Last updated:
Privacy policy
What Dynamic Reactions LLC does with personal data on this site: what is collected, why, on which legal basis, who processes it, how long it is kept, and your rights under the GDPR.
In short
This site has no accounts, no cookies, no analytics and no advertising. The only personal data it handles is what you choose to send: a message through the contact form, an email, or a booking for a call through the calendar. Technical data about visits is processed by the hosting provider to deliver the pages and keep them secure, and is kept briefly.
Who is responsible
The controller is Dynamic Reactions LLC, a Delaware limited liability company, operating from Faro, Portugal. Its managing member is Ittai Perez. For everything in this policy, including requests about your data, write to ittai@dynamic-reactions.com.
The company is established in Portugal for the purposes of the General Data Protection Regulation (GDPR). The competent supervisory authority is the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD). The company is not required to appoint a data protection officer. The managing member handles all data protection matters personally.
What is processed, why, and on what legal basis
Visiting the site
When you open a page, the hosting provider receives the technical data any web server needs: your IP address, the address of the page you asked for, the time, your browser and operating system, and the page you came from if your browser sends it. This data is used to deliver the pages, to protect the site against abuse, and to diagnose faults. The legal basis is the company’s legitimate interest in running a secure and reliable website (Article 6(1)(f) GDPR). No profile is built from it, and it is not combined with anything else.
Sending a message through the contact form
The form asks for your name, your email address and your message. Nothing else. It is sent only after you tick the consent box. The data is used to read and answer your message. The legal basis is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time by writing to the address above. If your message leads to a proposal or an engagement, the correspondence is then processed to take the steps you asked for before a contract (Article 6(1)(b) GDPR). You do not have to provide any of this data. Without it, the company simply cannot answer.
Before a message is sent, the form runs a bot check by Cloudflare Turnstile: a small widget from Cloudflare that looks at signals from your browser to tell a person from a script, and hands the site a one-time proof. With each message the site also records the network address (IP) it came from, the country the hosting provider derives from it, and the browser’s identification string, and keeps them with the message, so that abuse can be recognised and answered. Messages that fail the check, or arrive faster than a person could type, are not delivered. The legal basis for the check and for these records is the company’s legitimate interest in keeping the form usable and its mailbox free of automated spam (Article 6(1)(f) GDPR).
Writing by email
If you email ittai@dynamic-reactions.com directly, your email address, the content of your message and anything you attach are processed in the same way and on the same legal basis as a message sent through the form.
Booking a call
The “Book a 30-minute call” button opens a booking calendar that runs on Cal.com, a scheduling service. Nothing from Cal.com is loaded until you press the button. In the calendar you choose a time and enter your name and your email address, and anything you add in the notes. Cal.com records the booking, writes it into the company’s Google Calendar, creates the Google Meet link the call is held on, and sends you the confirmation, the reminders and the options to reschedule or cancel. Google therefore receives the invitation as well, with your name, your email address, the time and your notes, and hosts the call. The data is used to hold the call you asked for. The legal basis is the steps you asked for before a possible contract (Article 6(1)(b) GDPR). You can also arrange a call without the calendar by writing to the address above.
Keeping records
Correspondence that leads to an engagement is kept as part of the business relationship, on the basis of the contract (Article 6(1)(b) GDPR) and of the company’s legitimate interest in keeping records of its business (Article 6(1)(f) GDPR), for as long as the law on business and tax records requires.
How long data is kept
| Data | Kept for |
|---|---|
| Request logs at the hosting provider | A short period, at most a few days, then deleted |
| Delivery logs at the email delivery service | Up to 30 days |
| Contact-form messages and emails | Until the enquiry is closed, and at most 12 months after the last exchange, unless an engagement follows |
| Bookings made through the calendar, as calendar entries and correspondence | Like messages: until the enquiry is closed, and at most 12 months after the last exchange, unless an engagement follows. Cal.com keeps its own record of the booking for as long as the company’s account with it exists |
| Log lines about a form submission (network address, country, browser string, the outcome; never the message) | One hour, in the hosting provider’s runtime log. The network address, country and browser string that travel with a delivered message are kept like the message |
| Correspondence that is part of an engagement | For the duration of the relationship, and afterwards for the period the law on business and tax records requires |
| The record that you gave consent | As long as the message it relates to |
Who receives the data
The company does not sell personal data and does not share it with advertisers. It uses five service providers, each bound by data processing terms under Article 28 GDPR:
| Provider | What it does | Where | Safeguards |
|---|---|---|---|
| Vercel Inc. (United States) | Hosts and delivers this site and processes the request logs described above | United States, with delivery servers around the world | Data processing addendum with the EU Standard Contractual Clauses. Certified under the EU-U.S. Data Privacy Framework |
| Plus Five Five, Inc., trading as Resend (United States) | Carries contact-form messages from the site to the company’s mailbox as email, and keeps delivery logs for up to 30 days | United States | Data processing addendum with the EU Standard Contractual Clauses |
| Cal.com, Inc. (United States) | Runs the booking calendar: shows the free times, records a booking with your name and email address, writes it into the company’s calendar, creates the video call link, and sends the confirmation and the reminders | United States | Data processing terms with the EU Standard Contractual Clauses |
| Google LLC (United States) | Holds the company’s calendar (Google Calendar) and runs Google Meet, the video service the call is held on: it receives the booking as a calendar invitation with your name, your email address, the time and your notes, and hosts the call | United States, with data centres around the world | Google Workspace data processing terms with the EU Standard Contractual Clauses. Certified under the EU-U.S. Data Privacy Framework |
| Cloudflare, Inc. (United States) | Runs the bot check on the contact form (Turnstile): its widget loads on the contact page, looks at signals from your browser and at your network address, and tells the site whether the sender is a person | United States, with servers around the world | Data processing addendum with the EU Standard Contractual Clauses. Certified under the EU-U.S. Data Privacy Framework |
Messages arrive in the company’s business mailbox, hosted by its email service provider, and are read only by the managing member. Bookings arrive in the company’s calendar in the same way. Each provider publishes its own list of sub-processors on its website.
Transfers outside the European Economic Area
All five providers process data in the United States. These transfers rest on the European Commission’s Standard Contractual Clauses, which form part of each provider’s data processing terms. Vercel, Google and Cloudflare are in addition certified under the EU-U.S. Data Privacy Framework. You can ask for a copy of the safeguards at the address above.
Cookies and local storage
This site sets no cookies and uses no analytics. Fonts, images and scripts are served from this site’s own domain, so loading a page sends no request to anyone other than the hosting provider that serves the site. The one exception is the contact page, which loads Cloudflare’s bot-check widget from challenges.cloudflare.com. It runs in its own window on that page and may store data there for its own operation, as Cloudflare’s privacy policy describes. The site stores one thing on your device, and only if you ask for it: when you turn the sound on with the button in the header, your choice is kept in your browser’s local storage under the name dr-sound, so that it holds from page to page. It identifies nobody, is never sent anywhere, and goes when you clear the site’s data in your browser. When you open the booking calendar, Cal.com’s page is loaded inside a window on this site and may set its own cookies in that window for its own operation, as its privacy policy describes. Because the site sets no cookies of its own, and the only element from anyone else that loads before you ask for it is the bot check the contact form needs in order to work, there is no cookie banner: there is nothing to consent to.
Your rights
Under the GDPR you have the right to:
- access the personal data the company holds about you, and receive a copy;
- rectification of data that is wrong or incomplete;
- erasure, where there is no longer a reason to keep the data;
- restriction of processing while a question about the data is being resolved;
- portability, meaning a copy of the data you provided in a common machine-readable format;
- object to processing that rests on legitimate interest;
- withdraw consent at any time, without affecting what was done lawfully before.
To use any of these rights, write to ittai@dynamic-reactions.com. The company may ask you to confirm your identity before acting, answers within one month, and does not charge for this. There is no automated decision-making and no profiling on this site.
If you are in Israel, the Protection of Privacy Law, 1981 also gives you the right to inspect the data held about you and to have it corrected. Use the same address.
Complaints
If you believe the company has handled your data unlawfully, you can complain to the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese supervisory authority, or to the supervisory authority of the EU or EEA country where you live or work. In Israel, the Privacy Protection Authority is the competent body.
Children
This site is meant for organizations and the people who work in them. It is not directed at children, and the company does not knowingly collect data from anyone under 16.
Security
The site is served only over HTTPS. The company collects the minimum data it needs, keeps it no longer than needed, and limits access to the managing member.
Changes
When this policy changes, the new version is published here with a new date at the top. Material changes are pointed out in the text.