Privacy policy
What this site collects when you send a form, read a page or accept measurement, how long each item is kept, who else handles it, and how to have it corrected or erased.
Last updated: [SLOT: the date the reviewer signs this page off. The same date becomes dateModified in the page's JSON-LD and goes into the Review log of master.md.]
Who is responsible for your data, and which law applies
The controller of everything described below is [SLOT: legal entity, its registration number and its Monaco address, master.md open question 4]. One address reaches us on any question in this policy: [email protected]. We prepare and steer files for company formation in Monaco, and we are neither a law firm nor a data-protection adviser.
Two rules apply at once. The site's Monegasque processing runs under Loi n° 1.565 du 3 décembre 2024 relative à la protection des données personnelles, Monaco's personal-data act, in force since 3 December 2024. Monaco is not a member State of the European Union, so Regulation (EU) 2016/679, the GDPR, does not reach this site of its own force: it governs our processing of the data of visitors who are in the EU, and most of our readers are.
What we collect, why, and on what legal basis
Eight operations, and nothing else. Article 5 of Loi n° 1.565 lists the grounds that make processing lawful; three of them carry everything on this site: your consent (Art. 5 1°), steps taken at your request before or under a contract (Art. 5 3°), and our legitimate interest in keeping the site and its forms usable (Art. 5 6°). A retention period that has not been fixed yet is shown as a slot below rather than as a number we have not decided.
| Purpose | Data | Legal basis (Loi n° 1.565) | Retention |
|---|---|---|---|
| Answering an enquiry sent through the contact form | name, email address, the message, and the reference of a listing if you wrote from one | steps taken at your request (Art. 5 3°) | in the mailbox: [SLOT: retention window, fixed before launch] |
| Keeping both forms free of spam and abuse | a Cloudflare Turnstile token and a short-lived key derived from your IP address, allowing three submissions per ten minutes | legitimate interest (Art. 5 6°) | [SLOT: the key's time to live in the rate-limit store] |
| Opening a file through the onboarding form | the fields that form asks for, plus an optional copy of the submission in Cloudflare KV storage | steps taken at your request (Art. 5 3°) | 30 days for the stored copy; the email as in row 1 |
| Settling an invoice on the payment page | the invoice reference, the amount and the currency. Card and wallet details are entered on the provider's own page and never reach us | performance of a contract (Art. 5 3°) | the reference stays with the invoice; the payment record as the provider states |
| Measuring how the site is used, only once you accept | the cookies and identifiers Google Analytics 4 and Microsoft Clarity set, the pages you view, and, in Clarity, a replay of clicks and scrolling | consent (Art. 5 1°) | [SLOT: each tool's retention window, chosen before launch] |
| Counting visits without a cookie | page and referrer counts, with no cookie and no identifier we can resolve to a person | legitimate interest (Art. 5 6°) | aggregate figures only |
| Serving and protecting the site | the request data any web server receives: IP address, user agent, time and page | legitimate interest (Art. 5 6°) | [SLOT: the host's log window, verified before launch] |
| Honouring your consent choice | one entry written by your own browser and read back by the consent script | consent (Art. 5 1°) | until you clear your browser storage |
Nothing here profiles you, scores you or decides anything about you by automated means, which is the kind of decision Article 19 of Loi n° 1.565 gives you the right to refuse. The site runs no advertising pixel, no newsletter, no chat widget and no customer-relationship system, and it asks nobody to create an account.
The forms: contact, onboarding and the payment page
Three paths carry data out of your browser, and one check guards two of them.
The enquiry form. the contact form asks for a name, an email address and your message. It is delivered by Resend to [email protected] and forwarded from there by Cloudflare Email Routing to one mailbox we read.
The onboarding form. the onboarding form collects what is needed to open a file. Its email follows the same path as an enquiry, and a copy of the submission may sit in Cloudflare KV storage for 30 days.
The payment page. On the payment page you supply an invoice reference, an amount and a currency. Card details are entered on Stripe's page and wallet details on the NOWPayments page. Neither reaches us, and neither is stored here.
The spam check. Both forms run a Cloudflare Turnstile challenge and a rate limit of three submissions per ten minutes, keyed to your network address. That key is an abuse control, not a profile, and it is used for nothing else.
