Privacy

The controller for the processing described here is Coreveya Technologies Limited, Castleview, Waterford, Ireland.

For anything in this document, including a request under Articles 15 to 22 of the GDPR, write to privacy@coreveya.ie. We answer to that address rather than through the brief form on this site, because the form is itself one of the processing operations described below.

We have not appointed a data protection officer. Data protection questions are handled at the address above.

The current technical state of this website, verified against the built output rather than assumed:

No page on this site sets a cookie, embeds a tracking pixel, an advertising tag or a social plugin, and no page loads a font from another domain. The one exception to the no-third-party-script rule is the booking page, which loads cal.com's embed script so that the calendar can render inside the page; sections 06 and 07 below name cal.com and the transfer it involves. Nothing else here requires consent under the ePrivacy Directive, so you are not asked to accept cookies.

One qualification, so the panel is not read as more than it says. The booking page carries cal.com's calendar inside itself. The embed script and the calendar are served from cal.com's own servers, so opening the page makes your browser contact cal.com, and cal.com sees what any site you visit sees: your IP address, your browser and device details, and that the booking page was opened. What you type into the calendar, your name, your email address, the slot you choose, goes to cal.com and is not stored by this website at all. cal.com then writes the booking into our Microsoft 365 calendar and sends you the confirmation and the meeting link. What cal.com does with that data is governed by cal.com's own privacy policy at cal.com/privacy.

One entry, in your browser's local storage, named coreveya-theme. It holds the single word dark or light and is written only when you operate the light and dark toggle in the header. It holds no identifier, it is never transmitted to us, and clearing your browser storage removes it.

The basis for this is Article 6(1)(f) GDPR, the legitimate interest being to honour a display preference you set deliberately. There is no other cookie, tag or storage entry.

The brief form is the only place on this site where you hand us personal data. It does transmit what you type. An earlier version of this policy stated that it did not, which was wrong, and that is corrected here.

What is transmitted. The fields you complete: your name, your company, your email address, and, where you fill them in, your phone number, your description of the problem, the reasons you selected, who is involved, and your timeline. The time of receipt is recorded with the submission. Your IP address is not stored with the brief.

Where it goes. The form posts to a function running at Cloudflare's network edge. Each submission is written to a Cloudflare Workers KV store, and only once that store confirms the write are you told the brief arrived. Two emails are then sent through Resend: a notification to our team inbox, and a confirmation to the address you gave. Sending happens from the subdomain send.coreveya.ie, and replies go to contact@coreveya.ie, a shared mailbox in our Microsoft 365 tenant, which is where the brief is then worked on.

Email is best effort. If Resend fails, your brief is still stored and still reaches us. A failed send is never shown to you as an error, because the stored brief is the record that matters.

Legal basis. Handling your enquiry rests on Article 6(1)(b) GDPR, since you are asking us to take steps with a view to a contract. The confirmation email rests on the same basis: it acknowledges the request you just made and tells you what happens next. It is not marketing, there is no newsletter, and your address is not added to a mailing list or used to contact you about anything else.

Retention. The stored brief is kept for twelve months from receipt and is then removed automatically. Correspondence that follows in the mailbox is kept as long as it is needed for the business relationship, and where an enquiry becomes an engagement, accounting records are kept for the period Irish tax and company law require.

Spam handling. The form contains a hidden field that no person sees. If it is filled in, the submission is discarded: nothing is stored and nothing is sent.

Every request to this site passes through Cloudflare, which terminates the TLS connection at its network edge. Cloudflare therefore sees the connection details of every request, including your IP address, the resource requested and your browser identifier, and processes them to route the request and to protect the site against attack and abuse. Cloudflare also enables browser network-error reporting on its responses, which means your browser may report a failed connection to a Cloudflare endpoint.

There is no web server of ours behind that edge. This site is a set of static files and one small function, both served from Cloudflare's network, so there is no origin host of ours keeping an access log of your visit and no server-side session of any kind.

The basis for this log processing is Article 6(1)(f) GDPR, the legitimate interest being to keep the site available, diagnose faults and defend against attack. These logs are not used to build a profile of you or to measure audiences.

We cannot tell you how long Cloudflare keeps that edge data, because we never receive it. Our plan includes no log retention, export or streaming product, so no copy of those logs is delivered to us and we hold none. What Cloudflare retains at its own edge is governed by Cloudflare's terms, not set by us.

These are the service providers that process personal data on our instruction, what each does, and where. There are no others.

