Draft Privacy Notice

1. Scope and present status

This notice covers the static files served under hardwindex.com in their pre-launch form. The site presents English-language educational hardware articles for a Netherlands publication concept. It has no analytics tags, advertising tags, user accounts, payment service, newsletter service, server-side contact form, or active commercial relationship. The responsible operator is unknown, so this draft cannot satisfy the controller-identification duties of a live service.

The displayed mailbox, editor@hardwindex.com, is unverified and unmonitored. It must not be relied on for exercising legal rights until a real operator confirms ownership, access, procedures, and response responsibility. The absence of a working contact point is a publication blocker, not a waiver of data rights.

2. Data handled by this preview

The site’s own JavaScript handles one item in the visitor’s browser: a cookie-choice value stored in local storage under a site-specific key. The value is either optional or essential. It contains no name, email address, message, account identifier, or unique advertising identifier. It remains in that browser until the visitor clears site data or changes the choice. The “Reopen cookie choices” control permits a new selection.

The contact preview asks for a name, email address, inquiry type, message, and confirmation checkbox. On selection of the validation button, script prevents transmission, checks required fields locally, clears the form, and moves focus to a status message. Nothing is sent, stored by Hardwindex, queued, or emailed. There is no form action and no form method. Visitors should still avoid entering confidential or sensitive information because a live page and browser environment cannot be treated as a private notes application.

Ordinary hosting, once configured, may process network information such as IP address, request time, requested path, response status, browser header, and security events. No host has been supplied, so Hardwindex cannot yet name a processor, location, retention period, or security configuration. Those facts must be added before launch.

3. Essential and optional choices

No browser cookies are set by the generated Hardwindex files. The consent interface uses local storage to remember one preference. This functional value is intended to prevent the banner from appearing on every page view. Optional analytics is inactive. Choosing “Allow optional” records the preference only and does not load analytics, advertising, conversion, or marketing code.

If measurement is added later, it must remain off until legally valid permission is obtained where required. This notice and the interface must then identify the provider, purposes, data categories, storage duration, withdrawal route, legal basis, and any transfer outside the European Economic Area. A recorded preference must never be described as consent for technology that was not disclosed at the time.

4. External public images

Article and homepage photographs are requested from one remote public-image host. Loading such an image sends the visitor’s IP address and ordinary browser request metadata to that host so the file can be delivered. A no-referrer policy is applied to content images, and URLs contain deterministic site-wide seeds rather than visitor identifiers. Image requests are ordinary media requests and are not gated by the cookie buttons.

The Open Graph image address may be requested by social or messaging preview systems when a page is shared, independently of a direct site visit. Remote-image terms, processing locations, retention, and commercial-use rights have not been verified. Before publication, every image must receive visual and license review and should preferably be self-hosted. Self-hosting would reduce these external media requests and require this section to be updated.

5. Purposes and possible legal bases

In the present static preview, local preference storage serves the purpose of remembering the visitor’s banner selection. A final operator should determine and document the appropriate legal basis under the GDPR and AVG rather than copy one into place without analysis. Depending on the final service, strictly necessary storage may be assessed under applicable electronic-communications rules, while optional measurement commonly requires consent.

Future editorial correspondence might be processed to answer an inquiry, assess a correction, handle a rights request, or protect legal interests. Each purpose needs a defined legal basis, minimum fields, access rule, retention period, deletion path, and processor record before the form becomes active.

6. Retention and security

The local preference remains on the visitor’s device until cleared or overwritten. Form entries are not retained by Hardwindex because they are not transmitted. Remote image and future hosting logs are controlled by providers that have not yet been selected or verified, so no retention promise is made here.

Before launch, the operator must establish HTTPS, access controls, account protection, patching responsibility, backup and deletion procedures, processor agreements where required, incident handling, and a retention schedule. This static preview cannot establish organisational security measures for an unidentified operator.

7. GDPR and AVG rights

Where the GDPR applies, individuals may have rights of access, rectification, erasure, restriction, portability, and objection, as well as the right to withdraw consent without affecting earlier lawful processing. Rights depend on the processing and legal basis; they are not identical in every circumstance. Individuals may also lodge a complaint with the competent supervisory authority, including the Dutch authority where it is competent.

A live notice must explain how to submit and verify a request without collecting excessive identity evidence. Hardwindex cannot currently process such requests because no controller or monitored channel exists. That failure is why publication remains blocked. Once verified, editor@hardwindex.com may become a contact only if the real operator assigns and tests it.

8. International or cross-border transfers

The remote image host or future hosting and communication providers may process data outside the Netherlands or European Economic Area. Their actual locations and transfer mechanisms have not been checked. A final operator must map transfers, identify recipients and countries where disclosure is legally required, and document an appropriate transfer mechanism and supplementary measures where applicable. This draft does not claim that all processing stays in the European Union.

9. Children and sensitive information

The publication is written for general readers planning computer hardware and is not directed at children. It does not need sensitive personal information. Do not put health, payment, government identifier, password, confidential employment, or urgent safety information into the static form preview.

10. Changes and contact

Material changes should receive a new visible date and a concise explanation. The present version is dated 25 September 2026. The proposed editorial standards describe correction handling, while the about page lists unresolved identity details.