Independent resource on real-time embedded systems · FRESCOR project archive 2006–2009

Privacy Policy

On this page

    This Privacy Policy explains how FRESCOR.org collects, uses, stores and protects personal data when you visit frescor.org, contact us, or buy one of our services or digital products. We have written it in plain English and tried to be specific about what actually happens on this website. If anything is unclear, contact us at support@frescor.org.

    Last updated: October 19, 2026

    Key takeaways

    • We collect only what we need to answer your messages, fulfill your orders, keep the site secure and remember your cookie choices.
    • We do not run a newsletter, we do not sell personal data, and we do not share it for cross-context behavioral advertising.
    • You can ask to access, correct, delete or export your data at any time by e-mailing support@frescor.org.
    • We honor Global Privacy Control signals and never make decisions about you by purely automated means.

    Summary table

    Activity Personal data involved Why we use it Legal basis (GDPR / UK GDPR)
    Contact form Name, e-mail address, company (optional), subject, message To read and reply to your inquiry Legitimate interests, Art. 6(1)(f); or steps before a contract, Art. 6(1)(b)
    Orders and customer accounts Billing details, order history, account login details, communications about the order To process orders, deliver services and downloads, provide support, keep accounting records Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c)
    Security and server logs IP address, browser user agent, requested URLs, timestamps, login attempts To keep the site available and protect it against attacks and abuse Legitimate interests, Art. 6(1)(f)
    Cookie consent Consent choices, consent ID, date and time of consent To remember and prove your cookie preferences Legal obligation, Art. 6(1)(c)
    Optional cookies (if you accept them) Cookie identifiers and usage data, as described in the Cookie Policy Only the purposes you agree to Consent, Art. 6(1)(a)
    Comments (where enabled) Name, e-mail address, comment text, IP address To publish and moderate comments Consent, Art. 6(1)(a); legitimate interests, Art. 6(1)(f)

    1. Who we are

    frescor.org is an independent knowledge resource about real-time embedded systems, contract-based scheduling, timing analysis and related topics. It also preserves archive material from the historical FRESCOR research project. The current website is operated by FRESCOR.org, which is the data controller for the personal data described in this policy. That means we decide why and how your personal data is processed and we are responsible for it.

    The current website is not operated by the original FRESCOR consortium, its partner organizations or the European Commission, and none of them is responsible for the processing described here. See our Disclaimer for details.

    You can reach us at:

    We have not appointed a Data Protection Officer because we are not required to do so. Privacy questions are handled directly by the operator using the contact details above.

    2. Personal data we collect

    We collect personal data in three ways: when you give it to us, automatically when you use the website, and occasionally from service providers involved in completing your order (for example, a payment provider confirming that a payment succeeded).

    2.1 Contact form

    Our contact page uses the Contact Form 7 plugin. When you submit the form we receive:

    • your name;
    • your e-mail address;
    • your company or organization name, if you choose to provide it (this field is optional);
    • the subject of your message; and
    • the content of your message, including anything you choose to include in it.

    The form sends your message to us by e-mail. Please do not include sensitive information (such as health data) or confidential technical material in the form. If a project requires confidential information to be shared, we will agree a suitable method with you first.

    2.2 Orders and customer accounts

    Our services and digital products are sold through WooCommerce. When you place an order or create a customer account, we collect:

    • Billing details: name, company name (optional), billing address, country, e-mail address, phone number (if requested at checkout) and, where relevant, a VAT or tax identification number;
    • Order details: the products or services ordered, prices, taxes, discounts, order status, download history for digital products and notes you add to the order;
    • Account details: username, e-mail address and a password, which is stored only in hashed form so we cannot read it;
    • Communications about quotes, scopes of work, deliverables and support.

    We do not receive or store your full card number or other complete payment credentials. Payments are handled by the payment provider you select at checkout, which may send us limited information such as a transaction ID, payment status and the last digits of a card for reference.

    2.3 No newsletter

    We do not currently offer a newsletter or marketing mailing list, and we do not send marketing e-mails. If we introduce a newsletter in the future, it will be strictly opt-in and we will update this policy before launching it.

