[DRAFT - CLIENT LEGAL REVIEW REQUIRED]
This page is a structure, not a finished legal document. URU Forge is publishing the section order and what each section must establish, so the shape can be reviewed. The operative wording is written by the site owner and their counsel before launch, and this notice is removed at that point.
Nothing on this page is a commitment, and no sentence here should be relied on until counsel has signed it off.
Who we are
What this policy covers
Must set the scope: this website and the inquiries made through it. Where client engagement data is handled under a separate data-processing agreement, that has to be said plainly here, because a reader assumes one document covers everything.
What personal data we collect
Must be an exhaustive list, split by source. The forms are the only deliberate collection point on this site, and their fields are already enumerated in microcopy.md §7.3-§7.8. From the site itself: server logs, consent state, and analytics if and only if the visitor has accepted it (see the cookie policy).
Why we use it, and on what basis
Must pair each purpose with its lawful basis. Purposes are narrow here: replying to an inquiry, arranging a call, processing a job application, sending the ROI model when requested, and the newsletter where separately opted into. Counsel to determine the correct basis for each; A6 must not assert one.
How long we keep it
Who processes it on our behalf
Your rights
Must list the rights available under the applicable regime and say how to exercise them, with a real response time. Counsel writes this. A6 does not draft rights language.
Security
Must describe the measures actually in place, at a level that is true. The architectural controls we describe publicly are on the trust page, and this section must not claim more than that page does. No certification is claimed anywhere on this site.
Cookies
One paragraph and a link to the cookie policy, which is the operative document. Do not duplicate the cookie table here; two copies drift.
Children
Must state that the site is not directed at children and that we do not knowingly collect their data, with the age threshold set by the applicable regime.
Changes to this policy
Must say how changes are notified and that the last-updated date at the top is authoritative.