Privacy Policy

RETEC is a small digital studio. We build websites, web applications and custom software. This website exists to show that work and to let people start a conversation with us.

We are a studio, not a platform. There is no account to create, nothing to download behind a paywall, and no marketplace. If you only read this site, you do not give us an account, a password or a profile.

We do not sell personal information, and we do not share it for advertising. There is no advertising network on this site.

You give us information in two ways: by submitting a form, or by sending us an email or message. What each one collects is listed below, because the difference matters.

Project inquiry form

The "Start a Project" form asks for:

Name

Your name. Required.

Email address

So we can reply to you. Required.

Business / Organization

Optional. Leave it blank if you are enquiring as an individual.

Project type

Optional. Selected from a fixed list.

Budget range

Optional. Selected from a fixed list.

Project details

Your message. Required. Please do not include credentials, identity documents or anything else you would not want forwarded by email.

Your inquiry is emailed to the studio. The email record includes your name, email address, the fields above and the network address the request came from, so that replies can be traced if something goes wrong.

Your name and email address are also saved to our mailing list, so we can contact you about the enquiry and send occasional studio updates. You can ask us to remove that record at any time.

Discovery questionnaire

The discovery questionnaire at "/start-a-project" is the detailed first step of a project. It asks about you and how to reach you (name, email, phone, business, location, role and preferred contact method); what the business does and its current digital presence; what you want built and what success would look like — the last two are required, along with your name and email; the features you need from a fixed list; what content, brand assets, design references and technical integrations already exist; timeline and deadline; a budget range; who decides and approves; and anything else you want us to know.

Your answers are stored as a record in our database and attached to an internal project record, and the submission is emailed to the studio. We use them to prepare the proposal — scope, timeline and price come from what you write. Nothing in the questionnaire commits you to anything, and you can ask us to correct or delete your responses at any time.

Become a Partner application form

The partner application asks for your name, email address, company or studio, your role or specialty, a link to your portfolio, the kind of collaboration you are proposing, your areas of expertise, and a longer message. All of it is stored, because an application is something we need to be able to refer back to.

Like the discovery questionnaire, your application is held as a record in our database rather than existing mainly as an email.

Newsletter signup

The signup form asks for an email address and, optionally, a name. The email address is checked against a verification service before it is accepted, to reduce the number of bounced and abandoned addresses we hold.

The website keeps a small first-party record of visits. It exists so we can tell which parts of the site are useful and which are ignored. It is not an advertising profile and it is not linked to an identity.

Page views

Page

The path you requested.

Network address

The IP address the request came from.

Browser

The browser and operating system string your browser sends with the request.

Time

When the request arrived.

Section interest

When you scroll a section into view, or click a link that leaves the site, we record which section you were in and that you did so. Again: the section, the action, your IP address and the time.

Approximate location

The IP address above is looked up against a public geolocation database to derive a country and city. We store that derivation, not the address that feeds it. It is coarse — typically city level — and it exists so the studio can see roughly where its audience is.

Server logs

Our host records standard request logs, as any web host must. These are operational and are governed by the retention described in section 09.

• To reply to your enquiry, and to keep a record of what was agreed.
• To assess and respond to partner applications.
• To send the studio newsletter and, where you have asked for it, occasional updates about work and thinking.
• To understand which pages and sections are read, so the site can be improved.
• To keep the site running, secure and available.
• To meet legal obligations that apply to us.

We do not use information from this website to build advertising segments, and we do not sell or rent it.

RETEC is a small studio and we do not have a separate data protection officer. Privacy enquiries go to the same mailbox as everything else.

This site sets no advertising cookies, no analytics cookies from third parties, and no cross-site trackers. There is no cookie banner here because there is nothing to consent to.

The one cookie that exists

Signing in to the private admin area sets a single session cookie. It contains a signed identifier that lets the server recognise an authenticated administrator. It carries no personal information, it is not readable by other sites, and it is destroyed when the browser closes. Visitors to the public site never receive it.

Local storage and similar

We do not use local storage, IndexedDB or device fingerprinting to identify returning visitors.

Analytics on this site are first-party: the numbers are recorded by our own server from our own pages. No third-party analytics script runs here.

Services that receive your information

We use a small number of providers. Each one is listed with what it actually receives:

Transactional email provider

Brevo delivers the email this site sends — enquiry notifications, application notifications and the newsletter. It receives the recipient address and the message body of each send.

Transactional SMS provider

The same provider can text the studio when a new enquiry arrives. The message contains the contact details from your enquiry. This is a notification to us, not to you.

Email verification provider

ZeroBounce checks that a newsletter address is deliverable before we store it. It receives the address being checked.

IP geolocation provider

ip-api.com resolves an IP address to a country and city. It receives the address, and returns only the country and city.

Mailing list hosting

Newsletter contacts are held in the email provider's contact list so that broadcasts can be sent.

