Privacy Policy
How Convex Works handles personal data when you use our website, contact us, or book a meeting.
Summary
This policy applies when you visit convex.works, send us an enquiry, apply for a free audit, request a dataset or use our optional meeting-booking flow. Client work is governed by the relevant client agreement, not this website policy.
Cloudflare runs and protects the website and provides website metrics. c15t selects the regional privacy controls and records your choice on this device and in our self-hosted consent system. Cloudflare Zaraz stores a matching choice for future optional analytics. If you submit a form or book a meeting, we use the information you provide to respond. We do not sell personal data, run behavioural advertising or profile visitors.
Who is responsible
Convex Works is the controller for the processing described in this policy.
Nicolaas Beetsstraat 1403511HG Utrecht, Netherlands
[email protected]
Data we process and why
When you visit the website, Cloudflare receives technical request information. We use it to deliver the site, find faults and prevent spam, abuse and attacks. We process it because we have a legitimate interest in running and protecting the website.
- IP address
- Request date and time
- Requested page
- Referrer
- Browser and device
- Response information
- Security signals
Cloudflare Web Analytics gives us website usage and performance metrics. We use them because we have a legitimate interest in understanding and improving the website. It does not use analytics cookies, local storage or fingerprinting. We do not use advertising cookies. Cloudflare may set a necessary security cookie if a security feature or challenge is triggered.
- Page views
- Referrers
- Browsers
- Operating systems
- Countries
- Core Web Vitals
When the website asks our consent system to select a policy or record a choice, Cloudflare adds a country code and broad region code. We use them only to resolve the relevant privacy controls. We do not request access to your device location or receive precise coordinates.
c15t stores your privacy choice in a necessary cookie and local storage on this device. When you make or change a choice, our consent system also stores a receipt containing the choice, the time, a browser-local identifier, where the choice was made, the resolved policy, and the coarse country and region. We use these records to remember and respect your choice, based on our legitimate interest in providing reliable privacy controls.
- Consent choices
- Choice date and time
- Browser-local identifier
- Choice source
- Resolved policy
- Country and region
No IP address, user agent, browser language or precise location is stored with the receipt. These records are not sent to c15t, Inth or any external consent provider.
Choices made before 27 August 2026 remain only in the browser until you change them. If our consent system is temporarily unavailable, a new choice remains on the device and is queued to be sent when the service is available.
In the EEA, the UK, Quebec, or when the location is unavailable, optional analytics starts off and the privacy prompt is shown. In the United States it starts on without a prompt, unless your browser sends a Global Privacy Control signal. Elsewhere it starts on without a prompt. Anyone can change the choice through the footer.
Cloudflare Zaraz keeps a matching optional-analytics choice in a necessary first-party cookie. Its own consent prompt is disabled. No optional analytics tool uses the choice yet, and Cloudflare Web Analytics remains outside it. We will update this policy and ask again before connecting the first optional tool.
We use submitted details to answer enquiries, free-audit applications and dataset requests. If a request may lead to work together, we process it to take steps before a contract. For other correspondence, and for IP and country security review, we rely on our legitimate interests in answering and preventing abuse.
- Name
- Work email
- Company
- Website
- Selected services or datasets
- Message
- IP address
- Country
If you book a meeting, we use the information you enter to arrange and follow it up. We process it to take the steps you request before a possible contract and because we have a legitimate interest in managing correspondence.
- Details you enter
- Selected time
- Time zone
- Technical booking information
Required fields are marked on each form. Without them, we cannot process the request. Optional fields may be left blank, and you can browse the website without submitting a form or booking a meeting.
Services and transfers
| Privacy choices | |
|---|---|
| c15t | Selects regional privacy controls and stores choices in our self-hosted consent system. |
| Cloudflare Zaraz | Mirrors the optional-analytics choice in a first-party cookie so assigned tools can be held until allowed. |
| Website infrastructure | |
| Cloudflare | Content delivery, website security, consent-region codes and cookie-free Web Analytics. |
| Cloudflare Workers | Receives form submissions from the website server. |
| Cloudflare D1 | Stores enquiry, free-audit and dataset-request submissions. |
| Self-hosted operations | |
| Mattermost | Receives form notifications for review by our team. |
| Cal.com | Runs the optional meeting-booking flow at cal.convex.works. |
Cloudflare may process data outside the European Economic Area. Where required, its Data Processing Addendum sets out the safeguards for these transfers, including adequacy decisions and the European Commission's Standard Contractual Clauses.
Our c15t consent service, Mattermost and Cal.com are self-hosted on infrastructure managed for Convex Works by an EEA hosting provider.
How long we keep data
- 1 year The c15t cookie and local storage record on your device.
- Up to 1 year The Cloudflare Zaraz consent cookie on your device.
- 13 months Live consent receipts in our self-hosted consent system.
- Up to 12 months Enquiry and dataset-request records in D1 and Mattermost, including the associated IP address and country.
- Up to 12 months Meeting-booking records.
- 6 months Cloudflare Web Analytics dashboard availability.
- Only as needed Technical security data for website delivery, reliability and abuse investigations, subject to our providers' operational retention settings.
Encrypted consent backups expire under our existing backup rotation and are used only for recovery.
If an enquiry becomes a client engagement, information needed for that engagement is handled under the relevant agreement and applicable legal obligations.
Your rights
Depending on the circumstances, you can ask us to provide, correct, delete or restrict your personal data. You can also object when we rely on legitimate interests and, where the right applies, receive the data you provided in a portable format.
To exercise a right, email [email protected]. We may need enough information to verify your identity and locate the relevant data.
You may also lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.