Privacy notice
This notice explains what personal data this website processes, why, on what legal basis and for how long, and what rights you have. It is given under Articles 13 and 14 of Regulation (EU) 2016/679 (the GDPR).
Version 1.0 · Effective from 5 October 2026
Who is responsible
The controller of the personal data described here is Dmitry Prudnikov, a natural person in Bucharest, Romania, who operates this website and is the party to the contributor licence agreements signed on it. The association Structured World, whose registration the court ordered on 23 September 2026, does not yet process any personal data through this website. When the association is registered and those agreements are transferred to it, the association becomes the controller; this notice will then be replaced by a new version, and you will be able to see both.
Contact for anything about your personal data: privacy@sw.foundation.
No data protection officer is designated, because the processing described here does not require one (Article 37 GDPR).
Reading this website
You can read every page of this website without an account and without giving us any personal data.
The servers record each request (IP address, time, requested address, browser identification) to keep the site secure and working. Legal basis: our legitimate interest in the security of the service (Article 6(1)(f)). Retention: 14 days, then deleted.
Cookies
Two cookies are strictly necessary and are set without asking, because the site cannot do what you ask of it without them (Article 5(3) of Directive 2002/58/EC, Article 4(5) of Romanian Law 506/2004):
| Cookie | Purpose | Kept for |
|---|---|---|
sw_cla | The sign-in session of the agreement signing service, set when you sign in with GitHub to sign | At most 12 hours |
consent_preferences | Your choice about analytics cookies, accepted or refused, so that you are not asked again on every page | 6 months |
The analytics cookies below are set only if you accept them. The site sets no advertising cookies.
Analytics, only with your consent
If you accept analytics cookies, the site loads Google Analytics to count visits, to see which pages are read and to count how many people start and complete the signing of the Contributor License Agreement. Until you accept, no Google script is loaded and nothing is sent to Google.
- What Google receives: the address and title of each page you read and the page you came from; your browser, device type and language; your approximate location (country and region, worked out from your IP address; city-level location is turned off); a random identifier kept in the cookies below; and the names of the signing steps you complete. Your IP address reaches Google with each request; Google Analytics does not store it. Nothing you type into the signing form is sent.
- Settings: Google signals, advertising personalisation and data sharing for advertising are turned off, and the data is not linked to any advertising account.
- Cookies:
_gaand_ga_M6CRW9MWKV, kept for up to 6 months. - Retention in Google Analytics: 2 months, then deleted.
- Legal basis: your consent (Article 6(1)(a) GDPR and Article 5(3) of Directive 2002/58/EC). You can withdraw it at any time with the Cookie settings link at the bottom of every page: measurement stops and the analytics cookies are deleted. Withdrawal does not affect the processing done before it.
- Who processes it: Google Ireland Limited, as our processor under the Google Ads Data Processing Terms. Data may be transferred to Google LLC in the United States under the EU-US Data Privacy Framework, under which Google LLC is certified.
Signing the Contributor License Agreement
To contribute to the projects of Structured World you sign the Contributor License Agreement once. To sign, we process:
| Data | Why | Legal basis |
|---|---|---|
| Your GitHub account: numeric id, login, avatar, account creation date | To know which account signs, so that its contributions can be matched to the signature. We do not ask GitHub for your e-mail address or for access to any repository. | Taking steps to enter into, and performing, the agreement (Article 6(1)(b)) |
| Your full name, e-mail address and country | To identify the person who signs; the e-mail address also receives the confirmation code and your copy of the signed agreement | Article 6(1)(b) |
| Whether you sign for yourself or on behalf of an employer | To apply the right agreement (individual or corporate) | Article 6(1)(b) |
| The signature record: the version and checksum of the agreement text, the name you typed as your signature, the time, the pull request you came from, and the technical record of the signing session (IP address and browser identification at the moment of signing) | To be able to show, later, who agreed to which text and when | Article 6(1)(b); afterwards our legitimate interest in proving the licences we rely on (Article 6(1)(f)) |
A signing attempt that is not completed, or whose e-mail address is not confirmed, is deleted after 24 hours.
What becomes public
- On GitHub, a pull request shows whether the agreement has been signed for its authors (a status check).
- On this website, a verification page for each signature shows only the GitHub login, the version of the agreement and the date of signing, so that anyone using the code can check that a contribution is covered. Your name, e-mail address and country are never shown.
Legal basis for the verification page: our legitimate interest, and that of everyone who uses the projects, in being able to verify that contributions are licensed (Article 6(1)(f)). You can object to it (see your rights below).
How long the signature is kept
The signature record and your signed copy are kept for as long as the licences granted under the agreement may be relied on, and for as long afterwards as legal claims concerning them can be brought. A signature cannot be deleted while it is needed to prove a licence (Article 17(3)(e) GDPR).
Where it is stored and who else receives it
- The website and its database run on a server in Prague, Czech Republic, operated by the controller. Visitors reach it through two load balancers operated by the controller, one in Prague and one in France on a server rented from OVH SAS, which acts as a hosting processor. All of this is within the European Union.
- A copy of the signature record (without your e-mail address) is kept in a private repository hosted by GitHub, Inc., which acts as a processor. GitHub is in the United States; the transfer relies on the EU-US Data Privacy Framework, under which GitHub is certified.
- To prove when a record existed, a trusted timestamp is requested from an external timestamping service. That service receives only a checksum of the record, from which no personal data can be read.
- E-mail for the sw.foundation domain, including the confirmation codes and the copies of the agreement this website sends and the messages you send to us, is handled by Google Workspace (Google Ireland Limited, with transfers to Google LLC under the EU-US Data Privacy Framework), acting as a processor.
We do not sell personal data, and we do not use it for marketing or for any automated decision about you.
Your rights
You can ask us for access to your data (Article 15), its correction (Article 16), its erasure where the law allows it (Article 17), the restriction of its processing (Article 18) and a copy of the data you gave us for the agreement in a machine-readable form (Article 20). You can object to processing based on our legitimate interest (Article 21), including the public verification page: if you object, we remove your entry from the public page and keep the record only as proof of the licence.
Write to privacy@sw.foundation. We answer within one month; for complex requests this can be extended by two further months, and we will tell you why. We may ask you to confirm that the request comes from you, for example by replying from the e-mail address used for signing or from your GitHub account.
You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work. In Romania this is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), www.dataprotection.ro.
Changes to this notice
A new version of this notice is published here with its date; previous versions remain available.