Privacy Policy

1. Data Controller

The data controller responsible for the processing of your personal data on this website is:

If you have any questions about this Privacy Policy or about how we process your data, please contact us using the details above or through the Contact page.

2. Data We Collect

2.1 Data you provide directly

When you submit the contact form on this website, we collect the following data:

• Full name — to address you correctly in our reply.
• Email address — to respond to your enquiry.
• Message content — to understand and respond to your request.
• GDPR consent record — the fact that you agreed to data processing at the time of submission, including a timestamp.

2.2 Data collected automatically

When you visit this website, certain technical data may be collected automatically by web server software or analytics tools, including:

• IP address (typically anonymised)
• Browser type and version
• Operating system
• Referring URL
• Pages visited and time spent on each page
• Date and time of access

This data is used for statistical analysis and to ensure the technical operation of the site. It is not used to identify individual visitors unless required for security purposes.

2.3 Cookies

This website uses cookies. Please see our Cookie Policy for a full description of the cookies used, their purposes, and how to manage your preferences.

3. Purposes and Legal Bases for Processing

We process your personal data only where we have a valid legal basis to do so under the General Data Protection Regulation (GDPR) and other applicable law.

Purpose	Data Used	Legal Basis
Responding to contact form enquiries	Name, email, message	Consent (Art. 6(1)(a) GDPR)
Maintaining records of consent	Consent record and timestamp	Legal obligation (Art. 6(1)(c) GDPR)
Website security and fraud prevention	IP address, access logs	Legitimate interests (Art. 6(1)(f) GDPR)
Analytics and site improvement (if consented)	Anonymised usage data	Consent (Art. 6(1)(a) GDPR)

4. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law.

• Contact form submissions: Retained for a maximum of 24 months from the date of receipt, or until you request deletion, whichever is earlier.
• Consent records: Retained for 3 years to comply with our legal accountability obligations.
• Server access logs: Retained for up to 90 days for security and operational purposes, then automatically deleted.
• Analytics data: Retained in anonymised, aggregated form indefinitely; individual session data (where collected) is retained for up to 26 months.

5. Data Sharing and Transfers

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

We may share your data with the following categories of recipients where necessary:

• Hosting and infrastructure providers: The server on which this website is hosted may process data as part of normal operations. Such providers are bound by data processing agreements.
• Analytics providers: If you have consented to analytics cookies, usage data may be shared with analytics service providers in anonymised form.
• Law enforcement or regulatory authorities: We may disclose data where required by law, court order, or regulatory requirement.

Where data is transferred to recipients outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission or equivalent mechanisms.

6. Your Rights Under GDPR (EEA, Switzerland & UK)

If you are located in the European Economic Area, Switzerland, or the United Kingdom, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): You may request a copy of the personal data we hold about you.
• Right to rectification (Art. 16 GDPR): You may ask us to correct inaccurate or incomplete data.
• Right to erasure (Art. 17 GDPR): You may request deletion of your personal data where there is no overriding legitimate reason for us to retain it.
• Right to restriction of processing (Art. 18 GDPR): You may ask us to restrict processing in certain circumstances.
• Right to data portability (Art. 20 GDPR): Where processing is based on consent or contract, you may request a copy of your data in a structured, machine-readable format.
• Right to object (Art. 21 GDPR): You may object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3) GDPR): Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at admin@draxylonez.world. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority. In the EU, you can find your authority at edpb.europa.eu.

6A. Your Rights Under US Law (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with the following rights regarding your personal information:

• Right to Know: You may request information about the categories and specific pieces of personal data we have collected about you, the sources, the business purposes, and the third parties with whom it is shared.
• Right to Delete: You may request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information we hold about you.
• Right to Opt-Out of Sale or Sharing: We do not sell or share personal information for cross-context behavioral advertising. No opt-out action is required.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise your California privacy rights, please contact us at admin@draxylonez.world or use our Contact page. We will respond within 45 days as required by California law.

Residents of other US states with applicable privacy laws (including Virginia, Colorado, Connecticut, and Texas) may have similar rights. Please contact us to make a request and we will respond in accordance with applicable law.

7. Security Measures

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

• Transport Layer Security (TLS/HTTPS) encryption for all data transmitted to and from this website.
• Access controls limiting who within our organisation can access personal data.
• Regular review of data handling procedures.
• Secure storage with access logging for hosted data.

No method of transmission or storage is entirely secure. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours as required by Art. 33 GDPR, and affected individuals as required by Art. 34 GDPR.

8. Children's Privacy

This website is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately so we can take appropriate action.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of this website after any changes constitutes your acknowledgement of the updated policy.

10. Contact Us

For any questions, concerns, or requests related to this Privacy Policy or the processing of your personal data, please contact us: