Legal Notice
Version 1.0.
Effective date: 17 February 2026.
Last updated: 17 February 2026.
​
This Privacy Policy explains how personal data is processed when you visit this website, interact with any consent settings presented on the website, or contact the operator. The controller for processing described in this policy is a natural person website operator. The privacy contact for this website is privacy@thesevenlayers.org
.
1. Core commitments
The operator does not sell personal data. The operator does not disclose personal data to third parties for their own independent purposes. The operator uses service providers only where strictly necessary to operate the website and to run website analytics, and those providers process data under the operator’s instructions for the purposes described in this policy.
​
2. Scope and users
This policy applies to visitors of the landing page and to anyone who contacts the operator using the contact routes made available through the website. If a specific feature or channel presents a separate notice, that notice applies in addition to this policy.
​
3. Categories of personal data
When you visit the website, technical data may be processed, including IP address, device and browser information, referring page information, timestamps, and server log records. When analytics is enabled, usage data may be processed, including page views and interaction signals, together with online identifiers and device or browser attributes used to recognise a browser session. When you contact the operator, the operator processes the information you provide, typically your email address, any name you include, and the content of your message, as well as correspondence metadata required to manage the exchange.
​
4. Purposes of processing
The operator processes personal data to deliver the website to you, maintain stability and performance, prevent and detect abuse, and investigate incidents. The operator processes personal data to measure audience reach and improve the website using Google Analytics. The operator processes personal data to receive and respond to enquiries and to manage follow-up communications.
​
5. Legal basis for processing
Processing that is necessary to deliver and secure the website is carried out on the basis of the operator’s legitimate interests in operating a secure and reliable online presence and protecting the website from misuse.
​
Processing for analytics is carried out on the basis of consent where analytics technologies require consent in your context. Where a consent interface is presented, analytics is activated only in line with the preferences you select. You can withdraw consent at any time by changing your preference settings, without affecting processing carried out before withdrawal.
​
Processing of enquiries and correspondence is carried out on the basis of the operator’s legitimate interests in responding to communications and managing requests, and where relevant, to take steps requested by you prior to entering into any arrangement.
​
6. Cookies, similar technologies, and consent management
This website may use cookies and similar technologies, including local storage or comparable mechanisms. Technologies that are strictly necessary for core functionality, security, and storing your preference signal may be used as part of operating the website.
This website uses Google Analytics for audience measurement. Google Analytics may use cookies or similar storage and technical identifiers to generate reports about website usage and performance. Where a consent interface is presented, Google Analytics is used only if you enable the analytics preference. You may also use browser controls to manage cookies and site data; doing so may affect the functionality of parts of the website.
​
7. Google Analytics
Google Analytics is used to understand how visitors use the website and to improve content and performance. Depending on configuration and your choices, Google Analytics may process online identifiers, device and browser information, and usage data such as page views and interaction signals. Technical information, including IP address, may be processed as part of communications between your device and the analytics service.
​
The operator uses Google Analytics for measurement purposes. The operator does not provide personal data to Google or any other recipient for their own independent marketing or resale purposes.
​
8. Recipients and disclosures
The operator does not disclose personal data to third parties for their own independent purposes. Personal data may be processed by service providers strictly to operate the website and provide analytics functionality, including Google as the provider of Google Analytics, and any hosting, content delivery, or security providers required for website operation. These providers are engaged to deliver services and are expected to process data only under the operator’s instructions for the purposes described in this policy.
​
9. International processing
Some service providers, including Google Analytics, may process data outside the European Economic Area depending on infrastructure and support arrangements. Where international processing occurs, safeguards intended to ensure an essentially equivalent level of protection are applied, typically through contractual safeguards and technical and organisational measures appropriate to the processing and risk.
​
10. Retention
Technical logs and security records are retained for a limited period appropriate for security monitoring and incident investigation and are then deleted or anonymised.
​
Analytics data is retained in accordance with the configured retention settings within Google Analytics and is minimised where feasible.
​
Correspondence data is retained for as long as necessary to resolve the enquiry and for a limited period thereafter for continuity and accountability, unless a longer period is required by applicable law.
​
11. Your rights and how to exercise them
You may have rights under applicable data protection law, including access, rectification, erasure, restriction, objection, and data portability, depending on the circumstances and the nature of processing. Where processing is based on consent, including for analytics where consent is used as the basis, you may withdraw consent at any time.
​
To exercise your rights, contact privacy@thesevenlayers.org
and provide sufficient information to identify your request and the relevant interaction. If you are dissatisfied, you may lodge a complaint with the competent supervisory authority in your place of habitual residence, place of work, or the operator’s place of establishment. You may also contact the operator first using the privacy email so concerns can be addressed promptly.
​
12. Security
The operator applies technical and organisational measures proportionate to the nature of the website and the risks of processing, including access controls and monitoring. No method of transmission or storage can be guaranteed fully secure, but controls are maintained to reduce risk.
​
13. Children
This website is not directed to children. If you believe a child has provided personal data through this website, contact privacy@thesevenlayers.org
so appropriate steps can be taken.
​
14. Changes to this policy
Updates are published on this page. The last updated date changes when material updates are made.
​
Internal references: Regulation (EU) 2016/679, including the transparency, lawful basis, rights, and transfer safeguard provisions; EU ePrivacy framework expectations for cookies and similar technologies.