Privacy Notice

Last updated: 6 August 2026

This notice explains what personal data is processed when you use the CYCLE website, why, where it is stored, and the rights you have over it. It is written to meet the requirements of the EU/UK General Data Protection Regulation (GDPR) and to reflect good practice everywhere else.

1. Who is responsible (data controller)

For any privacy question or request, email us at the address above with the subject line “Privacy request”.

2. What we collect — and what we don't

This website is deliberately minimal:

• No cookies. The site sets no cookies of any kind — so no cookie banner is needed.
• No analytics or trackers. We run no visitor analytics, no advertising pixels, and no social media embeds.
• No third-party fonts or scripts. All fonts and code are served from this site itself; visiting a page sends no request to Google or any other third party.

The only personal data we collect is what you choose to send us through the contact form: your name, your email address, and your message.

3. Why we process it (purpose and legal basis)

We process contact form data for one purpose only: to read and respond to your enquiry. The legal basis is your consent (GDPR Art. 6(1)(a)), which you give by ticking the consent box before sending. The form cannot be submitted without it — and our database refuses any record where consent is not recorded.

You may withdraw your consent at any time by emailing us; we will then delete your message (see Section 6).

4. Where it is stored (processors and transfers)

• Form submissions are stored in a database operated by Supabase, hosted on AWS in São Paulo, Brazil (region sa-east-1). Supabase processes this data on our behalf under its data processing terms, which incorporate EU Standard Contractual Clauses for international transfers.
• Website hosting is provided by Vercel Inc. Like any web host, Vercel may log the IP address of visitors briefly for security and delivery purposes; CYCLE does not access or use these logs. This logging is processed on the basis of legitimate interests (GDPR Art. 6(1)(f)) in keeping the site secure and available. It involves a transfer to Vercel Inc. in the United States, safeguarded by Vercel's Data Processing Agreement incorporating EU Standard Contractual Clauses.

5. Who can see it

Only the CYCLE core team can read contact form submissions. The public website itself cannot read the database — it is technically permitted only to write your message, never to read anything back. We never sell, rent, or share your data with third parties for marketing.

6. How long we keep it

Contact messages are kept only as long as needed to handle your enquiry and any follow-up, and are deleted no later than 24 months after the conversation ends — or immediately upon your request.

7. Your rights

Under the GDPR (and equivalent laws), you have the right to:

• access a copy of the data we hold about you;
• have inaccurate data corrected;
• have your data erased (“right to be forgotten”);
• restrict or object to processing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
• lodge a complaint with a supervisory authority — if you are in the EU/EEA or UK, this is your national data protection authority.

To exercise any of these rights, email cyclegyinitiative@gmail.com. We respond within one month.

8. Children

This website is aimed at partners, funders, and the general public, and does not knowingly collect data from children. If you believe a child has submitted personal data through the form, contact us and we will delete it.

9. Changes to this notice

If our data practices change, we will update this page and its “last updated” date. Since we collect so little, changes should be rare.

← Back to the deck