Controller and scope
Bradley Dykens, in Belgium, is the controller for the processing described here for the showcase websites Sparkling Hammer and Play Furry Foundry. Contact and requests concerning your data: sparklinghammer@gmail.com.
This notice covers the websites and their contact correspondence, without covering an application or game. The presentation pages and published legal documents offer no forms, registration or purchases. No audience analytics tool, advertising profile, AdSense ad-serving script or third-party player is active on them.
Data and purposes
Visiting the websites sends technical information to the server, including the IP address, date and time, request, its outcome and information useful for diagnostics. This information is used to deliver the pages, keep them working and protect the websites against errors and abuse. This processing is based on the legitimate interest in maintaining accessible and secure showcase websites, with collection and retention limited to these purposes.
If you write to the contact address, I process your email address, any name you provide, the message and its attachments to respond and follow up on the correspondence, based on the legitimate interest in handling your request. Sending a message does not authorise marketing. Provide only what is useful; without a way to reply or sufficient details, I will not be able to give a useful response. Do not send unnecessary sensitive data or data about other people.
Handling requests to exercise your rights fulfils GDPR obligations. A minimal record of their handling is kept to demonstrate the response given. None of the processing described here produces a legal or similarly significant decision based solely on automated decision-making.
Retention
- Ordinary access logs: 14 days after creation; application and diagnostic logs: 30 days after creation.
- Routine backups: 30 days after creation; exceptional maintenance copies: 90 days after creation.
- Ordinary messages and useful attachments: 12 months after the last relevant exchange. If correspondence concerns a possible collaboration or request for a quotation, without implying any current commercial activity, useful material is retained for 12 months after closure, or after the last relevant exchange if follow-up remains open. Sorting and deletion are managed manually; no automatic Gmail purge is claimed.
- Security incident file: during its handling, then for 12 months after closure for material useful for follow-up and preventing recurrence.
- Data-related requests: during their handling, then for 24 months after closure for a minimal record of the request, decision and response. Identity documents that are no longer needed are not part of this record.
The expiry of logs and backups on the server is checked hourly: a normal processing delay of about one hour and one minute may be added to these periods. Local backup copies are handled when the computer is available. Backup expiry is suspended if a replacement copy that has recently been restored and verified is unavailable; this recovery exception must be resolved and reviewed. Backups are stored on the VPS and the publisher’s computer, with restricted access.
Unnecessary data is removed earlier. If a specific incident, applicable obligation or defence of rights justifies further retention, only the necessary material is isolated, with a reason and a review. Deleted data disappears from backups when their retention cycle expires; a restoration must reapply the necessary deletions.
Access, service providers and transfers
Data is accessible to the publisher for the stated purposes and to the technical providers involved in hosting and email. It may also be disclosed where a legal obligation requires it.
Hosting: OVH SAS (OVHcloud), 2 rue Kellermann, 59100 Roubaix, France, provides the VPS located in Beauharnois, Canada. Its public data processing agreement, section 6 describes locations, remote access and the use of standard contractual clauses 2021/914 for certain transfers to countries without an adequacy decision. The adequacy recognised for Canada concerns commercial organisations within its scope; it does not exempt every transfer from verification. OVHcloud also publishes its sub-processors and their countries. You can request details and a copy of the safeguards using the contact address at the top of this notice. The contractual version specific to this service and all support access have not been audited.
Email: messages are received in a personal Gmail account. The Google Privacy Policy identifies Google Ireland Limited for users in the European Economic Area. Google describes international processing, including in the United States, and the mechanisms it uses: adequacy decisions, the EU–US framework for Google LLC and its covered subsidiaries, or standard contractual clauses where necessary. See its information on transfers and obtaining these clauses. No Google Workspace contract is claimed.
Cookies and external services
Simply reading the presentation pages and published legal documents anonymously creates no cookies or local storage for presence, translation or synchronisation. Native technical flows, including login and certain error pages such as a non-existent document version, may open an anonymous session with cookies that expire in the browser after 24 hours. Server-side session data follows separate native cleanup with a seven-day threshold. Administration retains its native components and storage; their details and ways to clear them are explained in the cookie information.
External links, including YouTube and GitHub, do not load a player or resources from these services before you click. When you follow them, their own rules apply. Before any future advertising or other processing requiring consent, this information and the mechanisms for choosing, refusing and withdrawing consent will need to be adapted.
Your rights
Subject to the conditions of the GDPR, you may request access to, rectification or erasure of your data, or restriction of processing. You may object to processing based on legitimate interests on grounds relating to your particular situation. Data portability and withdrawal of consent apply where their conditions are met.
Write to the contact address above with the details needed to locate your data. An identity document is not routinely requested: only necessary information may be requested in the event of reasonable doubt. A response is normally provided within one month; a justified extension may apply under the legal conditions. You may complain to the competent authority, including the Belgian Data Protection Authority, or the authority of your habitual residence, place of work or the place of the alleged infringement.