This notice applies to mabeyn.com, the corporate site of Mabeyn LLC. It explains what personal data the site collects, why, who else is involved in handling it, and how long it is kept.
The controller is Mabeyn LLC, 117 S Lexington St, Ste 100, Harrisonville, MO 64701, United States. Write to [email protected] about anything on this page.
What this site collects
The site has two forms. When you submit the contact form we record:
- your name and email address, because we cannot reply without them;
- what the message is about and the message itself;
- your organisation, only if you choose to give it — the field is optional;
- that you confirmed you had read this notice.
When you send an open application from the careers page we record:
- your name, email address, the area you are interested in and what you tell us about yourself;
- a link to your profile or portfolio and where you are based, only if you choose to give them.
With either form we also record your IP address, your browser user-agent string and the date and time of the submission, so that abuse of the forms can be identified.
That is the whole list. The site has no analytics, no advertising, no tracking pixels, no social media buttons, no chat widget and no embedded third-party content; even the typeface is served from our own server. We do not profile visitors and no automated decision is made about anyone.
Why we are allowed to hold it
You write to us on your own initiative and we use what you send to answer you. Under the GDPR this is our legitimate interest in responding to an enquiry addressed to us and, where your message concerns a possible contract or employment or a partnership, the steps taken at your request before entering into one. The technical data rests on our legitimate interest in keeping the forms from being abused.
Giving us this data is voluntary. The consequence of not giving it is simply that we cannot reply; you are free to email us instead.
Cookies
This site sets one cookie, named mabeyn_site. It holds nothing but a random session identifier, which lets us check that a submitted form came from the page we served and that the same visitor is not submitting it in a loop.
It is a session cookie: your browser discards it when you close it. It is marked HttpOnly, Secure and SameSite=Lax. It is strictly necessary for the forms to work, which is why you are not asked to consent to it, and it is set only on pages that carry a form. There are no other cookies and no local storage is used.
Who else handles the data
We keep the number of parties involved as small as we can. Each acts on our behalf and is not permitted to use your data for its own purposes:
- Cloudflare, Inc. — every request to this site passes through Cloudflare’s network before it reaches our server. Cloudflare therefore processes your IP address and request metadata in order to serve the page, to terminate the TLS connection and to filter attacks. It acts as our processor.
- Our hosting provider — operates, in a data centre, the server that runs this site and stores form submissions.
- Our email provider — hosts our mailboxes, so messages you send to any of our addresses pass through and are stored with it.
Cloudflare is a US company and the company itself is US-registered, so data reaches the United States. Transfers out of the EEA and the UK are covered by standard contractual clauses and, for the US, by the EU–US Data Privacy Framework where the recipient participates in it.
Nothing is sold, rented or shared for advertising. We disclose data beyond the above only where a law or a valid order from a competent authority requires it.
Where it is stored, and for how long
Submissions are written to a file on our own server, outside the area the web server can serve, so no request can retrieve them. There is no online panel or third-party form service; access is limited to the people who answer enquiries.
We keep a message for as long as it is live and then for up to 24 months, so that we can pick up a thread that resumes later. Open applications are kept for up to 24 months so that we can consider you for roles that open later, unless you ask us to delete yours sooner. After that they are deleted. Where a message turns into a contract or an invoice, the records that document it are kept for the period the applicable tax and commercial law requires, which is longer.
Server and Cloudflare logs are kept separately, for up to 14 days, for security and fault-finding.
Your rights
Depending on where you live — including under the GDPR, the UK GDPR and US state privacy laws — you have some or all of the following rights over the data we hold about you: to access it, to have it corrected, to have it deleted, to restrict or object to our use of it, and to receive it in a portable form. Where our basis is legitimate interest, you may object at any time and we will stop unless we have an overriding reason not to.
Email [email protected] and we will answer within one month. We may ask you something that lets us match your request to the right message — usually the address you wrote from — so that we do not hand your data to someone else. There is no charge.
We do not sell or share personal data, so there is nothing to opt out of; a Global Privacy Control signal from your browser is honoured all the same. Where your state’s law gives you a right to appeal our decision on a request, reply to our answer and a different person will review it.
If you are not satisfied with our answer, you may complain to the data protection authority where you live.
Children
This site is for adults. It is not directed at children and we do not knowingly collect data from anyone under 16. If such data reaches us through a form, tell us and we will delete it.
Security
The site is served only over HTTPS, with HSTS set. Credentials for our systems are held outside application code. The stored submissions sit outside the web root. No method of transmission or storage is perfectly secure, so please do not send us passwords, card numbers or identity documents through the forms.
Changes
If what we do changes, this page changes with it and the date at the top is updated. Material changes affecting data we already hold will be communicated to the people concerned where we are able to reach them.