Privacy policy
Who is responsible
SOCIETE ALPHA QIO, trading as ALPHA Q IO, of Manzel A El Marina, 4180 Houmt Souk, Djerba, Tunisia, is the controller of the personal data described on this page. For anything to do with your data, write to legal@alphaqio.com.
Which law applies
We are a Tunisian company and we are bound by Tunisian Organic Law 2004-63 of 27 July 2004 on the protection of personal data.
Where we offer services to people in the European Union or handle data about them, Regulation (EU) 2016/679, the General Data Protection Regulation, applies as well. Where the two differ, we apply whichever gives you more protection.
What we collect, and why
When you send the contact form
We receive your name, your email address, your company if you gave one, which of the four options you chose, your website address if you asked for an audit, and your message. We use them for one purpose: to answer you. The legal basis is your consent, given by ticking the box, together with our legitimate interest in replying to an enquiry.
The form is protected by Cloudflare Turnstile, which receives your IP address and some technical signals from your browser in order to tell a person from a bot. We do not receive those signals. Your message is delivered to our inbox by Resend. It is not written to a database and it is not stored anywhere but that inbox.
When you book a call
The booking cards on our contact page load nothing until you click them. Once you click, Cal.com loads and you are on their booking page. What you enter there, your name, your email and the time you chose, goes to Cal.com and comes to us as a calendar invitation. The legal basis is the step you are taking towards a contract.
When you visit any page
Our host records a server log entry for each request: the IP address, the time, the page requested, the referring page and the browser's user agent string. These logs exist so the site can be operated and defended against attack, which is our legitimate interest. We do not use them to build a profile of you.
We measure page views with Vercel Web Analytics. It sets no cookies, uses no device fingerprint and does not follow you to other websites. It counts page views and where they came from, and nothing it records identifies you.
When you email us
We keep the correspondence so we can carry on the conversation and, where it concerns work we did, so we have a record of what was agreed.
Who processes it for us
These are the only third parties involved in running this website. Each one acts on our instructions under a data processing agreement.
- Vercel Inc. (United States)
- Hosting, content delivery, server logs and cookieless analytics.Privacy policy
- Resend (United States)
- Delivery of the contact form message and of our email generally.Privacy policy
- Cloudflare, Inc. (United States)
- Turnstile, the spam check on the contact form.Privacy policy
- Cal.com, Inc. (United States)
- Call booking, loaded only after you click a booking card.Privacy policy
Cookies
This website sets no cookies of its own. There is nothing to consent to and therefore no cookie banner.
Nothing from a third party loads until you ask for it. The Cal.com booking page loads when you click a booking card, and from that point you are on their page under their policy. Cloudflare Turnstile loads on the contact page only, because that is the only page with a form to protect.
How long we keep things
- Contact form messages. Kept in our email for 24 months from your last message, then deleted. If the enquiry becomes a project, the correspondence moves under the retention period below.
- Client records, contracts and invoices. Kept for 10 years from the end of the financial year, which is the retention period Tunisian commercial and tax law requires.
- Server logs. Kept by our host for up to 30 days.
- Analytics. Aggregated counts only, with nothing that identifies a visitor, retained by Vercel for up to 12 months.
- Bookings. Kept in our calendar and in Cal.com until the call has happened and any follow-up is finished.
Your rights
Under both frameworks you can ask us to:
- tell you what data about you we hold, and give you a copy of it
- correct anything that is wrong
- delete it, where we are not required to keep it
- restrict what we do with it while a question about it is open
- hand it to you, or to someone else, in a portable format
- stop processing it where we rely on a legitimate interest
- withdraw a consent you gave, with no effect on what came before
Write to legal@alphaqio.com. We answer within 30 days. We will ask you to confirm who you are before we hand over data, and we do not charge for this.
If you are not satisfied with how we handled it, you can complain to the Tunisian Instance Nationale de Protection des Données Personnelles, and if you are in the European Union, to the supervisory authority where you live or work.
Data leaving Tunisia and the European Union
Every processor listed above is established in the United States, so data that passes through this website leaves both Tunisia and the European Economic Area. Each transfer is covered by the European Commission's Standard Contractual Clauses in our agreement with that processor.
Transfers out of Tunisia are made in line with Organic Law 2004-63, including the authorisation requirements that apply to us as a Tunisian controller.
Processing data for our clients
When we host or maintain a client's website, the visitors to that site are the client's data subjects, not ours. In that arrangement the client is the controller and SOCIETE ALPHA QIO is a processor. We act on the client's documented instructions and we do not use their visitors' data for anything of our own.
A Data Processing Agreement is available to any client on request. It includes the European Commission's Standard Contractual Clauses, a list of the sub-processors we use, the security measures we apply, and what happens to the data when the contract ends. Ask for it at legal@alphaqio.com.
We tell clients in advance if we intend to add or change a sub-processor, so there is time to object.
Keeping it safe
The site is served over HTTPS. Access to client systems is limited to the people who need it and protected by two-factor authentication where the platform offers it. We ask clients for accounts of our own rather than shared passwords, so access can be withdrawn cleanly when work ends.
Children
This website is aimed at businesses. We do not knowingly collect data about anyone under 16. If you believe we have, write to us and we will delete it.
Changes to this policy
When this policy changes, the date in the left column changes with it. Material changes affecting existing clients are sent to them by email rather than left here to be discovered.