Privacy Policy

Scope

This policy applies only to data collected through this website. When you follow an external link, the policy of that site applies.

Who can access the data

Form records can be accessed only by authorised users in the administration panel. The panel is role-based: each user sees only the section required for their duties.

Operations performed in the panel (changes beyond simply viewing a record) are written to an audit trail together with the user, date and IP address.

Technical security measures

The site is served entirely over HTTPS; traffic between browser and server is encrypted.

All forms are protected with CSRF protection; submissions cannot be made from a spoofed site.

Submission frequency is rate-limited and automated submissions are filtered out with a honeypot field.

Images uploaded to the administration panel are validated by content and re-encoded; code embedded in a file cannot be written to disk.

Database access uses an application-specific account with limited privileges.

Administrator passwords are stored as irreversible hashes; they are never kept in plain text.

Third-party content

No request is sent to any third-party server while pages load. No advertising network, social media tracker or behavioural analytics tool is installed.

The map on the contact page loads only when you click the “Show map” button. Until you click, your browser does not connect to Google servers.

In case of a data breach

If it is established that personal data has been unlawfully obtained by others, the situation is reported to the affected individuals and to the Personal Data Protection Board as soon as possible.

Changes to this policy

This policy is updated in line with technical changes made to the site. The current version is always published on this page.