This page covers only the contact form on this site — what's collected, why, and for how long.
Secfoo (info@secfoo.com) is the controller for information submitted through this form. TODO — replace with the actual registered legal entity name and address before go-live; "Secfoo" alone is not a sufficient controller identity under GDPR Art. 13.
Name, email address, company (optional), and the message you write. A bot-protection token (Cloudflare Turnstile) and a truncated version of your IP address are processed transiently to filter spam — the truncated IP is logged, never the full address.
To respond to the enquiry you've sent us. The lawful basis is legitimate interest — responding to a message you chose to send us. Submitting this form does not add you to any mailing list; that requires a separate, unticked opt-in, which this form does not currently offer.
Your submission is sent as an email via Resend, our email delivery processor, and stored in our database so we can find and respond to it. Resend acts as our processor under a data processing agreement — TODO — confirm the DPA is actually executed before go-live (deployment-plan.md section 9). No other third party receives this data.
Stored submissions are automatically deleted 90 days after you send them — enforced by the database itself (a TTL policy), not a manual process. TODO — confirm 90 days is the intended retention period, and that the destination mailbox has a matching retention/deletion rule for the copy that arrives by email.
You can ask us to erase, correct, or send you a copy of what we hold about you by emailing info@secfoo.com. We'll respond within one month.