Privacy Policy
How Convex Works handles personal data when you use our website, contact us, or book a meeting.
Summary
This policy covers convex.works, our enquiry forms, dataset requests and optional meeting-booking flow. Client work is covered by the relevant client agreement.
We use personal data only to run and protect the website, understand how it performs, remember privacy choices and respond to requests. We do not sell personal data, run behavioural advertising, profile visitors or make automated decisions about them.
Who is responsible
Convex Works is responsible for the processing described here.
Athens, Greece[email protected]
What we process
Cloudflare receives technical request information when you visit the website. We use it to deliver the site, measure its performance and prevent faults, spam and attacks. This is based on our legitimate interest in running a reliable website.
- IP address
- Request details
- Page and referrer
- Browser and device
- Performance metrics
- Country and region
Cloudflare Web Analytics provides page and performance metrics without analytics cookies, local storage or fingerprinting. Cloudflare may use a necessary security cookie if a security check is triggered.
Cloudflare also provides a coarse country and region code so our consent system can select the appropriate privacy controls. We do not request precise device location. The system records the choice on the device and, when a choice is made or changed, in our self-hosted consent service.
- Privacy choice
- Choice time
- Browser identifier
- Resolved policy
Consent receipts do not contain the IP address, user agent, browser language or precise location. If the service is temporarily unavailable, the choice remains on the device and is queued for delivery.
PostHog provides optional website measurement in its EU-hosted project. Our consent system controls when its browser software loads through our own domain. It measures page visits, clicks and form interactions using a random browser identifier, which lets us recognise returning visits without knowing who you are. Where permission is required, it remains off until you allow it. Elsewhere, you can turn it off in Privacy choices. In the United States, Global Privacy Control keeps it off.
- Page URL and title
- Referring URL
- Campaign attribution
- Clicks and form interactions
- Browser, device and language
- Visit time
- Browser and session identifiers
We remove URL query strings and fragments while keeping campaign attribution fields. We retain readable interaction labels and normal browser and device information, but not form contents or consent-record identifiers. We do not use IP-based location, identify visitors, create person profiles or record session replays. Our proxy removes visitor-IP forwarding headers and PostHog is configured to discard client IP data. Cloudflare Web Analytics remains separate from this choice.
When you contact us, request a dataset or book a meeting, we use the information you provide to respond and arrange the requested next step. This is necessary to take steps at your request before a possible contract. We use IP address and country only for abuse and security review.
- Contact details
- Company and website
- Message or selections
- Booking details
- IP address and country
Required fields are needed to process the request. Optional fields may be left blank, and you can browse without submitting anything.
Who supports the website
| External provider | |
|---|---|
| Cloudflare | Website delivery, security, coarse location and cookieless Web Analytics. |
| Cloudflare Workers | Handles website form submissions and proxies allowed PostHog measurement through our domain. |
| Cloudflare D1 | Stores website form submissions. |
| PostHog | EU-hosted website measurement controlled by privacy choices. |
Cloudflare may process data outside the European Economic Area. Its Data Processing Addendum includes the safeguards used for those transfers.
Our hosting and email providers process data only as needed to operate these services.
How long we keep data
- While allowed PostHog's random browser identifier is stored in local storage and a host-only cookie with a one-year expiry. It is cleared when optional analytics is turned off or an expired choice is detected, or when you clear site storage.
- 1 year Privacy choices on the device.
- 13 months Consent receipts.
- Up to 12 months Enquiries, dataset requests and booking records.
- 6 months Cloudflare Web Analytics dashboard data.
- Only as needed Security data for delivery or an abuse investigation.
Pseudonymous measurement data is stored in our PostHog EU project according to its event-retention setting. Removing the browser identifier does not delete events already received.
Encrypted backups expire under our backup rotation and are used only for recovery. If a request becomes a client engagement, information needed for that work is handled under the relevant agreement and legal obligations.
Your rights
Depending on the circumstances, you can ask us to access, correct, delete, restrict or provide your personal data, or object to our use of it. Email [email protected]. We may need enough information to verify your identity and find the relevant data.
You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens.