Privacy Policy

Summary at a glance

• This website does not use analytics, advertising, tracking pixels, social media plugins or marketing cookies.
• All fonts, images and scripts are delivered from our own domain. Your browser does not connect to Google or any other third party when you load our pages.
• The website is hosted and protected by Cloudflare. To deliver the pages securely, Cloudflare necessarily processes technical connection data such as your IP address.
• If you email us, we use your message and contact details only to reply and to handle your enquiry.
• We do not sell or rent personal data, and we do not use it for profiling or automated decisions.
• You have the rights described in sections 15 to 18 and can exercise them at any time by email.

1. Who is responsible

The controller responsible for the processing of personal data on this website within the meaning of the EU General Data Protection Regulation (GDPR) and comparable laws is:

We have not appointed a data protection officer, as we are not legally required to do so. For all questions about data protection, please contact us at the email address above.

EU and UK representative

Global Grandline LLC has no establishment in the European Union or the United Kingdom. We have not appointed a representative under Art. 27 GDPR or Art. 27 UK GDPR, because the processing described in this policy is occasional, does not include special categories of data on a large scale and is unlikely to result in a risk to the rights and freedoms of individuals (Art. 27(2)(a) GDPR). You can contact us directly at any time.

2. Scope of this policy

This policy explains how we process personal data when you visit globalgrandline.com, including its subpages, and when you contact us by email. It applies to visitors, prospective clients, business partners and anyone else who gets in touch with us.

“Personal data” means any information relating to an identified or identifiable natural person, for example a name, an email address or an IP address. “Processing” means any operation performed on such data, such as collecting, storing, using, transmitting or deleting it.

3. Visiting this website

When you open a page on this website, your browser automatically sends technical information to the server that delivers the page. This happens on every website and is necessary for the page to be displayed. The following data are processed:

• IP address of the requesting device
• date and time of the request
• address (URL) of the requested page or file
• referring page (referrer), if your browser transmits it
• browser type and version, operating system and language settings (user agent)
• amount of data transferred and the HTTP status code
• approximate location derived from the IP address (country level), used for routing and security

Purpose: to deliver the website to your device, to ensure its stability and security, and to detect and defend against attacks such as denial-of-service attempts or automated abuse.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in providing a fast, reliable and secure website. Without this data the website cannot be delivered.

Retention: this data is not stored by us. It is processed by our hosting provider Cloudflare (see section 4) and kept only for a limited period for security and operational purposes, after which it is deleted or anonymised. We do not combine this data with other sources and do not use it to identify you.

4. Hosting and content delivery (Cloudflare)

This website is hosted on Cloudflare Pages and delivered through Cloudflare’s global network. The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, United States of America.

Cloudflare acts as our processor. All requests to this website pass through Cloudflare’s servers, which deliver the pages, encrypt the connection (HTTPS) and filter malicious traffic. For this purpose Cloudflare processes the connection data listed in section 3. Requests are usually answered by the Cloudflare data centre closest to you, which may be inside or outside the European Union.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and efficient delivery of our website), together with Art. 28 GDPR, as Cloudflare processes data on our behalf under its Data Processing Addendum.

Transfers to the USA: Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, the UK Extension to it and the Swiss-U.S. Data Privacy Framework. Transfers are therefore based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR). In addition, Cloudflare’s Data Processing Addendum incorporates the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

More information: Cloudflare’s privacy policy at cloudflare.com/privacypolicy and its GDPR information at cloudflare.com/trust-hub/gdpr.

5. Cookies and similar technologies

This website does not set any cookies of its own and does not use local storage, fingerprinting or any other technology to recognise you across visits or websites. You therefore will not see a cookie banner.

In rare cases, Cloudflare’s security systems may set a strictly necessary security cookie (for example __cf_bm or cf_clearance) if a request looks automated or suspicious. These cookies only serve to distinguish people from bots and to protect the website. They contain no information used for advertising or analytics and expire after a short time (for __cf_bm, after 30 minutes of inactivity).

Legal basis: storing such cookies is strictly necessary to provide the service you request and is therefore permitted without consent under Art. 5(3) of the ePrivacy Directive (and the national laws implementing it). The related processing is based on Art. 6(1)(f) GDPR (legitimate interest in protecting the website). You can delete or block cookies in your browser settings; in that case the website may ask you to complete a security check.

6. Fonts, scripts and external content

All fonts, images, stylesheets and scripts used on this website are stored on our own domain and delivered by Cloudflare as described in section 4. We do not load content from Google Fonts, content delivery networks of other providers, social networks, video platforms or map services. No data is transmitted to such third parties when you visit our pages.

The small amount of JavaScript on this website is used only for the navigation menu, subtle visual effects and to show our email address in a way that makes it harder for spam bots to collect. It does not collect or transmit any data.

7. Contacting us by email

You can contact us by email at contact [at] globalgrandline.com. When you do, we process the data you send us, typically:

• your name and email address
• the name of your company and your position, if you provide them
• the content of your message and any attachments
• technical metadata of the email (time sent, mail servers involved)

Purpose: to answer your enquiry, to communicate with you and, where applicable, to prepare or perform a contract with you.

Legal basis: Art. 6(1)(b) GDPR if your enquiry relates to an existing contract or to steps prior to entering into a contract; otherwise Art. 6(1)(f) GDPR, based on our legitimate interest in responding to messages addressed to us.

Email delivery: emails sent to addresses at globalgrandline.com are received by Cloudflare Email Routing (Cloudflare, Inc., see section 4) and forwarded to the mailbox we use for business correspondence, which is operated by an email service provider acting as our processor. Cloudflare does not store the content of forwarded messages beyond what is necessary for delivery.