• Hetzner Online GmbH, Germany. Hosts the server that runs Coreveya Cloud, in its Falkenstein data centre. It provides the machine, the power and the network. It holds no key to the database and no account on the applications. It is not involved in serving this website.
• Cloudflare, Inc. Provides authoritative DNS for coreveya.ie, serves this website and the form function from its own network, terminates TLS and proxies every request, carries the connection to our Coreveya Cloud server through an outbound tunnel, stores submitted briefs in Workers KV, and operates the access gate in front of our administrative hostnames.
• Resend. Delivers the two emails a brief triggers, the internal notification and your confirmation. It receives the contents of those messages, which include the brief.
• Microsoft Ireland Operations Limited. Provides the Microsoft 365 tenant holding the contact@coreveya.ie mailbox that receives and answers briefs.
• Cal.com, Inc., United States. Provides the booking calendar embedded on the booking page. It receives the fact that the page was opened, together with the IP address and browser details any visited site sees, and it receives what you type into the calendar. It holds the booking record, writes the event into our Microsoft 365 calendar and sends the confirmation. Its privacy policy is at cal.com/privacy and its data processing agreement at trust.cal.com.

Each is engaged as a processor under Article 28 GDPR. The written record of those agreements is being completed, and none is described here as signed until it is: [ARTICLE 28 AGREEMENTS: EXECUTION BEING CONFIRMED PER PROCESSOR]

The Coreveya Cloud server is in Germany and the Microsoft 365 tenant is in the European Union. This website itself has no server of ours: it is served from Cloudflare's global network. Cloudflare and Resend are companies with a United States parent, so a request to this site can be handled at an edge location outside the EEA and a brief can be processed on infrastructure operated by a US company. The booking calendar adds a third: cal.com states that the data typed into its calendar is processed in the United States.

That position is not going to be described more comfortably than it can be evidenced. cal.com states that it relies on standard contractual clauses and, where it applies, the EU-US Data Privacy Framework. The lawful transfer mechanism for each provider, meaning the clauses or the adequacy decision that the executed agreement actually relies on, is being confirmed provider by provider and will be named here: [TRANSFER MECHANISM PER PROCESSOR: BEING CONFIRMED]

If you would rather your enquiry did not pass through those services, write directly to privacy@coreveya.ie instead of using the form. That reaches the Microsoft 365 mailbox without going through the brief store or Resend.

Coreveya Cloud is the tenant platform on coreveya.cloud. It is not open to the public: a tenant is created by us, and registration is closed to any address outside the email domains that tenant has declared.

Roles differ there, and the distinction matters. Where a customer organisation uses the platform, that organisation is the controller for its users and its content, and Coreveya acts as processor on its instruction under Article 28 GDPR. If you use the platform through your employer, address a request about your data to them first, and we support them in answering it. Where Coreveya uses its own tenant for its own staff, Coreveya is the controller.

What the platform holds about an account holder is a display name, an email address, the material needed to authenticate them, and records of authentication attempts. Passwords are stored only as an argon2id hash, never in readable form. The second-factor secret is encrypted with a key held outside the database. Recovery codes, session identifiers and short-lived login tokens are stored only as irreversible digests. Tenants are separated inside the database by row-level security. All of it sits on the server in Germany, and no third-party identity provider is involved.

Authentication records keep the client IP address at full precision for 7 days, after which it is truncated to a network prefix, and the record itself is deleted after 90 days. The administrative audit trail is kept for 730 days. Expired sessions and consumed login tokens are deleted. These periods are enforced by a scheduled database routine.

There is no backup of that server at present. That is stated plainly rather than implying a resilience we do not have, and it is on our record as an open item.

Under the GDPR you have the right to:

• Access your data (Art. 15)
• Have inaccurate data corrected (Art. 16)
• Have your data erased (Art. 17)
• Restrict processing (Art. 18)
• Receive your data in a portable form (Art. 20)
• Object to processing based on legitimate interests (Art. 21)
• Withdraw any consent you have given, at any time (Art. 7(3))
• Lodge a complaint with a supervisory authority (Art. 77)

Write to privacy@coreveya.ie. We answer within one month of receiving the request, as Article 12(3) requires, and we will tell you if we need to extend that and why. If you use a customer's Coreveya Cloud tenant, read section 08 first: your request belongs with your own organisation.

Coreveya is established in Ireland, so our supervisory authority is the Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland, dataprotection.ie.

You may also complain to the supervisory authority of the country where you live or work. For a visitor in Germany or Austria that means your own national or federal authority, and you do not have to come to Ireland to raise a concern.

There is no automated decision-making and no profiling within the meaning of Article 22 GDPR. Nothing about you is decided by a machine.

You are under no obligation to give us any data. You can read this site without providing anything. If you want an answer to an enquiry, we need a name, a company and an email address, because without them there is nothing to reply to. Everything else on the form is optional, and declining to use the form has no consequence other than that we cannot reply.

This document describes the current state of the systems it covers. When that changes, this page is updated and the revision date in the header changes with it.

Where something is not settled yet, it is marked in the text rather than described vaguely or left out.