Privacy Policy
The controller responsible for processing personal data on this website is astranet OÜ, Sepapaja tn 6, 15551 Tallinn, Estonia. Contact: hi@astranet.io.
Data processed
When you contact us by email or through the contact form, we process your contact details (name, email address, message, and optional information you provide, such as organization, project type, system size, deployment preference, identity provider, integrations, timeline, and procurement requirements) solely to handle the inquiry. The contact form also requires an identical repetition of the email address to check for typing errors; this confirmation is not stored as a separate inquiry field. The legal bases are Article 6(1)(b) GDPR for steps prior to entering into a contract and Article 6(1)(f) GDPR for handling other inquiries.
Contact form and storage
Inquiries submitted through the contact form are stored in this website's database (the Express form in the Concrete CMS installation). An internal notification with the inquiry is sent to the current email address of the ID 1 administrator account, and a receipt without the full message is sent to the email address provided by the person making the inquiry. Both emails are sent through the website's configured Concrete SMTP transport; the form's stored recipient address is empty. The administrators of the Concrete CMS installation and the people at AstraNET authorized to handle inquiries have access to the stored inquiries. Email delivery is not guaranteed and there is no scheduled retry for new notifications.
Spam protection (CAPTCHA)
The contact form uses a CAPTCHA to prevent automated spam submissions. It is delivered and processed locally by this website; no data is transmitted to an external CAPTCHA service.
Server logs
When the website is accessed, server logs (including the IP address, time, and requested resource) are collected to ensure proper operation. The legal basis is Article 6(1)(f) GDPR.
No tracking
This website does not use analytics or tracking services and does not set cookies for tracking purposes. Fonts are delivered locally.
Hosting and backups
The hosting provider, data location, and backup and recovery arrangements depend on the actual operating setup. No general claim of self-hosting, automatic database backup, or tested recovery is made here.
Retention
Contact inquiries are stored until their handling is complete and beyond that only where statutory retention obligations apply. How long server logs are stored, and whether they are rotated, depends on the actual hosting and operating setup; no specific retention or rotation period is confirmed here. Requests to erase personal data are assessed in light of applicable legal obligations; statutory retention duties can limit erasure.
Website refresh inquiries
For a non-binding website refresh inquiry, we process the address of your existing website or the indication that it is unavailable, the selected website variant, your name and one email address. Additional functions, free-text wishes and a telephone number are optional. The initial inquiry form does not collect company or billing address details, a VAT ID or a second email address. The name is stored without splitting it into first and last name in the existing technical name field. The provided website address is stored solely as content of the inquiry; the form does not retrieve this URL server-side.
Inquiries stored before this simplification may still contain first and last name, company, billing address and VAT ID. The form change does not delete or alter these historical entries; the same purpose-limited access and retention rules apply. Billing details required for a later order are requested separately.
The inquiry is stored as an Express entry in this website's database. The administrators of the Concrete CMS installation and the people at AstraNET authorized to handle inquiries have access to stored website refresh inquiries. The internal notification goes to the current email address of the ID 1 administrator account and the acknowledgment goes to the requesting person, both sent directly through the website's configured Concrete SMTP transport; the sender address and sender name come from the website configuration. The refresh block's stored recipient address is retained for legacy compatibility but is not used for new mail. New inquiries create no delivery outbox rows and have no scheduled mail retry; delivery is not guaranteed. Previously queued messages may still exist in the legacy outbox and can be processed by manual cutover; their nonce, Express entry and outbox relationships, delivery status, timestamps and technical message-ID seed are pseudonymous personal linkage metadata.
The form uses the CAPTCHA delivered and processed locally by this website. To limit automated inquiries, a pseudonymous HMAC rate key is generated from the normalized IP address, page and block context, and a time window using a secret key. Metadata cleanup is scheduled for rate identifiers after 24 hours and replay tombstones after 180 days; it does not send mail or retry delivery. Cleanup depends on the scheduled worker being enabled, running without errors, and operationally monitored. Errors or outages may extend actual retention until repaired; deletion within these periods is not guaranteed.
Website refresh inquiries are stored until their handling is complete and beyond that only where required for steps prior to entering into a contract or statutory retention obligations.
Your rights
You have the right of access, rectification, erasure, restriction of processing, objection to processing, and data portability. Please direct requests to hi@astranet.io.
Processing on behalf of customers
Where a project involves processing on behalf of a controller, the terms of a data processing agreement (DPA) are subject to agreement for that project.