Privacy policy

Last updated: 2026-09-24

This policy explains what personal data Michael Filipsen ("I", "me") collects through ensky.io, why, how long it's kept, and how you can request access to or deletion of it. This site is operated from Denmark and this policy is written to meet the requirements of the EU General Data Protection Regulation (GDPR).

What is collected

When you submit the contact form, the following is stored:

Name
Email address
Company name (if provided)
The topic you selected and the message you wrote
Submission timestamp and the IP address the request came from (used only for spam and abuse prevention)

No other personal data is collected. This site does not use tracking cookies and does not set any cookies for advertising or cross-site tracking purposes, so no cookie consent banner is shown. Cloudflare Web Analytics, used to see aggregate visitor counts, works without cookies or any client-side identifier.

Why it's collected

Contact form data is collected solely to respond to your enquiry — there is no other use. The legal basis under GDPR Article 6(1)(a) is your explicit consent, given via the checkbox on the contact form, and Article 6(1)(f) (legitimate interest in responding to business enquiries and preventing abuse of the form).

Where it's stored

Submissions are stored in a Cloudflare D1 database provisioned in Cloudflare'sWestern Europe region, so the data stays within the EU and no transfer to a third country takes place for storage.

How it's protected

The contact form is protected by Cloudflare Turnstile (bot verification) and server-side rate limiting. The administrative view of submissions is restricted using Cloudflare Access, requiring authentication before any submission can be read. Your IP address is stored only as a keyed cryptographic hash, never in its original form.

Retention

Contact form submissions are retained for 12 months from the date of submission, after which they are deleted. If an engagement results from your enquiry, any data needed for that engagement is handled separately under the terms agreed for that engagement, not under this policy.

Your rights

Under GDPR, you have the right to:

Request a copy of the personal data held about you
Request correction of inaccurate data
Request deletion of your data at any time, before the 12-month retention period ends
Withdraw consent at any time
Lodge a complaint with a supervisory authority — in Denmark, the Datatilsynet

To exercise any of these rights, send the request through the contact form, selecting "Other" as the topic and describing what you would like done. You can also reach me via LinkedIn. I respond within 30 days.

No public email address is listed here deliberately — published addresses are harvested for spam, which makes them an unreliable channel. The contact form reaches me directly and is monitored.

Third parties

This site uses the following third-party services, all operated on infrastructure within Cloudflare's platform:

Cloudflare Turnstile — bot/spam verification on the contact form. See Cloudflare's privacy policy.
Cloudflare Web Analytics — cookieless, aggregate visitor analytics.

Submissions are not currently emailed anywhere. I review new submissions directly in the system that stores them, and no notification email is generated or sent when you submit the form. If that changes, this page will be updated in the same change to name the service used and how it is protected.

No data collected through this site is sold, rented, or shared with any other third party.

Changes to this policy

If this policy changes, the "last updated" date above will change accordingly. Material changes will be reflected here before they take effect.