Website Privacy Notice

01

About this notice

This privacy notice explains how Runtime Labs handles personal information when you:

• visit runtime-labs.org;
• contact us by email or telephone; or
• make a business or service-related enquiry.

The website is a small, self-hosted informational website. It does not provide user accounts, online purchasing, comments, newsletters, or server-submitted contact forms, and Runtime Labs does not use it to build profiles of visitors.

Although Runtime Labs does not deliberately collect personal information from ordinary website browsing, limited technical information is necessarily processed by Cloudflare when a device connects to the website. We also process information that a person chooses to provide when contacting us.

This notice is intended to comply with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and, where applicable, the EU General Data Protection Regulation (“EU GDPR”).

02

Who is responsible for your information?

Runtime Labs and Runtime Laboratories are trading names used by Marcus F Tipler, who is the data controller for the purposes described in this notice.

Please use “Privacy request” as the subject of an email concerning your personal information.

Runtime Labs has not appointed a data protection officer because its limited processing activities do not require one.

03

Information processed when you visit the website

The website does not have server-submitted contact forms, user accounts, advertising, payment processing, newsletter sign-up, or a customer database.

However, when you visit any website, your browser must send technical information so that the requested page can be delivered. Because runtime-labs.org uses Cloudflare, Cloudflare may process information including:

• your Internet Protocol address;
• the date and time of the request;
• the requested page or resource;
• the referring website, if supplied by your browser;
• browser, device and operating-system information;
• approximate location derived from an IP address;
• request status, routing and performance information; and
• information used to identify malicious, automated or abusive traffic.

This processing is necessary to route traffic, provide the website, maintain availability, prevent attacks, diagnose technical problems and protect the self-hosted origin server.

The origin server is reached through an encrypted Cloudflare Tunnel and is not intended to be exposed directly to the public internet.

Runtime Labs does not use this technical information to identify ordinary visitors, create visitor profiles or advertise to them.

Origin-server logging: The self-hosted origin may retain limited security or diagnostic logs for no longer than 30 days, unless a longer period is necessary to investigate an active security incident.

04

Cloudflare Web Analytics

Runtime Labs uses Cloudflare Web Analytics to understand basic, aggregated information about website use and performance, such as:

• page views and visits;
• popular pages;
• referring websites;
• broad browser or device categories; and
• website loading and performance measurements.

According to Cloudflare, its Web Analytics product does not collect or use visitors' personal data. It does not use cookies or local storage for analytics and does not fingerprint visitors using IP addresses, user-agent strings or similar identifiers.

Runtime Labs uses these aggregated statistics only to understand whether the website is working properly and which public pages are useful. We do not combine them with contact information or use them to track individuals.

More information is available in the Cloudflare Web Analytics documentation.

05

Cookies and similar technologies

Runtime Labs does not place its own cookies and does not use advertising, behavioural tracking, social-media tracking pixels or cross-site profiling.

Cloudflare Web Analytics does not use cookies, local storage or visitor fingerprinting for analytics.

Cloudflare's security systems may set a short-lived, strictly necessary cookie if a security check or challenge is required to protect the website. Such a cookie is used only for security and delivery of the service, not advertising or behavioural analytics.

If you use the interface-sound control, the website stores a small on/off preference in your browser's local storage. This allows the website to remember your sound choice between pages and future visits. The preference remains on your device, does not identify you, and is not used for analytics, advertising or behavioural tracking.

Aside from this user-selected functional preference, no non-essential cookies or equivalent storage technologies are intended to be used. The website therefore does not ordinarily require a cookie-consent banner. You can remove the sound preference by clearing the website's stored data in your browser. This position will be reviewed if the website's features or Cloudflare configuration change.

06

Information processed when you contact us

If you contact Runtime Labs by email or telephone, we may receive:

• your name;
• your email address or telephone number;
• your organisation and role;
• the contents of your message;
• attachments or other information you choose to provide;
• basic email-routing information;
• call date, time and duration information;
• voicemail messages; and
• records of our response and subsequent correspondence.

You are not legally required to provide this information. However, we may be unable to answer an enquiry or discuss requested services without sufficient contact information.

Please do not send passwords, private encryption keys, unnecessary identity documents, highly sensitive information or special-category personal data unless we have specifically agreed on an appropriate secure method.

07

How and why we use personal information

We process personal information only where we have a lawful basis.

Where we rely on legitimate interests, we consider whether the processing is necessary and whether those interests are outweighed by your rights. The limited and privacy-focused nature of the website reduces the effect on visitors.

Runtime Labs does not use personal information for automated decision-making or profiling.

