Privacy Policy

This Privacy Policy explains how MEDIASERVERE LTD (Company #16540150, "we", "us", "MediaServere") collects, uses and protects personal data you provide through mediaservere.com.

1. Data controller

MEDIASERVERE LTD, registered in England & Wales (Company #16540150), London, United Kingdom. Email: support@mediaservere.com.

2. What we collect

• Contact form data: name (optional), email, WhatsApp (optional), subject, message, preferred contact method.
• Order form data: all of the above plus website URL, project details, selected service.
• Technical metadata: IP address, browser user-agent, timestamp — stored only for security (rate limiting, fraud detection).
• Cookies: a session cookie (PHPSESSID) for CSRF protection. Optional analytics cookies only after consent.

3. How we use it

• To reply to your enquiry or fulfil your order.
• To send a project plan, invoice or service deliverable.
• To prevent spam and abuse (rate limiting, deduplication).
• To comply with legal/accounting obligations.

We do not: sell your data, share it with marketing partners, use it for retargeting ads, or include it in any third-party profile.

4. Legal basis (GDPR Art. 6)

• Contract performance for order processing and delivery.
• Legitimate interest for security logs and replying to enquiries.
• Consent for optional cookies and the newsletter (revocable any time).
• Legal obligation for tax/accounting records.

5. Retention

• Contact form submissions: 90 days, then auto-deleted.
• Order records: 90 days from order completion (longer if required by tax law).
• Security logs: 30 days.
• Invoices & accounting: 6 years (UK statutory requirement).

6. Your rights

Under GDPR you have the right to: access, rectification, erasure, restriction, data portability, and to object to processing. Email support@mediaservere.com to exercise any of these. We reply within 30 days.

You also have the right to complain to your local data protection authority (UK: ICO).

7. Data location & transfers

Personal data is stored on servers located in the European Union. We use Telegram (Cloud-API, encrypted in transit) to receive submission notifications — the message body contains the data you submitted. No transfers to third countries without GDPR-compliant safeguards.

8. Security

HTTPS everywhere (HSTS preload), CSRF protection on every form, two-tier rate limiting, content-security headers, dual-timing bot detection. Submissions are stored in private directories with file-level access controls.

9. Changes

We'll post any policy changes on this page with an updated "Last updated" date. Material changes will be highlighted at the top.