Please note: standard email is not end-to-end encrypted. Please do not send highly sensitive information (such as passwords, financial account details or health data) by email.

Retention: see section 12.

8. Clients and business partners

If you or your company become a client or business partner, we process the contact and communication data required to carry out the cooperation, including invoicing and accounting data. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (compliance with legal obligations, such as tax and accounting rules). Details are set out in our individual agreements where relevant.

9. Links to other websites

This website may contain links to external websites, for example to projects we have worked on. These websites are operated by third parties, and this privacy policy does not apply to them. No data is transferred to the linked website until you click the link. Please read the privacy policies of the websites you visit.

10. Recipients of personal data

We only share personal data where this is necessary for the purposes described above or required by law. Recipients may include:

• our hosting and network provider Cloudflare, Inc. (sections 4, 5 and 7)
• our email service provider (section 7)
• tax advisers, accountants and legal advisers, who are bound by professional confidentiality, where needed for our business
• public authorities, courts or law enforcement, where we are legally obliged to disclose data

We do not sell, rent or trade personal data, and we do not share it for advertising purposes.

11. International data transfers

Global Grandline LLC is based in the United States. If you contact us from the European Economic Area, the United Kingdom or Switzerland, your data is therefore processed in the USA. Where we receive your data directly from you, for example because you send us an email, this transfer is necessary to answer your enquiry or to perform pre-contractual steps you requested (Art. 49(1)(b) GDPR). Transfers to our service providers are based on the EU-U.S. Data Privacy Framework or on the EU Standard Contractual Clauses, as described in section 4.

Please be aware that data protection laws in the USA may differ from those in your country. We apply the protections described in this policy wherever your data is processed.

12. How long we keep data

• Connection data (section 3): not stored by us; processed by Cloudflare only for a limited period for security and operational purposes.
• Email enquiries (section 7): kept for as long as needed to handle your enquiry and any follow-up. We review our correspondence regularly and delete enquiries that did not lead to a business relationship no later than three years after the last contact.
• Business correspondence and contract records (section 8): kept for the duration of the business relationship and afterwards for as long as legal retention obligations require (for tax and accounting records, generally up to seven years).
• Data may be kept longer only where this is necessary to establish, exercise or defend legal claims.

13. Data security

We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. All connections to this website are encrypted using TLS (HTTPS), browsers are instructed to always use encrypted connections (HSTS), and the website uses strict security headers that prevent content from being loaded from unauthorised sources. The website itself has no database, no user accounts and no forms, so no personal data is stored on it.

14. No automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

Is providing data required?

You are not obliged to provide personal data. Connection data (section 3) is technically necessary to display the website. Contacting us is voluntary; without your email address and message, however, we cannot reply.

15. Your rights under the GDPR

If the GDPR (or the UK GDPR or Swiss data protection law) applies to the processing of your data, you have the following rights:

• Right of access (Art. 15 GDPR): to obtain confirmation of whether we process your data and a copy of it.
• Right to rectification (Art. 16 GDPR): to have inaccurate data corrected or incomplete data completed.
• Right to erasure (Art. 17 GDPR): to have your data deleted, unless we are legally required to keep it.
• Right to restriction of processing (Art. 18 GDPR): to have the processing of your data limited in certain cases.
• Right to data portability (Art. 20 GDPR): to receive data you provided to us in a structured, commonly used and machine-readable format, or to have it transmitted to another controller.
• Right to withdraw consent (Art. 7(3) GDPR): where processing is based on consent, to withdraw it at any time with effect for the future.

To exercise your rights, simply send us an email. We will respond within one month. We may ask you to confirm your identity before we disclose or change data.

16. Right to object

Where we process your data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you have the right to object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. We do not process your data for direct marketing.

17. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, place of work or place of the alleged infringement. In the United Kingdom, the competent authority is the Information Commissioner’s Office (ICO); in Switzerland, it is the Federal Data Protection and Information Commissioner (FDPIC). We would appreciate the chance to address your concerns first, so please feel free to contact us directly.

18. Privacy rights in the United States

We collect only the categories of personal information described in this policy: identifiers (such as IP address, name and email address), internet or network activity information (such as browser and request data) and the contents of communications you send us. We collect this information from you and your device, and use it only for the purposes described above.

We do not sell personal information and do not share it for cross-context behavioural advertising, and we have not done so in the past twelve months. We do not knowingly collect sensitive personal information as defined by U.S. state laws.

Depending on where you live (for example California, Colorado, Connecticut, Virginia or another U.S. state with a comprehensive privacy law), you may have the right to know what personal information we hold about you, to access it, to correct it and to have it deleted. While several of these laws may not apply to a business of our size, we honour such requests from all U.S. residents. Send your request to the email address in section 1; you may also use an authorised agent. We will not discriminate against you for exercising your rights.

Do Not Track and Global Privacy Control: because we do not track visitors or sell or share personal information, there is nothing to opt out of. We nevertheless treat a Global Privacy Control signal as a valid request to opt out of any sale or sharing.

This policy also serves as our privacy policy under the California Online Privacy Protection Act (CalOPPA). We will post any material changes on this page and update the date at the top.

19. Children

This website is directed at businesses and adults. It is not intended for children, and we do not knowingly collect personal data from anyone under 16 years of age (or under 13 in the United States). If you believe that a child has sent us personal data, please contact us and we will delete it.

20. Changes to this policy

We may update this privacy policy when our website, our services or the legal requirements change. The current version is always available on this page, and the date at the top shows when it was last updated. If changes significantly affect how we process data you have already provided, we will inform you where we are able to do so.

21. Contact

For any questions about this privacy policy or the processing of your personal data, please contact us at contact [at] globalgrandline.com or by post at the address in section 1.