What we keep, and why.

SERAC is a fictional watch maison: this site is a design study and there is no company called SERAC. The person responsible for this site and for any personal data it processes — the controller under the General Data Protection Regulation (GDPR) — is:

Controller

Dmitry Faisman, trading as DF Development

Postal address

Limassol MarinaLimassolCyprus

Email

fsdimon084@gmail.com

Contact form

serac.faisman.dev/inquiry

Anything you send to “SERAC” or “the concierge” through this site reaches DF Development and no one else. No data protection officer has been appointed, as none is required for processing of this kind and scale; write to fsdimon084@gmail.com with any question about your data.

• No analytics, no advertising, no social-media pixels, no tracking across sites, no profiling.
• Your browser talks only to this site: fonts, photographs and films are all served from here.
• Security cookies only — see the cookie notice.
• Personal data is collected only when you send the private inquiry form, is used only to answer you, and is deleted automatically 12 months after it arrives — earlier if you ask.
• Nothing is sold, rented or shared for marketing. There is no newsletter.

To show you a page, our server necessarily receives your IP address, the address of the page, the time of the request and the technical headers your browser sends (such as its name and preferred language). They are used to deliver the page; our server keeps no access log of visits. When a request fails — for example while the site restarts — the web server’s error log can record it together with your IP address; that log is deleted after 7 days.

To protect the inquiry form and the configurator’s “save build” feature against automated abuse, the site counts requests per address. It never stores the address itself, only a keyed hash (HMAC-SHA-256 with a secret key) that cannot be turned back into the address without that key; these counters are deleted after 2 days, and the per-minute counters held in memory after a minute.

Purpose

Delivering the site securely; preventing abuse and attacks

Legal basis

Art. 6(1)(f) GDPR — our legitimate interest in a site that works and stays secure

Kept

No access log; error log 7 days; hashed counters 2 days

SERAC sells nothing: the form is how you write to DF Development about this design study. When you send it, we store what you entered:

• your name and email address;
• your phone number and country, if you give them, and how you prefer to be contacted;
• the reference or configured build you ask about, and your message.

With it we store a keyed hash of your IP address and your browser’s identification string, which help us recognise automated or abusive submissions. Both are removed from the inquiry after 30 days. The form also uses invisible anti-spam checks that involve no personal data.

Purpose

Reading your message and answering it, by the means you chose

Legal basis

Art. 6(1)(a) GDPR — your consent, given with the checkbox under the form; for the IP hash and browser string, Art. 6(1)(f) — our legitimate interest in keeping the form free of abuse

Kept

12 months from receipt, then deleted automatically — or earlier at your request

Giving these details is voluntary, but without a name, an email address and a message we cannot answer you. You can withdraw your consent at any time by writing to fsdimon084@gmail.com: the inquiry is then deleted. Withdrawal does not affect what was done lawfully before it. If our conversation continues by email or phone, those messages are kept only as long as needed to deal with your request, and no longer than 12 months after the last one.

Saved builds

When you save a configuration, the site stores the chosen bezel, dial and strap under a short code so the link keeps working. A keyed hash of your IP address is stored with it to prevent abuse and removed after 30 days; the build itself holds no personal data.

Your data is read only by Dmitry Faisman, trading as DF Development. It is processed on our behalf by:

• Hostinger International Ltd. (Larnaca, Cyprus), which provides the server in a data centre in Paris, France — as a processor bound by a data processing agreement under Art. 28 GDPR.

When we answer you by email, or you write to us, the messages pass through our mailbox at Google Ireland Limited (Gmail) (Dublin, Ireland), which processes them under its own terms.

The films on this site come from our own media server through this site; your browser does not connect to it, and nothing about you is passed on with those requests. We pass data to authorities only where the law obliges us to.

Outside the European Union

The site and its database run on a server in the European Union, and inquiries are stored only there. Data can leave the European Economic Area in these cases only:

• Google Ireland Limited (Gmail), the provider of our mailbox, which may process emails outside the EEA under the EU–US Data Privacy Framework, under which Google LLC is certified, and standard contractual clauses.

The site stores only what it needs to work: a security cookie for every visitor, a sign-in cookie for the administrator, and two small notes in your browser’s own storage. None of them tracks you. The cookie notice lists each one with its purpose and lifetime.

Inquiries

12 months from receipt

IP hash and browser string

30 days, then removed from the inquiry, the saved build or the audit log

Rate-limit counters

2 days

Web server error log

7 days

Administrator records

Sign-ins until they expire (8 hours); the audit trail of administrator actions 12 months

Deletion runs automatically on the server several times a day. An inquiry is deleted earlier when you ask for it, or when it is plainly spam.

Under the GDPR you have the right to:

• know whether we hold data about you and receive a copy of it (Art. 15);
• have inaccurate data corrected (Art. 16) or your data erased (Art. 17);
• have its processing restricted (Art. 18);
• receive the data you gave us in a structured, machine-readable format (Art. 20);
• withdraw your consent at any time, without affecting what was done before (Art. 7(3)).

Write to fsdimon084@gmail.com. It costs nothing, and we answer within one month. If we cannot tell from your message that it really comes from you, we may ask you to confirm it from the email address you used in your inquiry.

Your right to object

Where we rely on our legitimate interests (Art. 6(1)(f)) — delivering and securing the site, counting requests, and the IP hash and browser string stored with an inquiry — you may object at any time, on grounds relating to your particular situation (Art. 21). Write to fsdimon084@gmail.com; we then stop unless we have compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend legal claims.

Complaints

You may also lodge a complaint with a data protection supervisory authority — in particular the one where you live, where you work or where you believe the infringement took place (Art. 77). For DF Development this is the Commissioner for Personal Data Protection (Cyprus).

Every connection is encrypted (HTTPS with HSTS). Inquiries can be read only by the administrator, after signing in with a strong password; sign-ins expire after eight hours. IP addresses are stored only as keyed hashes. The server runs the site as an unprivileged, sandboxed service.

No decision about you is made automatically, and no profile of you is built (Art. 22).

This site is not meant for children under 16. Please do not send us an inquiry if you are under 16.

When the way this site handles data changes, this notice is updated first and the date at the top changes with it. Earlier versions are available on request.