Privacy policy

The short version

There is no form on this website, no account to create, no analytics, no advertising, no tracking pixel and no tag manager. Your browser talks to this domain and to nothing else — the typefaces, the film and the images are all served from here rather than from anyone’s network.

The only way to reach us from here is the email address, which opens your own mail program. Until you choose to write, we do not know you were here.

Who is responsible

The controller of any personal data described here is the firm identified at the foot of this page. Write to the address there for anything in this policy, including any of the rights below.

What happens when you open a page

The site is a set of static files. Serving them creates the ordinary server record any web server creates: your IP address, the time, the page requested, the referring page and your browser’s user-agent string. Those records exist so the site can be kept secure and available, and they are held by Railway, on servers in the Netherlands, under that provider’s own terms.

The site is served through Cloudflare, which sits in front of those servers, terminates the encrypted connection, and keeps its own record of the same request.

Those servers are inside the European Economic Area. The layer in front of them is not confined to one: on our plan the request is answered by whichever of that network’s data centres is nearest you, and that may be outside the EEA.

Railway Corporation and Cloudflare, Inc. are both established in the United States. Staff at either can reach those records from outside the EEA while operating and supporting the service. That access is covered by data processing agreements between us and each of them, which incorporate the European Commission’s standard contractual clauses — Decision 2021/914 of 4 June 2021, controller-to-processor. Ask at the address below and we will send you copies.

They are not used to build a profile of you, are not combined with anything else, are not sold, and are not shared with anyone for marketing. The lawful basis is our legitimate interest in running a secure website — Article 6(1)(f).

The one thing stored in your browser

If you use the freeze control to stop the film, that preference is remembered on your own device so the site does not start moving again on the next page. It is stored in local storage rather than in a cookie, which means it is never attached to a request and never reaches the server. Clearing your browser’s site data removes it.

When you write to us

If you email us we hold what you send — your address, your name if you give it, and whatever you write — for as long as it takes to answer you and to keep a record of the conversation. The lawful basis is taking steps at your request before entering a contract, or our legitimate interest in replying to correspondence.

We do not add you to a mailing list. There is no mailing list.

Client project data is somewhere else

Nothing in this policy covers data processed inside a client engagement. That is governed by the signed contract and its data processing agreement, where the firm acts as processor on the client’s instructions. A summary of the standing security position is on the About us page; the contract is the document that binds.

Your rights

Under the GDPR you can ask us for a copy of what we hold about you, ask us to correct it or erase it, ask us to restrict what we do with it, object to processing based on legitimate interest, and ask for it in a portable form. Write to the address at the foot of this page and we will answer within one month.

You can also complain to the supervisory authority. In Greece that is the Hellenic Data Protection Authority, at dpa.gr. You do not have to come to us first, though we would rather you did.

Changes

If the site ever starts collecting something, this page changes before that happens rather than after. The date at the top is the date of the last substantive revision.