GumRailLegal
Privacy Policy
Last updated: 29 October 2026
This policy explains how GumRail handles personal data when you visit gumrail.com or contact us. We keep it short and collect as little as we can.
Who we are
The controller of your personal data is GumRail, a sole proprietorship operating as a web studio. You can reach us about anything in this policy at [email protected].
What we collect and why
- When you email us or use the contact form. Your email address, your name, the company or website you give (optional) and whatever you write to us. The contact form sends your message by email to our own mail server, like an email you write yourself; with it we keep your IP address and the time you sent it, to stop spam and abuse (our legitimate interest, Art. 6(1)(f) GDPR). We use it to answer you and, if you ask, to prepare a proposal or carry out work for you. Messages arrive at our own mail server in the European Union and are forwarded to Gmail, where we read them. Legal basis: steps at your request before entering into a contract, and performing that contract (Art. 6(1)(b) GDPR).
- Technical logs. Like every website, our servers and our network provider receive your IP address, browser type, the page requested and the time of the request. We use this only to keep the site secure and working, for example to stop abuse and fix errors. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).
- Analytics, only if you agree. With your consent we use Google Analytics 4 to understand, in aggregate, how visitors use the site: pages viewed, time on page, device type and approximate region. We do not use it for advertising and we do not try to identify you. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
We do not sell your data, we do not use it for advertising, and we do not make automated decisions about you.
Google Analytics
Google Analytics is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acting as our processor. It is loaded through Google Tag Manager, also provided by Google, and only after you click Accept in the cookie banner; until then no Analytics code runs and no Analytics cookies are set. We use Google's Consent Mode, so analytics storage stays denied unless you accept.
Google Analytics 4 does not log or store IP addresses; Google uses them briefly to estimate a general location and then discards them. Google may process data on servers outside the European Economic Area, including in the United States. Such transfers rely on the EU-U.S. Data Privacy Framework, to which Google LLC is certified, and on the European Commission's Standard Contractual Clauses.
You can refuse analytics or change your mind at any time with the Cookie settings link at the bottom of every page. Choosing Reject stops Analytics and removes its cookies. More from Google: Google Privacy Policy, how Google uses data from sites that use its services, and the Google Analytics opt-out browser add-on.
Cookies and similar storage
| Name | Type | Purpose | Kept for |
|---|---|---|---|
gr-consent | Necessary (local storage) | Remembers whether you accepted or rejected analytics, so we don't ask on every page. | 12 months, then we ask again |
_ga | Analytics (Google, only with consent) | Distinguishes visitors with a random ID, for aggregate statistics. | 2 years |
_ga_<ID> | Analytics (Google, only with consent) | Keeps the state of your visit (session) for aggregate statistics. | 2 years |
Necessary storage does not need consent. The site uses no advertising or social media cookies; the links to our Facebook and Instagram pages are plain links, and those platforms' own policies apply once you visit them.
Who else receives data
- Our hosting provider, which runs the server in the European Union where the site and our email are hosted.
- Cloudflare, which delivers and protects the site and therefore handles technical request data such as IP addresses.
- Google, for Analytics (only if you consent) and as the email provider that receives a copy of messages sent to [email protected], because our mailbox forwards to Gmail. Any transfers outside the European Economic Area are covered by the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses, as for Analytics.
These services process data under their own terms and, where they offer them, under data processing agreements; we may also disclose data when the law requires it.
How long we keep it
- Emails: as long as needed to handle your request and any work that follows, then deleted, unless the law requires us to keep records longer (for example for tax purposes).
- Technical logs: a short period, no longer than 30 days, unless needed to investigate a security incident.
- Analytics data: 14 months in Google Analytics, then deleted automatically.
- Your cookie choice: 12 months in your browser.
Your rights
Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, to data portability, and to withdraw your consent at any time without affecting processing that happened before. To use any of these rights, email [email protected]; we reply within one month.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular the one where you live or work. Our lead authority is the Hellenic Data Protection Authority (dpa.gr).
Changes to this policy
If we change how we handle data, we will update this page and the date at the top. If a change needs your consent, we will ask for it again.