vercel Analytics & Speed Insights):
  Collected data: Pseudonymized IP hash, device category, screen dimensions, operating system, Core Web Vitals speed indicators.
  Legal basis: Legitimate interest in maintaining infrastructure reliability, security, and response times (Art. 6(1)(f) GDPR).

3. Zero Third-Party Advertising Cookies (Cookieless Design)

Miscat.tech operates on privacy-first engineering standards:

• We do not deploy third-party advertising or profiling cookies (no Meta Pixel, no Google Ads remarketing).
• Vercel Web Analytics runs in strict cookieless mode — it creates no persistent identifiers and never tracks users across other web services.
• Browser localStorage is exclusively used to persist cookie banner UI preferences.

4. Trusted Subprocessors

Data is transferred solely to verified cloud infrastructure providers with signed Data Processing Agreements (DPA) or under EU Standard Contractual Clauses (SCC):

• Vercel Inc. (USA / EU): Cloud hosting, edge CDN network, and cookieless telemetry.
• Resend Technologies Inc. / SMTP Providers: Transactional email delivery.
• Google Ireland Ltd. / Google LLC: Domain email hosting and Google Meet video appointments.
• Cloudflare Inc.: DNS routing, TLS/SSL termination, and DDoS mitigation.

5. Data Retention

• Contact inquiries: Maintained for the duration of B2B negotiations and archived for up to 3 years to defend against potential legal claims.
• Newsletter subscribers: Stored until consent is revoked (via unsubscribe link or email).
• Telemetry metrics: Retained for up to 30 days for operational debugging.

6. Your Rights Under GDPR

You have the right to access (Art. 15), rectify (Art. 16), erase (Art. 17), restrict processing (Art. 18), transfer data (Art. 20), and object to processing (Art. 21 GDPR).

You also have the right to lodge a formal complaint with the supervisory authority: President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

7. Data Protection Inquiries

To exercise your rights or request data erasure, contact us at: kontakt@miscat.tech.