Privacy policy

Who is responsible

The data controller is Mark Finlay, Ireland, operating Passing Places. Questions and requests about your data can be sent through the contact page.

What we collect, and why

• Contact messages. If you write to us, we keep the name, email address and message you typed, to read and reply to it. Nothing else is recorded with it. Messages are kept for up to twelve months after the exchange ends, then deleted.
• Accounts. The research instance is by invitation. For an account we keep the email address and name given, a hashed password, and the times and network addresses of sign-ins, to secure the account. Accounts are removed when access ends.
• Server logs. Like any website, the server records requests, including the network address and browser making them, for security and to keep the site running. Logs are kept briefly and are not used to profile anyone.

Our lawful basis is our legitimate interest in running the project and answering the people who write to it, and, for accounts, the agreement under which access is given. We do not use the data for marketing and we do not sell or share it, except with the providers below who process it on our behalf.

Cookies

Every page sets one session cookie. It protects the site's forms against forgery and, after sign-in, keeps you signed in; it holds no identifier that outlives your browser session and is not used to track you. A longer "remember me" cookie is set only if you ask for it at sign-in. Both are needed for the site to work, so no consent banner is shown. There is no advertising and no analytics tracking.

Providers

• Hetzner Online GmbH hosts the site in Helsinki, Finland, within the European Union.
• Google Fonts serves the site's typefaces. Your browser requests them from Google's servers, which may be outside the EU, and Google may see your network address in doing so; we intend to serve the fonts ourselves in a future release.
• OpenStreetMap serves the map tiles on the example journey pages. Your browser fetches them from the OpenStreetMap Foundation's servers, which see your network address in doing so; no other page loads them.
• Let's Encrypt issues the site's certificate; it handles no personal data of yours.

Your rights

Under the General Data Protection Regulation you may ask what we hold about you, have it corrected or deleted, object to our processing, or take your data elsewhere. Write to us through the contact page and we will answer within a month. You may also complain to the Data Protection Commission in Ireland.

Changes

We will update this page if what we collect changes; the date above shows the current version.