    2.4 Server logs and IP addresses

    Like almost every website, our web server and hosting provider automatically record technical information when your browser requests a page. This typically includes your IP address, the date and time of the request, the page or file requested, the HTTP status code, the referring page, and your browser’s user agent string. These logs are used for security, troubleshooting and keeping the site running reliably.

    2.5 Security plugin (Wordfence)

    We use the Wordfence security plugin to protect the site against malicious traffic, brute-force login attempts and known vulnerabilities. To do this, Wordfence logs IP addresses, user agents, requested URLs, login attempts (including usernames tried) and related timestamps. Some of this information may be sent to servers operated by Defiant, Inc., the company behind Wordfence, for example to check IP addresses against threat intelligence lists, to receive firewall rules and malware signatures, and to verify the plugin’s license. Defiant is based in the United States. More information is available in the Wordfence privacy policy.

    2.6 Cookie consent (CookieYes)

    We use CookieYes to display our cookie banner and manage your choices. CookieYes stores a cookie in your browser recording which categories of cookies you accepted or rejected, along with a consent identifier and the date of your choice. A record of the consent may also be kept so we can demonstrate compliance. Full details of the cookies used on this site are in our Cookie Policy.

    2.7 Comments

    Comments are generally not enabled on this site. Where comments are enabled on a particular page, we collect the name, e-mail address and website (optional) you enter, the comment itself, and your IP address and browser user agent to help detect spam. Your e-mail address is never published. Comments may be held for moderation before they appear.

    2.8 Yoast SEO

    We use the Yoast SEO plugin to manage page titles, descriptions, sitemaps and structured data. Yoast SEO does not collect personal data from visitors to the site.

    2.9 The schedulability calculator

    Our schedulability calculator runs in your browser. The task parameters you enter are used to compute results on your device and are not sent to us or stored on our servers.

    If you are in the European Economic Area (EEA) or the United Kingdom, the GDPR and UK GDPR require us to have a legal basis for each processing activity. We rely on the following:

    • Consent, Art. 6(1)(a): for optional cookies and similar technologies, and for publishing comments where enabled. You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
    • Contract, Art. 6(1)(b): to prepare quotes at your request, process your orders, provide the services you buy, deliver digital downloads, manage your customer account and provide support.
    • Legal obligation, Art. 6(1)(c): to keep invoices and accounting records required by tax and commercial law, to record cookie consent, and to respond to lawful requests from authorities.
    • Legitimate interests, Art. 6(1)(f): to answer general inquiries, to keep the website secure and available, to prevent fraud and abuse, and to establish, exercise or defend legal claims. We have balanced these interests against your rights and believe the processing is proportionate and expected. You have the right to object to processing based on legitimate interests (see Section 9).

    4. How we use your personal data

    We use personal data only for the following purposes:

    1. Responding to questions, quote requests and other messages you send us.
    2. Preparing quotes, agreeing scopes of work and statements of work, and delivering consulting, analysis and training services.
    3. Processing payments, issuing invoices and delivering digital products such as eBooks.
    4. Providing customer support and managing your account.
    5. Protecting the website, our customers and ourselves against security threats, fraud and abuse.
    6. Meeting legal, tax and accounting obligations.
    7. Remembering your cookie preferences and, where you have consented, any other purpose described in the Cookie Policy.
    8. Establishing, exercising or defending legal claims.

    We do not use your personal data for profiling, targeted advertising or any purpose that is incompatible with the purposes above.

    5. How long we keep your data

    We keep personal data only for as long as necessary for the purposes it was collected for, then delete or anonymize it. The table below shows our standard retention periods. Longer periods may apply where required by law or to deal with an ongoing dispute.

