Privacy policy

What this policy covers

This policy applies only to the eCTD marketing website and its demo request form. It does not cover the eCTD application (sign-in and dossier work). No separate privacy policy or data processing agreement has been published for the application.

For review: Before the application processes customer data, write and publish an application privacy policy and a data processing agreement for dossiers and user accounts.

Who is responsible

DEV387, Prvomajska 18, 71000 Sarajevo, Bosnia and Herzegovina, business identification number 4304442720006, provides this marketing website. For an enquiry sent through the form, DEV387 receives it and replies to it. Write to info@ectd.app.

DEV387 is also the service provider and the invoicing party for the eCTD product. This policy does not cover dossiers, accounts or files inside the application. No application privacy policy and no data processing agreement for that work have been published. Naming DEV387 here does not mean those documents exist.

For review: Counsel still needs to confirm whether “controller” is the right word for marketing enquiries, and whether a data protection officer is required. The full registered name, registration authority, registration number, VAT status and legal form are not published: an invoice does not prove them. Do not describe DEV387 as the controller of customer data in the application until the application privacy policy and data processing agreement exist.

What the form sends

The site does not write form details to a database. A valid submission is sent by email. That message contains:

• your name, email address and company name;
• organisation type (pharmaceutical company, regulatory consultant or other);
• your message, if you write one;
• the language of the page the form was sent from and the time it was received.

What is not sent

The hidden anti-bot field and the time taken to fill the form are not included in the email. If that field is filled in, or the form is submitted too quickly, the request is discarded and no message is sent.

Technical data

To limit how often the form can be sent, the server keeps the IP address supplied by the proxy, and a counter, in memory only (at most five submissions in 15 minutes). The application does not write that record to disk, does not put it in the email or the application log, and deletes it when the 15 minutes end or the process stops.

Application logs record only the outcome: accepted, discarded, or delivery failed, plus the page language and the provider's message id. They do not contain the form text or the IP address.

The site sets no cookies and uses no analytics or advertising tools. Fonts and images are served from the same server.

For review: Confirm whether Caddy or host system logs store IP addresses and for how long. This application does not control those logs, and they have not been checked, because the site is not deployed.

Why the data is used

The details are used to reply to the enquiry. The form asks you to agree that they will be used only for that. The submission limit exists to stop abuse of the form.

There is no campaign tooling and the details are not sold. Which legal basis and which statute apply has not been legally confirmed.

For review: Confirm the basis (consent from the form and/or legitimate interest for the rate limit), the current text of the Law on Personal Data Protection of Bosnia and Herzegovina, and whether the GDPR applies to visitors from the EU.

Who receives the data

The following is what is configured. A data processing agreement with these providers has not been checked, and this page does not claim that one is signed.

• Resend, Inc. (USA) sends the email. The ectd.app domain is configured to send from the EU (Ireland) region. The sender is website@ectd.app, the recipient is info@ectd.app, and the reply address is the email you entered.
• Cloudflare Email Routing (Cloudflare, Inc., USA) forwards mail for info@ectd.app to a mailbox that is not named here.

For review: Check the DPA and the basis for transfers to the USA for Resend and Cloudflare, and how long Resend keeps message content. State the country of the mailbox info@ is forwarded to. Hosting for this site is not in service, so no hosting provider is named.

How long data remains

No retention period has been adopted. Nothing deletes the mailbox message automatically; it stays until someone deletes it by hand. The in-memory per-IP counter lasts 15 minutes.

For review: Adopt a retention period and a deletion method before public launch. Do not write a number of months into this page until that decision exists.

Your rights

To ask for access, correction or deletion, or to withdraw the consent given in the form, write to info@ectd.app. No response deadline is published.

For review: Add a deadline and how the requester's identity is checked. Confirm whether a complaint goes to the Personal Data Protection Agency of Bosnia and Herzegovina and whether an EU authority is also competent.

Changes

This text will change when the processing changes or when legal review closes the open points. The draft date is at the top of the page.