Privacy Notice
How the CAUSVEN pre-launch website handles personal data, technical request information and business enquiries.
Version 1.0 · Effective date: 15 September 2026 · Last updated: 15 September 2026.
1. Who operates CAUSVEN and controller status
CAUSVEN is a pre-launch technology brand. The intended operating company has not yet been formally incorporated. This notice describes the current website data handling for transparency, but it is not yet a legally complete controller or service-provider identity notice.
Before a release can be classified as legally complete, the legally required operator/controller identity and contact information must be activated or the relevant collection flow must change. Privacy enquiries may be sent to contact@causven.com.
2. Scope and pre-launch status
This notice applies to the public causven.com website and its current Contact enquiry flow. CAUSVEN is in product-development and commercial-preparation phase. This notice does not activate product licences, paid services, customer accounts, subscriptions, newsletters or advertising.
Product-specific services may require separate privacy notices before launch. Those future notices are outside this notice unless expressly added after a new data-flow review.
3. Personal data categories and sources
When you use Contact, we receive the destination you select, your email address, subject and message. The form also contains an anti-bot honeypot field named website; if it is filled, that submitted value may be processed for abuse detection.
Our web infrastructure also receives technical request data such as IP address, request time, path and method, response status, referrer and user-agent. These data arise from your connection to the website rather than from a separate account profile.
4. Purposes and lawful bases
We use enquiry information to receive, route, review and respond to your request, discuss licensing, projects or services you ask about, and maintain necessary business correspondence. In the EEA/Romania, Article 6(1)(b) GDPR is used only where processing is objectively necessary to take steps at your request before entering a contract; otherwise ordinary business correspondence may rely on Article 6(1)(f) legitimate interests.
Technical request and abuse-control data are used to deliver and secure the website, troubleshoot failures, detect abuse and protect service reliability. In the EEA/Romania this generally relies on Article 6(1)(f) legitimate interests. Article 6(1)(c) is used only where a concrete legal obligation actually applies.
We do not require a general consent checkbox merely to send an enquiry. Consent will be used only for genuinely optional future processing where consent is the appropriate legal basis.
5. Contact form processing
The current Contact flow validates the destination, email address, subject and message, applies same-origin and anti-abuse controls, and routes a successful enquiry to the selected CAUSVEN mailbox. The Contact flow has no database write in the audited build.
Please do not include unnecessary special-category, highly sensitive, financial-account, government-identifier or health information in a general enquiry. If such information is received unexpectedly, we will handle it under our internal privacy and minimisation procedures.
6. Transactional acknowledgement email
After a successful Contact submission, the current system sends the enquiry to either sales@causven.com or contact@causven.com and sends a transactional acknowledgement to the email address you provided. This acknowledgement is not a newsletter or marketing subscription.
7. Technical and security logs
Our web server maintains technical access logs containing request metadata such as IP address, timestamp, request details, response status, referrer and user-agent. We use these logs for service delivery, troubleshooting, security, abuse detection and operational evidence.
In the audited build there are no site-owned analytics profiles derived from these logs.
8. Abuse prevention and rate limiting
The Contact endpoint uses your request IP address to derive a SHA-256 rate key. Local rate state contains a rate-window start value and request count. The configured limit is 5 submissions per 600 seconds.
The 600-second logical window is not a promise that the corresponding local rate-state file is physically deleted after that period. Current cleanup enforcement is still being hardened, so this notice does not state a fixed physical deletion period that the system cannot yet prove.
9. Recipients and processors
Enquiry data may be accessed by the CAUSVEN personnel responsible for sales, general enquiries, security or operations, and by infrastructure or email service providers that process data to provide hosting, network or message-delivery functions.
We do not identify a processor legal entity merely from a technical hostname. The contracting legal entity, applicable data-processing agreement status and subprocessor chain for the current infrastructure are still under contractual verification. Until that verification is complete, this notice uses recipient categories rather than inventing a provider identity.
10. International transfers
We have not yet verified a complete provider-by-provider map of storage locations, remote access locations and international-transfer mechanisms for the current hosting and email services. We therefore do not claim that all personal data remain exclusively in the EEA or that a particular adequacy decision, standard contractual clause, UK transfer mechanism or other safeguard applies to every flow.
Before a legally complete release, applicable transfer paths and safeguards must be verified against the actual contracted providers and service configuration. Where a regional law requires transfer-specific disclosure, that disclosure will be provided once the relevant territorial scope and transfer facts are established.
11. Retention
We use retention criteria rather than inventing fixed periods that are not technically enforced. Contact correspondence is kept only as long as reasonably necessary to handle the enquiry, follow up on requested work, preserve relevant business records, meet applicable legal obligations, or establish, exercise or defend legal claims. The exact mailbox retention configuration is still under verification.