    Data Retention period
    Contact form messages and related e-mail correspondence (no order placed) Up to 24 months after our last exchange
    Order records, invoices and accounting data As long as required by applicable tax and commercial law, typically up to 10 years after the end of the financial year
    Project correspondence and deliverables for services Up to 6 years after the project ends, to handle support, warranty and legal claims, unless a contract specifies otherwise
    Customer account Until you ask us to delete it, or after 3 years of inactivity; order records are then kept as described above
    Digital product download logs For the life of the order record
    Web server logs Up to 30 days, unless needed to investigate a specific security incident
    Wordfence security logs Up to 30 days for live traffic data; blocked IP records for as long as the block is active
    Cookie consent records Up to 12 months, after which you will be asked again
    Published comments (where enabled) Until the comment is removed by you (on request) or by us

    6. Who we share data with

    We do not sell personal data. We share it only with service providers (processors) who help us run the website and business, and only to the extent they need it. They process data on our instructions under written agreements that include appropriate data protection terms.

    Recipient What they do Data involved
    Hosting provider Hosts the website, database and server logs; provides backups All data stored on the website, including form submissions, orders and logs
    Payment providers selected at checkout Process payments and help prevent fraud Billing details, order amount, payment information you provide directly to them
    E-mail delivery provider Delivers transactional e-mails (order confirmations, download links, password resets) and contact form notifications Name, e-mail address, message or order content
    Defiant, Inc. (Wordfence) Firewall rules, threat intelligence and brute-force protection IP addresses and related security data
    CookieYes Cookie consent management Consent choices, consent ID, anonymized or truncated IP address where applicable

    Payment providers such as card processors or online payment services may act as independent controllers for some of their processing, for example for fraud prevention and regulatory compliance. Their own privacy policies apply to that processing, and you will be able to review them when you choose them at checkout.

    We may also disclose personal data to professional advisers (such as accountants and lawyers) under a duty of confidentiality, to public authorities where required by law, or to a successor organization if the website or business is transferred, in which case this policy will continue to protect your data.

    7. International data transfers

    Some of our service providers, including Defiant, Inc. (Wordfence) and some payment and e-mail providers, are located or store data outside the EEA and the UK, in particular in the United States. Where personal data is transferred to a country that does not have an adequacy decision from the European Commission or the UK government, we rely on appropriate safeguards, mainly the European Commission’s Standard Contractual Clauses (SCCs) and, for UK data, the UK International Data Transfer Addendum. Where a US recipient is certified under the EU-U.S. Data Privacy Framework (and its UK Extension), we may rely on that certification instead. You can request a copy of the relevant safeguards by contacting support@frescor.org.

    8. How we protect your data

    We use technical and organizational measures appropriate to the risk, including:

    • encryption of all traffic between your browser and the site using HTTPS (TLS);
    • a web application firewall, login rate limiting and brute-force protection;
    • hashed storage of account passwords;
    • keeping WordPress, themes and plugins up to date and removing unused components;
    • strong, unique credentials and two-factor authentication for administrative access;
    • restricting access to personal data to people who need it;
    • regular backups stored securely by our hosting provider.

    No method of transmission or storage is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, you, in line with applicable law.

    9. Your rights

    Depending on where you live, you have some or all of the following rights over your personal data:

    • Access: obtain confirmation of whether we process your data and a copy of it.
    • Rectification: have inaccurate or incomplete data corrected.
    • Erasure: have your data deleted where there is no longer a valid reason to keep it.
    • Restriction: ask us to limit processing while a complaint or correction is being resolved.
    • Data portability: receive data you gave us in a structured, commonly used, machine-readable format, or have it sent to another controller, where processing is based on consent or contract and carried out by automated means.
    • Objection: object at any time to processing based on our legitimate interests. We will stop unless we have compelling legitimate grounds or need the data for legal claims.
    • Withdraw consent: withdraw any consent you have given, for example through the cookie settings link in the site footer.

    How to exercise your rights

    Send your request to support@frescor.org, ideally with the subject line “Privacy request”. Please tell us which right you want to exercise and give enough information for us to find your data, such as the e-mail address you used. If you have a customer account, you can also view and update most of your details yourself under “My account”.

    We will respond within one month of receiving your request. This can be extended by up to two further months for complex or numerous requests, in which case we will tell you why. We may ask for reasonable proof of identity before acting on a request, to protect your data from being disclosed to someone else. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.

