Privacy Policy
The HAIA Foundation is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you visit our website.
Data Collection
We may collect the following types of information:
- Information you provide: When you contact us through our contact form, we collect your name, email address, and any message you submit.
- Automatically collected data: Technical data such as your browser type, operating system, IP address, and timestamps when accessing our website.
Your Rights
You have the right to:
- Request information about the data we store about you
- Request corrections to any inaccurate information
- Request deletion of your personal data
- Object to the processing of your data
To exercise any of these rights, please reach out via our contact form.
Cookies
We do not set any cookies of our own, and we do not use tracking or advertising cookies. This website is a static site with no user accounts and no sessions.
Two exceptions come from Cloudflare, which delivers and protects this site. When you submit the contact form, Cloudflare Turnstile may store a short-lived token in your browser to record that the security check has been passed. Separately, Cloudflare may set a short-lived security cookie if it needs to verify a request it treats as suspicious. Neither is used for tracking or advertising. See Content Delivery and Security and Spam Protection below.
Content Delivery and Security
This website is served through Cloudflare, Inc., which acts as a content delivery network and security layer in front of our web host. This is worth stating plainly: every request to this site passes through Cloudflare's servers, not only form submissions.
In the course of delivering each page, Cloudflare processes your IP address, the address of the page you requested, your browser and device type, and the approximate location implied by your network connection. Cloudflare also instructs browsers to report network errors back to it, so a failed connection to this site may be logged on their systems. Cloudflare operates globally, so this may involve processing outside your country of residence.
We rely on this for delivery speed and for protection against denial-of-service attacks and other abuse, on the basis of our legitimate interest under GDPR Article 6(1)(f). It is not possible to browse this site without your request reaching Cloudflare. Their handling of that data is governed by Cloudflare's privacy policy.
Server Logs
Our web server automatically collects and stores information such as browser version, operating system, referrer URL, hostname, and IP address. This data is stored separately and is not combined with other data sources. Equivalent request logs are also generated at Cloudflare's edge, as described above.
Contact Form
Data entered through our contact form is processed with your consent under EU GDPR Article 6(1)(a). This data is retained until you request its deletion.
Submissions are delivered to us by email over an authenticated, encrypted connection to our own mail server. The contents are not stored in a database on this website.
Spam Protection
To stop automated spam, our contact form uses Cloudflare Turnstile, a privacy-focused alternative to traditional CAPTCHAs, provided by Cloudflare, Inc. This is in addition to Cloudflare's role in delivering the site, described above.
When you submit the form, Turnstile receives your IP address and limited technical information about your browser in order to determine whether the request is automated. The legal basis is our legitimate interest in protecting the site from abuse (GDPR Article 6(1)(f)).
Cloudflare states that Turnstile does not use this data for advertising or cross-site tracking. Their handling of it is governed by Cloudflare's privacy policy.
Third-Party Sharing
We do not sell your data, and we do not share it for advertising. The only third parties that receive any data through this website are:
- Cloudflare — delivers and protects the site, so it processes the IP address and request details of every visit, and additionally runs the spam check on contact form submissions (see above).
- Our web host — operates the server and mail service that deliver your message to us.
- Substack — only if you choose to subscribe to our newsletter, which happens on Substack's own site rather than here.
Analytics
This website uses no analytics. We do not run Google Analytics or any comparable service, we do not build visitor profiles, and we do not track you across sites. The only record of your visit is the standard server log described above.
External Resources
Fonts, stylesheets, scripts and images are all served from our own domain. Your browser is never asked to fetch anything from a third-party font service, analytics provider, ad network, or social media widget, and there are no embedded trackers. The only external request the site triggers is the spam-protection widget on the contact form.
Note that this is separate from Cloudflare's role: because Cloudflare serves the site itself, your request reaches Cloudflare even though the files are first-party. See Content Delivery and Security.
Newsletter
If you subscribe to our newsletter through Substack, your email address will be processed according to Substack's privacy policy. You can unsubscribe at any time using the link provided in each newsletter.
Legal Basis
Our data processing is based on:
- GDPR Article 6(1)(a): Your consent for specific processing activities
- GDPR Article 6(1)(b): Processing necessary for contract fulfillment
- GDPR Article 6(1)(f): Processing based on legitimate interests
Last updated: August 2026
If you have any questions about this Privacy Policy, please reach out via our contact form.