08

Email and telephone service providers

Runtime Labs uses Proton Mail, operated by Proton AG, to host and protect its email mailboxes. Email sent from a non-Proton service may not be end-to-end encrypted, although it is normally protected in transit using standard transport encryption where supported.

Proton may process message content, sender and recipient addresses, delivery information and anti-spam or security information to provide its service. Information about Proton's practices is available in the Proton Mail privacy policy.

Cloudflare provides DNS services for the runtime-labs.org domain. If Cloudflare Email Routing is enabled for an address, relevant addressing and routing information, and the message while it is being forwarded, may pass through Cloudflare before reaching the Proton mailbox.

Telephone calls and text messages may also be processed by the relevant telecommunications providers.

09

Who we share information with

Personal information may be disclosed only where reasonably necessary to:

• Cloudflare, for DNS, network delivery, security, analytics and, if enabled, email routing;
• Proton AG, for email hosting and security;
• telecommunications providers, for calls and messages;
• trusted IT, security, legal, accounting or professional advisers where necessary;
• public authorities, courts, regulators or law-enforcement bodies where disclosure is legally required; or
• another party where necessary to establish, exercise or defend legal rights.

Service providers are permitted to process information only for the relevant service or as otherwise allowed by law.

Runtime Labs does not sell or rent personal information. It does not share visitor information with advertisers or data brokers.

10

International processing

Cloudflare operates a global network, so limited request and security information may be processed outside the United Kingdom, including in the United States and other countries where Cloudflare operates.

Cloudflare's Data Processing Addendum provides for recognised safeguards, including adequacy arrangements, the EU Standard Contractual Clauses and the UK International Data Transfer Addendum where required. More information is available in the Cloudflare Data Processing Addendum and Cloudflare Privacy Policy.

Proton AG is based in Switzerland and operates Proton Mail infrastructure in Switzerland, Germany and Norway. Where an international transfer requires additional protection, Proton states that it uses applicable adequacy arrangements or approved contractual safeguards. See the Proton Data Processing Agreement.

11

How long information is kept

Runtime Labs aims to keep personal information only for as long as reasonably necessary.

Unless a longer period is required for an ongoing matter or by law:

• routine enquiries that do not lead to a business relationship are normally deleted within 12 months after the enquiry is closed;
• call records and voicemail messages are normally deleted within 90 days, unless retained as part of relevant business correspondence;
• security and diagnostic logs retained by Runtime Labs, if enabled, are normally deleted within 30 days;
• correspondence and records connected with a contract, payment, tax obligation or legal claim may be kept for up to six years after the relevant relationship ends; and
• information subject to a dispute, investigation or legal requirement may be retained until the matter has been resolved and any applicable limitation period has expired.

Cloudflare's aggregated Web Analytics information is not used to maintain identifiable visitor histories. Information held by service providers is also subject to their technical retention cycles, contractual terms, backup procedures and legal obligations.

12

Security

Runtime Labs uses proportionate technical and organisational safeguards, including:

• encrypted HTTPS connections;
• an encrypted Cloudflare Tunnel between Cloudflare and the self-hosted origin;
• restricted administrative access;
• appropriate authentication and account-security controls;
• system and software updates;
• Cloudflare network and security protections; and
• encrypted email storage provided by Proton.

No internet transmission or storage system can be guaranteed to be completely secure. If we become aware of a personal-data breach, we will assess it and notify affected individuals and the relevant regulator where required by law.

13

Your data-protection rights

Depending on the circumstances, you may have the right to:

• request confirmation of whether we hold personal information about you;
• obtain a copy of your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to delete information;
• ask us to restrict how information is used;
• object to processing based on legitimate interests;
• receive certain information in a portable format;
• withdraw consent where processing is based on consent; and
• complain to a data-protection regulator.

These rights are not absolute, and exemptions may apply. We will normally respond to a valid request within one month, although the law allows additional time in certain circumstances.

To exercise a right, contact marcus@runtime-labs.org with the subject “Privacy request”. We may ask for information reasonably necessary to confirm your identity.

We would appreciate the opportunity to address your concern first, but you are not required to contact us before approaching the ICO.

If the EU GDPR applies, you may also complain to the supervisory authority in the EU or EEA country where you live, work or believe an infringement occurred.

14

External websites

The website may contain links to third-party websites. Runtime Labs is not responsible for how those websites process personal information. Their own privacy notices apply when you leave runtime-labs.org.

15

Children

The website is a general business and technical information website and is not directed at children. Runtime Labs does not knowingly use the website to collect personal information from children.

16

Changes to this notice

We may update this notice if the website, its service providers or applicable law changes. The revised version will be published on this page with a new “Last updated” date. Material new uses of personal information will be brought to affected individuals' attention where required.