Assets loaded from other companies

The page you are reading loads a small number of files from CDNs rather than from our own server. As with any request to another company, those CDNs see the request that reaches them, which includes your IP address and browser string:

• A font and icon stylesheet, from a public CDN.
• The animation libraries that drive the page, from a public CDN.
• One small portrait image in the navigation bar, hosted on an image hosting service rather than ours.
• A fallback background photograph, from a stock image service, used only if no background of our own is configured.

Our own brand typeface is served from our own server, not from a third party.

We share information only where a service cannot work without it, or where the law requires it:

• With the email, SMS, verification and geolocation providers listed in section 06, to the extent needed to perform the service they perform for us.
• With our hosting and database providers, which store the site and its data.
• With professional advisers or authorities where we are legally required to do so.

We do not sell personal information. We have never sold it and this policy does not create a way to.

None of these recipients are allowed to use your information for their own purposes. That is a contractual obligation we place on them, not a claim about how they are built.

The application is served from a managed web host behind a CDN and proxy, and its data is held in a managed PostgreSQL database. Records about you therefore leave the browser and are processed on infrastructure operated by other companies.

Those providers act as processors on our instructions. They are not independent controllers for your information, and they do not use it to build their own profiles.

We keep information only as long as it is doing a job.

Enquiry, questionnaire and application records

Kept for as long as the conversation or collaboration lasts, and then deleted. [TODO: ...]: state a specific period, for example "24 months after the last exchange", and apply it to the stored rows.

Newsletter records

Kept until you unsubscribe, then marked inactive and retained briefly before removal. [TODO: ...]: confirm the deletion interval.

Analytics records

Page views, section interest and location records are kept indefinitely at present. [TODO: ...]: decide on a rolling window — 12 months is typical — and delete beyond it.

Server logs

Set by our hosting provider. [TODO: ...]: confirm the provider's retention window.

Backups

Database backups are kept in rotating fashion by an operator-run script. [TODO: ...]: confirm how long the host keeps a backup before overwriting it.

When we delete a record, it stops being available in the application. It may persist briefly inside a backup until that backup is rotated out — an ordinary property of backup systems, not a hidden second copy.

RETEC is a small studio, so the honest framing is: we take this seriously, we do a specific set of things well, and we do not claim certifications we do not hold.

• All pages and form submissions are served over HTTPS. Credentials and form data are encrypted in transit.
• The single administrator account stores a hashed password. The plaintext password is never written to the database.
• Administrative pages are protected by an authentication check performed on the server for every request. Hiding a link is not how that protection works.
• Public forms are rate limited, and each carries a hidden field that quietly rejects automated submissions.
• Forms are validated and constrained on the server. Submitted values are checked against an allowlist where they select from a list.
• Content published to the Journal is filtered to a fixed set of permitted tags and attributes before it is stored.
• Sensitive configuration — database credentials, API keys, the session key — is held in environment variables on the server and is never committed to source control.
• Uploads are restricted to an allowlist of image and video file extensions, given a generated filename, and size-capped.
• The database is written to through an application account, and the application refuses to run destructive operations against a remote database unless explicitly unlocked.
• Dynamic pages are served with caching disabled, so a page about you is not held in a shared cache.

The full picture, including the practices behind these controls, is set out on our Security page.

No system is perfectly secure. If a breach affecting your information occurs, we will investigate, and we will tell you what we find and what we have done about it.

Depending on where you live, you may have rights over personal information relating to you — to ask what we hold, to correct it, to have it deleted, to object to certain processing, or to complain to a regulator.

In practice, for this website, the whole list reduces to four emails:

• Ask what information we hold about you, and get a copy.
• Ask us to correct something that is wrong.
• Ask us to delete your enquiry, application or newsletter record.
• Ask us to stop emailing you. Every newsletter carries an unsubscribe link, and it works immediately.

We will act on a request from the address we hold for you, so that we can be sure we are not deleting a stranger's data on request. We will tell you if we cannot act on something, and why.

If you are in the EEA or the UK you also have the right to complain to your data protection authority. Elsewhere, your local regulator is the equivalent route.

This website is a portfolio and a contact point for a business. It is not directed at children, and we do not knowingly collect personal information from anyone under 16.

If you believe a child has submitted information through one of our forms, tell us and we will delete it.

RETEC operates from Kenya. The hosting, database and email providers listed above are not all located in Kenya, so information you submit is processed on servers and systems in other countries.

Those transfers happen under the safeguards those providers publish for the arrangements they operate. We do not separately negotiate bespoke transfer terms for a studio of this size.

This policy changes when the website changes. The date at the top of this page is the real signal — it is updated whenever the text is.

If a change materially affects what we do with information you have already given us, we will tell you by email before it takes effect.

[TODO: ...]: the section above describes the intended behaviour. Wire it to a real notification if and when that process exists.

Privacy questions, access requests and deletion requests all go to one address. Read it first, because it is where we can actually check who you are against what we hold.

Privacy enquiries contact.retec@gmail.com

There is also a contact form on the homepage. Use the address for anything about your data — a form message is easier to lose than an email thread.