This page still contains information that Marl must confirm. Replace every highlighted placeholder before publishing it as final.
1. Who is responsible for your data
XXXXXX-XXXXX, trading as Marl, legal form XXXXXX-XXXXX, established at XXXXXX-XXXXX, registration number XXXXXX-XXXXX and VAT number/status XXXXXX-XXXXX, is the controller of the personal data described in this Policy. Contact: contact@marl.works | Telephone: XXXXXX-XXXXX | Privacy contact/DPO, if appointed: XXXXXX-XXXXX.
2. Scope
This Policy applies when you visit marl.works, use its contact form, request a proposal, communicate with Marl or become a client. Separate project agreements or data-processing agreements may provide additional information. Links to third-party websites are governed by their own privacy notices.
3. Data we collect
- Contact and enquiry data: name, email address, selected plan, message, preferred language and any information you choose to include.
- Technical and security data: IP address or a salted hash derived from it, timestamps, requested URL, user agent, referrer, response status and other hosting/security logs, depending on the confirmed Hostinger configuration.
- Commercial and project data: proposals, contracts, invoices, payment status, project files, credentials you provide, support requests and correspondence.
- Consent and preference data, only if optional analytics, marketing or similar technologies are introduced.
Please do not send special-category data, passwords or confidential third-party information through the general contact form unless Marl has specifically requested a secure method.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Answer enquiries, assess a project and prepare a proposal | Steps at your request before a contract, GDPR Art. 6(1)(b); legitimate interests for ordinary business follow-up where appropriate, Art. 6(1)(f) |
| Deliver web-development, hosting, maintenance and support services | Performance of a contract, Art. 6(1)(b) |
| Invoices, tax, accounting and legal records | Legal obligation, Art. 6(1)(c) |
| Protect the site, prevent spam, troubleshoot and defend claims | Legitimate interests in security, service integrity and legal protection, Art. 6(1)(f) |
| Optional analytics or marketing, if introduced | Consent, Art. 6(1)(a), where consent is required; you may withdraw it at any time |
5. Is the data required?
Fields marked as required are needed to understand and answer your enquiry. You are not obliged to provide other information, but Marl may be unable to prepare a suitable proposal or deliver contracted services without the data reasonably required for that purpose.
6. Recipients and processors
Personal data may be accessed by Marl and, only where necessary, by: hosting provider XXXXXX-XXXXX; email provider XXXXXX-XXXXX; invoicing/accounting provider XXXXXX-XXXXX; cloud or project tools XXXXXX-XXXXX; professional advisers and public authorities where legally required; and approved subcontractors XXXXXX-XXXXX. Each processor must be identified from the actual contracts and configuration. Data is not sold.
7. International transfers
Data is stored in XXXXXX-XXXXX. If a provider transfers personal data outside the European Economic Area, Marl will use an applicable adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses, and will provide further information on request. Confirm the real provider entities, regions and safeguards before publication.
8. Retention
- Non-client enquiries: XXXXXX-XXXXX after the last meaningful contact.
- Rate-limit IP hashes and timestamps: maximum XXXXXX-XXXXX, enforced deterministically in code.
- Hosting logs: XXXXXX-XXXXX, as confirmed with the host.
- Client, contract, invoice and project records: XXXXXX-XXXXX, based on contract, limitation, tax and accounting duties.
- Consent records: for the life of the consent and XXXXXX-XXXXX afterwards to demonstrate compliance.
- Backups: XXXXXX-XXXXX, after which they are overwritten or securely deleted.
Data may be retained longer where necessary to establish, exercise or defend legal claims, comply with law or preserve evidence of a dispute. It will then be restricted to that purpose.
9. Your rights
Subject to the GDPR and any applicable limits, you may request access, rectification, erasure, restriction, portability and objection. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. You may object at any time to direct marketing. Send requests to contact@marl.works. Marl may request proportionate information to verify identity and will normally respond within one month.
10. Complaints
You may lodge a complaint with the data-protection authority in your habitual residence, workplace or the place of the alleged infringement. If Marl is established in Luxembourg, the lead authority is the Commission Nationale pour la Protection des Données, 15 Boulevard du Jazz, L-4370 Belvaux, Luxembourg, info@cnpd.lu, cnpd.public.lu. If Marl is established in Belgium, use the Data Protection Authority, Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, autoriteprotectiondonnees.be. Publish only the applicable establishment block.
11. Security
Marl uses technical and organisational measures appropriate to the risk, including access control, transport encryption, data minimisation, backups, software maintenance and abuse prevention. No internet service can guarantee absolute security. If a breach creates a legally relevant risk, Marl will follow the applicable notification duties.
12. Children and automated decisions
The website is intended for businesses and adults and is not directed to children. Marl does not use the site data for decisions based solely on automated processing that produce legal or similarly significant effects.
13. Changes
This Policy may be updated when services, providers or legal requirements change. The current version and last-updated date will remain available on this page. Material changes will be highlighted where appropriate.