Giving us data is voluntary. An enquiry without an email address cannot be answered, which is the only reason that field is required; everything else you type is your decision.
Cookies, measurement and the consent gate
Google Analytics 4 and Microsoft Clarity load only after you accept measurement, and they stop when you withdraw. Clarity records interactions, so accepting it means a replay of clicks, scrolling and mouse movement on the pages you visit, not a page count: that is stated here rather than left to the small print. Ahrefs Web Analytics sets no cookie and holds no identifier we can resolve to a person, so it runs outside the gate. Withdrawal is as simple as consent and does not make what happened before it unlawful (Loi n° 1.565, Art. 6). the cookie policy carries the per-cookie table, with each cookie's purpose and lifetime; this page does not repeat that list, so the two cannot drift apart.
Who else handles your data, and where it is processed
Seven companies handle parts of what section 2 describes, each under its own notice. All of them sit outside Monaco, so data described above leaves the Principality. Transfers are governed by Chapter VIII of Loi n° 1.565, and this page makes no claim that any country or any of these companies has been found to offer an adequate level of protection: that finding has not been verified, so it is not asserted.
| Processor | What it handles for us | Its privacy notice |
|---|---|---|
| Cloudflare | hosting and delivery, the Turnstile check, the rate-limit store and the email routing | Cloudflare privacy policy |
| Resend | delivery of the emails both forms generate | Resend privacy policy |
| Google Analytics 4 measurement, behind the consent gate | Google privacy policy | |
| Microsoft | Clarity measurement and session replay, behind the consent gate | Microsoft privacy statement |
| Ahrefs | cookieless visit counting, outside the consent gate | Ahrefs privacy policy |
| Stripe | card payment started on the payment page | Stripe privacy policy |
| NOWPayments | crypto payment started on the payment page | NOWPayments privacy policy |
Beyond those seven, nobody. We do not sell data, we do not share it for advertising, and we pass it to no one else unless a law or a competent authority obliges us to, in which case we hand over what is demanded and no more.
Your rights, complaints, and changes to this policy
Loi n° 1.565 gives you the following rights over the data we hold about you. A visitor in the EU holds the equivalents the GDPR grants, and we answer either the same way.
- Access. Ask what we hold and why, and receive the answer within one month of the request (Art. 12).
- Rectification. Have data that is inaccurate or incomplete corrected without delay (Art. 13).
- Erasure. Have data deleted where one of the grounds in the act applies (Art. 14).
- Restriction. Have processing frozen while an objection or a dispute about accuracy is settled (Art. 15).
- Objection. Object, on grounds relating to your situation, to processing we base on legitimate interest (Art. 17).
- Portability. Receive the data you gave us in a structured, commonly used, machine-readable format (Art. 18).
- Withdrawal of consent. Withdraw measurement consent whenever you like, as simply as you gave it (Art. 6).
One email to [email protected] starts any of them, in whatever words you like. Article 12 requires the person asking to establish their identity, so we may ask you to confirm it, and we ask for nothing beyond what that takes. If our answer does not satisfy you, you may complain to the Monegasque supervisory authority. Article 37 of Loi n° 1.565 creates it as an independent administrative authority, the Autorité de Protection des Données Personnelles (A.P.D.P.), and Articles 11 and 12 count the right to bring a complaint to it among the things a controller has to tell you about. The authority examines complaints and tells the person who brought one how it is progressing and how it ended (Arts. 38 and 39). [SLOT: the A.P.D.P.'s published address and complaint form, read from the authority's own site before launch. The act fixes the right and the authority; it does not print the postal route.] A visitor in the EU may complain instead to the supervisory authority of their own country. When the processing changes, this policy changes with it: the new version replaces this one at the same address and the date at the top of the page is the date it took effect. What governs the rest of your use of the site is in the terms of service.
Start your Monaco file
Tell us the activity, where it will be carried on and who will run it. One of us reads it and comes back with the questions the authorisation file will ask. Our fees are on request.
The authorisation is personal and non-transferable, and it names the activity and the premises. Nothing on this site is sold ready to trade.
SEE_WHAT_THAT_MEANS