Technical access logs are subject to operational rotation and are retained for security, troubleshooting and evidentiary needs; the complete end-to-end period, including any backups or copies, is still being verified. Rate-limit state is retained for abuse-control purposes, but the current cleanup control does not yet justify a fixed physical deletion promise.
When a legal hold, dispute, incident investigation or mandatory retention requirement applies, relevant information may be kept for the period reasonably necessary for that purpose.
12. Security measures
We use measures appropriate to the current website such as HTTPS/TLS, access restrictions, isolated service configuration, input validation and rate limiting. Security controls are reviewed as the service evolves.
No internet service can guarantee absolute security. We do not describe the site as completely secure, unhackable or risk-free.
13. Your privacy rights
In the EEA/Romania, subject to the conditions and exceptions in applicable law, you may have the right of access to your personal data, rectification of inaccurate data, erasure, restriction of processing, data portability where applicable, and the right to object to processing based on legitimate interests.
If processing is ever based on consent, you may withdraw that consent for future processing without affecting processing already carried out lawfully. You may also object to direct marketing if such processing is introduced in the future; the current Contact acknowledgement is transactional, not direct marketing.
To exercise a right, contact contact@causven.com. We will verify identity proportionately to the sensitivity of the request and will not require a government ID by default where less intrusive verification is sufficient.
14. Complaints
You may raise a privacy concern with us at contact@causven.com. Where the GDPR applies, you also have the right to lodge a complaint with the competent supervisory authority, including the authority in the EEA country of your habitual residence, place of work or the place of the alleged infringement as provided by applicable law.
Regional complaint or appeal mechanisms are described below to the extent applicable to you.
15. Children and minors
The CAUSVEN corporate website is intended for business and technology enquiries and is not directed to children. We do not knowingly design the current Contact flow to solicit information from children. If you believe a child has submitted personal data, contact us so the situation can be assessed and handled appropriately.
16. Automated decision-making and profiling
The audited website flow uses no solely automated decision-making and no profiling that produces legal or similarly significant effects. Contact messages are routed and reviewed as business enquiries rather than scored to make such decisions.
18. Changes, effective date and versioning
This is Version 1.0, effective 15 September 2026. Material changes will update the version or last-updated date and, where required, will be brought to affected individuals' attention before new processing begins.
19. Privacy contact
For privacy questions or requests, email contact@causven.com. A dedicated DPO or privacy officer is not represented as appointed by this notice.
20. EEA and Romania
Because the current operator is established in Romania, the GDPR transparency framework is treated as the baseline for this notice rather than an optional regional add-on. The purposes, legal bases, recipient categories, retention criteria and rights described above are drafted to that baseline.
Where we rely on legitimate interests, you may object on grounds relating to your particular situation as provided by Article 21 GDPR. We will stop the relevant processing unless an applicable legal ground permits or requires it to continue.
21. United Kingdom
To the extent applicable under UK law, individuals in the United Kingdom receive the transparency and individual rights required by the UK GDPR and related legislation. Current ICO guidance is under review following legislative changes, so this section must be refreshed before any UK-specific commercial launch.
UK international-transfer wording will be added only after the actual transfer path and applicable UK mechanism are verified.
22. Switzerland
To the extent applicable under the Swiss Federal Act on Data Protection, we will provide the information needed to understand the collection and use of personal data and to exercise applicable rights. Any disclosure of foreign destination countries or safeguards must match the verified data path rather than an assumption.
23. Brazil
To the extent the Brazilian LGPD applies, individuals may exercise the rights and complaint mechanisms provided by that law, and international transfers must use a mechanism permitted by the LGPD and applicable ANPD rules. We do not claim a Brazil-specific transfer mechanism until the actual transfer and territorial scope are verified.
24. Canada
To the extent PIPEDA or applicable Canadian provincial privacy law applies, we will use identified and appropriate purposes, limit collection and retention, use safeguards, provide openness about our practices, and support applicable access/correction and complaint mechanisms. Coverage is assessed against the actual commercial activity and jurisdiction.
25. Australia
To the extent CAUSVEN is an APP entity or another Australian Privacy Act trigger applies, we will maintain the required APP privacy information and address applicable collection, access, correction, security and overseas-disclosure requirements. This notice does not assert APP-entity status without a factual applicability assessment.
26. United States state privacy laws
US state privacy rights are jurisdiction and threshold dependent. This notice does not assert that CAUSVEN is currently a covered business or controller under California, Colorado, Virginia or another state law without factual threshold evidence.
To the extent applicable, required state rights and controls may include notice at collection, access or knowledge, correction, deletion, portability, opt-outs, appeals, sensitive-data controls or universal opt-out mechanisms. If a threshold is met or processing changes, the required operational controls will be activated before the triggering processing is relied upon.
The audited build has no intentional personal-data sale and no targeted advertising; this statement is factual for the audited build and must be revalidated if the service changes.