    Some data cannot be deleted immediately, for example invoices we are legally required to keep. In that case we will explain what we must retain and why, and restrict its use to that purpose.

    10. Complaints to a supervisory authority

    If you are unhappy with how we handle your personal data, please contact us first so we can try to resolve the issue. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU or EEA country where you live, work or where the alleged infringement took place. A list of EU and EEA authorities is available from the European Data Protection Board. In the UK, you can complain to the Information Commissioner’s Office (ICO). California residents may contact the California Privacy Protection Agency or the California Attorney General.

    11. Children

    This website and our services are intended for professionals, students and adults with an interest in embedded systems. They are not directed at children under 16, and we do not knowingly collect personal data from children under 16. Orders may only be placed by adults with legal capacity to enter into contracts. If you believe a child has provided us with personal data, contact us and we will delete it.

    12. Automated decision-making

    We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you. Automated security tools such as the Wordfence firewall may temporarily block an IP address that behaves like an attacker. If you believe you have been blocked in error, contact us and a person will review the block.

    13. Do Not Track and Global Privacy Control

    Global Privacy Control (GPC): we treat a GPC signal sent by your browser as a valid request to opt out of the sale or sharing of personal data and of optional (non-essential) cookies for that browser. As described below, we do not sell or share personal data in any case, but we still honor the signal.

    Do Not Track (DNT): there is no common industry standard for how websites should respond to DNT signals. Because we do not track visitors across third-party websites, our practices are the same whether or not your browser sends DNT.

    14. Notice for California residents (CCPA/CPRA)

    This section applies to California residents and supplements the rest of this policy. It describes our practices under the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, “CCPA”), to the extent the CCPA applies to us.

    Categories of personal information collected in the last 12 months

    CCPA category Examples Collected? Disclosed for a business purpose to
    Identifiers Name, e-mail address, postal address, IP address, account username Yes Hosting, payment, e-mail delivery and security providers
    Customer records (Cal. Civ. Code §1798.80(e)) Billing name, address, phone number, limited payment information Yes Hosting and payment providers
    Commercial information Products and services purchased, order history Yes Hosting and payment providers
    Internet or other electronic network activity Server and security logs, pages requested, browser type, cookie consent choices Yes Hosting, security and consent management providers
    Professional or employment-related information Company name you provide in a form or at checkout Yes, if provided Hosting and e-mail delivery providers
    Sensitive personal information Account login credentials (username and password) Yes, only to provide your account Hosting provider
    Biometric, geolocation (precise), protected characteristics, inferences — No —

    Sources: directly from you; automatically from your browser or device; and from payment providers involved in your order. Purposes: those described in Section 4. Retention: as described in Section 5. We use sensitive personal information only for purposes permitted by the CCPA, such as providing your account, and not to infer characteristics about you.

    We do not sell or share personal information

    We do not sell personal information and we do not share it for cross-context behavioral advertising, as those terms are defined in the CCPA. We have not done so in the preceding 12 months, and we have no actual knowledge of selling or sharing personal information of consumers under 16.

    Your California rights

    California residents have the right to know what personal information we collect, use and disclose; to access a copy of it; to correct inaccurate information; to delete it, subject to legal exceptions; to opt out of sale or sharing (which we do not do); to limit the use of sensitive personal information (which we use only for permitted purposes); and not to be discriminated against for exercising any of these rights. To make a request, e-mail support@frescor.org. We will verify your request by matching information you provide with information we hold. You may use an authorized agent; we may ask the agent for proof of authorization and ask you to verify your identity directly.

    15. Changes to this policy

    We may update this Privacy Policy when our practices, the plugins and services we use, or the law change. The “Last updated” date at the top shows when the policy was last revised. If we make significant changes, for example introducing a new category of processing, we will highlight them on the website and, where we have your contact details and the change affects you directly, notify you by e-mail.

    16. Contact us

    For any question about this policy or how we handle your personal data, or to exercise your rights, contact:

    Related pages: Cookie Policy, Terms and Conditions, Refund Policy.

    ^ Top