Privacy Policy

1. Introduction

Theta Consultancy ("we", "us", "our") operates https://www.theta.mc. This Privacy Policy explains how we collect, use, and protect your personal data in accordance with the General Data Protection Regulation (GDPR) (EU) 2016/679.

2. Data controller

3. Data we collect

We collect personal data in two circumstances.

When you contact us. The contact form collects your name and email address, and optionally your company and role, together with the message you write. We also record the IP address the submission came from and the page it was sent from. Your email address is used as the reply address so we can respond.

When you browse the site. Our analytics provider records aggregate usage — pages viewed, referrer, approximate location, device and browser type. This is measured without cookies and without building a profile of you, and we cannot identify individual visitors from it.

We do not operate a mailing list and there is nothing on this site to subscribe to. We do not ask for, and have no way to receive, special category data through this site.

4. Legal basis for processing

We process your personal data on the following legal bases:

• Performance of a contract (Article 6(1)(b) GDPR)
• Legitimate interests (Article 6(1)(f) GDPR)

We do not rely on consent, and we do not ask for it: there is no cookie banner and no opt-in on this site, because the analytics are cookieless and nothing here requires your agreement before it works.

5. Cookies

This site does not use cookies. Our analytics are cookieless, so there is no consent banner to manage — there is nothing to consent to.

We do store one item in your browser's local storage: a key named theta-theme, which remembers whether you chose the light or dark appearance. It holds nothing but that preference, it is set only when you use the theme toggle yourself, it never leaves your browser, and clearing your site data removes it.

6. Third-party services

Three providers process data on our behalf:

• Cloudflare — hosting, content delivery and the contact-form endpoint. As part of serving the site it processes your IP address and request metadata.
• Plausible Analytics — cookieless usage analytics, EU-hosted. Per Plausible's own documentation it does not store IP addresses and does not track visitors across sites or sessions.
• Resend — delivery of contact-form enquiries to our inbox. It processes the contents of your message in order to send it.

Each publishes its own privacy notice. We do not sell personal data, and we do not share it with anyone else except where we are legally required to.

7. Data retention

Different data has different lifetimes:

• Contact enquiries reach our inbox as email and are kept there while the enquiry is live and for as long as we may need the correspondence, up to two years.
• A short-term copy of each submission, including the sending IP address, is held in our own storage for 90 days and then deleted automatically. It exists so that an email delivery failure does not lose your enquiry.
• Anti-abuse counters record a submitting IP address for 20 minutesto limit how many messages one source can send.
• Analytics are aggregate and retained by our analytics provider under its own retention policy. They are not tied to you.

8. Your rights under the GDPR

As a data subject in the European Union, you have the right to:

• Access your personal data
• Rectification of inaccurate data
• Erasure ("right to be forgotten")
• Restrict processing
• Data portability
• Object to processing

To exercise these rights, contact: contact@theta.mc

9. Data transfers

Your data is processed outside the European Economic Area. Saying otherwise would be misleading, so here is the actual picture.

Theta is established in Monaco, which is not part of the EEA. Data you send us is therefore handled outside the EEA from the moment it reaches us, and our processing is also subject to Monaco's own data protection law.

Our providers sit in different places:

• Plausible hosts our analytics data in the EU.
• Cloudflare and Resend are established in the United States and run global infrastructure, so data they handle for us — the pages we serve, and the delivery of your enquiry — may be processed outside the EEA, including in the United States.

Where data leaves the EEA we rely on the transfer safeguards these providers offer in their data processing terms, such as the European Commission's standard contractual clauses. If you want to know precisely which mechanism applies to a given provider, ask us at contact@theta.mc and we will tell you rather than leave you to guess.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, or disclosure.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated via our website.

12. Contact