Privacy policy

About this notice

Mythoswin is a universal static toy museum template. It has no real museum, location, operator or visitor service supplied with it. This copy must be completed and checked by the site owner before publication. The controller is [PLEASE ADD]; the controller's data-protection contact is [PLEASE ADD].

A quiet-by-default site

The template uses local fonts and, as supplied, has no site analytics, tracking or site-set cookies; it contains no advertising trackers. No external network request is made by the static pages by default. The owner must not describe the site as network-free after enabling an optional service. Hosting can still create technical records: the hosting provider, server operator, categories of logs, legal basis, locations and retention are not supplied here. [PLEASE ADD hosting/server operator, log categories and purpose, lawful basis, retention period, and hosting, backup and log locations]

Forms and what we use

Contact, group-enquiry and newsletter forms are optional features. A browser sends a POST request to Formspree only after a visitor submits a form and only when the owner has configured a valid Formspree form ID. The submitted fields may include an email address, name, message, group details and a record of the consent choice. The form should include a honeypot field and a clear, separate consent control; do not put special-category or confidential information in it.

Contact and group enquiries are used to answer a request and, where genuinely necessary, to take steps requested before an arrangement. The possible GDPR lawful bases are Article 6(1)(a) consent and Article 6(1)(b) steps at the individual's request before a contract; the owner must choose and document the basis that actually applies. Spam prevention and site security may be based on Article 6(1)(f) legitimate interests only after a documented balancing assessment. A legal obligation may apply under Article 6(1)(c) where a specific law requires it. [PLEASE ADD the confirmed lawful basis for each enabled form purpose]

Newsletter: confirmation is not built in

A static Formspree POST is not proof of a confirmed newsletter subscription. This template does not implement automatic confirmation or double opt-in, and no automatic double opt-in should be assumed from a Formspree submission. Newsletter sign-up must use separate, freely given consent under Article 6(1)(a), with an easy withdrawal or unsubscribe route. Before activating the newsletter, the owner must connect a confirmed double opt-in flow and document the provider, confirmation message, consent record, unsubscribe method, retention and any transfer safeguards. [PLEASE ADD the verified newsletter provider and confirmed double opt-in process before activation]

Optional OpenStreetMap map

No OpenStreetMap iframe or map request is made by default. If the owner replaces the template coordinates with a real location, the map must be loaded only after the visitor activates the map button. Activating it will connect the browser to OpenStreetMap infrastructure and may cause map and tile requests, so the visitor's technical information may be processed by those services under their own policies. Provide visible OpenStreetMap attribution and a text or link alternative. [PLEASE ADD the confirmed map coordinates, map implementation, attribution and current OSM privacy wording before enabling the map]

Recipients and international transfers

Depending on the features enabled, recipients may include the site host and its server or security providers, Formspree for submitted forms, and OpenStreetMap services only after the map is activated. The owner remains responsible for checking the controller/processor roles and contracts. Formspree's public security information says its services are hosted with Amazon Web Services in the United States and refers to Standard Contractual Clauses, but this template does not verify the current account configuration, contract, sub-processors or transfer mechanism. [PLEASE ADD the verified Formspree DPA, current sub-processors, transfer safeguard and supplementary measures, and the relevant hosting/OSM arrangements]

Retention

Formspree may store submissions in its service, and the host may create server logs. Newsletter records may be held by the confirmed mailing provider. Retention is not set by this template and must be limited to what each purpose needs, with deletion or review dates. [PLEASE ADD retention periods for Formspree submissions, newsletter records, host/server logs and backups, including deletion or review arrangements]

Your rights

Where the GDPR applies, and subject to its conditions and any applicable local law, you may ask for access to your personal data, rectification, erasure, restriction of processing, data portability and information about processing. You may object where the law gives you that right, and you may withdraw consent at any time when processing relies on consent; withdrawal does not undo processing already carried out lawfully. These rights are qualified and may be limited by legal exemptions, another lawful basis or the rights of others. To exercise a right, use contact or this privacy page to find the owner's confirmed route. You may complain to [Data protection authority – PLEASE ADD]. [PLEASE ADD the identity and contact route for the controller handling rights requests]

Automated decisions and changes

This template does not make decisions about visitors using solely automated processing or profiling. Formspree spam filtering may operate on a submission as a service feature, but it is not presented here as an automated decision with legal or similarly significant effects. The owner must update this notice before introducing profiling, targeted marketing or another material processing change. The latest version should be linked from privacy; questions can be sent through contact.

Self-hosted fonts

Lora and Inter font files are served by this website’s own host. Your browser does not contact Google Fonts or another font service. Font requests may appear in the host’s server logs, subject to the confirmed hosting arrangements described above.

Policy date

Last updated: [PLEASE ADD policy update date]. The operator must review this notice whenever services or processing change.