Privacy Policy

1. Who is responsible for your data

The controller of your personal data (the titolare del trattamento) is Donaldson R F, a sole trader based at Via Mario Pettenghi, 27100 Pavia PV, Italy, Partita IVA 03047430180. You can reach me at info@donaldsonrf.com. This policy applies to donaldsonrf.com, the services and tools sold on it, the free tools, and the DRF Key licence service. It follows Regulation (EU) 2016/679 (the GDPR) and the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended).

2. What I collect, why, and on what legal basis

• Contact form and emails. Your name, email address and message, so that I can reply. Legal basis: taking steps at your request before a contract, or my legitimate interest in answering you (GDPR art. 6(1)(b) and (f)).
• Orders. When you buy a service, payment is handled by Stripe. Stripe sends me your name, email address, country and the order reference. I never see your full card number. Legal basis: performing the contract (art. 6(1)(b)). I also keep the invoice and accounting records the law requires (art. 6(1)(c)).
• Project details and access. The form you fill in after paying may include links, files and sometimes temporary access to a website, hosting panel or server. Please use a temporary account where you can. I use this only for your job and delete access details when the work is finished. Legal basis: performing the contract.
• DRF Key and Expert Advisors. For a licence I keep your email address, the key, the subscription reference from Stripe, the status and end date, and the IP address from which the key was last used, because a key is bound to one IP address at a time. The licence server also logs each check of a known key (key, name of the EA, IP address, result and time), so that I can see when a key is used from the wrong place and answer support questions. Your card details stay with Stripe; the licence system only holds the Stripe customer and subscription references. Legal basis: performing the contract, and my legitimate interest in preventing a key being shared (art. 6(1)(b) and (f)).
• Account area (sync server). If you ask for a sign-in link, I keep your email address, a one-way code of the link (not the link itself), the time and your IP address, for 15 minutes of use and then up to 2 days, to stop abuse. A session cookie keeps you signed in. Legal basis: performing the contract and legitimate interest in security.
• DRF Signal and data feeds. The Signal page and some tools read public data files from my sync server (sync.donaldsonrf.com). That server, like any web server, records your IP address in its access log. The signal figures themselves contain no personal data about you.
• Server logs. Like any web server, mine records your IP address, the page requested and the browser type for security and fault-finding. Legal basis: legitimate interest (art. 6(1)(f)).
• Statistics. If you accept analytics cookies, Google Tag Manager and Google Analytics measure how the site is used. Nothing of this loads before you accept. Legal basis: your consent (art. 6(1)(a)), which you can withdraw at any time. See the Cookie Policy.
• Protection of the forms. Every form on this site (contact, tool suggestions, newsletter sign-up, the details after a purchase, and the sign-in link request of the account area) has its own protection against automated messages: invisible fields that only a robot fills in, a signed single-use code with the time the page was opened, a short check that the form was used in a browser (counts of key presses and pointer events and the time taken, never what you typed), a small calculation that your browser does before sending, a check that the request comes from this site, and a limit on the number of attempts from one IP address. For this I keep a short one-way code of your IP address with a count and a time, never the text you wrote, for up to 30 days in a security log, together with the rounded score that Google reCAPTCHA gave the check (a number, never your address or text), and up to 2 days for the limit counters. Legal basis: my legitimate interest in keeping the site and my inbox free of abuse (art. 6(1)(f)). The pages that contain a form (contact, tool suggestions, the details after a purchase, newsletter sign-up) also load Google reCAPTCHA v3 for security, whatever you chose in the cookie banner, because the forms are refused without it. It scores whether the visit looks human. For that, Google receives your IP address, details of your browser and device, and how you interact with the page, and may set or read a cookie. The script is not loaded on other pages. Google handles this under its own Privacy Policy and Terms of Service. Legal basis: my legitimate interest in protecting the forms and my inbox from automated abuse (art. 6(1)(f)); you can object by not using the form and writing to me by e-mail instead. The account area on the sync server uses only my own protection and no Google script.
• Newsletter. If you sign up, I keep your email address, the time of your request, which page you signed up on (for example the footer or an article), whether you confirmed, the time you confirmed, and the time you unsubscribed if you do. You get one email with a link to confirm first (double opt-in); nothing else is sent until you confirm. The letters are prepared and sent from my own server (an automation tool on the same server, and my own mail server); your address is not given to an AI service or to an email marketing company. About one short email a week, and only when there is something worth reading; every letter has a one-click unsubscribe link. Legal basis: your consent (art. 6(1)(a)), which you can withdraw at any time by unsubscribing. After you unsubscribe I keep only the address and the date, so that you are not added again by mistake.
• Counters. The site counts page views, tool visits, searches and clicks on Buy buttons and on the Expert Advisor pages in totals, without identifying you. A second set of totals tries to count people only: a small script reports a page view to my server after the page has loaded, and requests from known robots and crawlers are counted separately. No IP address, cookie or identifier is stored for this. If you are the owner of the site and signed in to the admin, a small cookie keeps your own visits out of the counts (see the Cookie Policy).

The free tools run in your browser. Text, files and numbers you type into them are not sent to me, except for the few tools that by their nature ask my server to fetch a public address for you (for example a DNS, SSL or redirect checker). Those requests are not stored beyond what the server log keeps.

3. How long I keep it

• Messages and project files: for as long as needed to answer you and deliver the work, and then for up to 24 months in case of follow-up questions.
• Access credentials you give me: deleted when the job is finished.
• Invoices and accounting records: for the period required by Italian law, which is currently ten years.
• Licence records: while the key is active and afterwards for as long as needed for support, accounting and disputes. Licence check logs: 90 days, then deleted. Sign-in link records: up to 2 days.
• Newsletter: your address and sign-up details until you unsubscribe; after that the address and the date of the unsubscribe, so that you are not added again by mistake.
• Analytics data: according to the retention setting of the analytics account.

4. Who receives your data

I do not sell or rent personal data. I use these providers, who process data on my behalf or as independent controllers for their own role: Stripe (payments and subscriptions), my hosting provider (the web server and the sync server), Cloudflare (network protection and delivery), an email provider (sending and receiving email), and Google (Tag Manager and Analytics only with your consent; reCAPTCHA on the pages with a form, for security, whatever you chose in the cookie banner). Some of these providers are in, or may transfer data to, countries outside the European Economic Area. Where that happens, the transfer relies on a valid mechanism under the GDPR such as the European Commission's adequacy decision for participants in the EU-US Data Privacy Framework or standard contractual clauses.

5. Your rights

Under the GDPR you can ask me for access to your data, correction, erasure, restriction of processing, a copy in a portable format, and you can object to processing based on legitimate interest. Where processing rests on consent you can withdraw it at any time, without affecting what was done before. Write to info@donaldsonrf.com and I will answer within one month. You also have the right to complain to the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the authority in your own country.

6. Security

The site is served over HTTPS. Secrets and visitor messages are kept outside the public part of the server. No method of storage or transmission is completely secure, so I cannot promise absolute security, but I limit access to what is needed.

7. Children

The site is not directed at children and I do not knowingly collect data from anyone under 16.

8. Changes

I may update this policy. The date below shows the latest version.

Last updated: 27 October 2026