Privacy notice

This notice describes the public website at randilenplains.com. Randilen Plains is a trading name of EcoScience Limited. EcoScience Limited is the controller for the personal details this site collects.

Enquiry form

The site has no shop, no checkout and no subscription. A stay is arranged by enquiry. When you send the form, we receive only what you type:

• Name, if you give one
• Email address
• Phone number, if you give one
• Travel dates, or the months and approximate nights you are considering
• How many adults and children are travelling, and children’s ages if you give them
• Whether you are asking about the Lodge, the Bush Camp, or would like help choosing
• Interests you tick, and any message
• Your confirmation that we may use these details to reply

We use those details only to answer the enquiry and to discuss a possible stay. We do not add you to a mailing list, and the form has no newsletter option. Please do not put health information in the form. Information about your health needs your explicit consent (GDPR Article 9), and this form does not ask for that. A hidden field is there to catch automated spam. If it is filled in, the submission is dropped and nothing is emailed.

The website does not keep a database of enquiries. The server sends the message as an email through Resend to the reservations address configured for the site, with your email as the reply address. The email does not include your IP address. The email records that you consented, with the date and time and the version of this notice.

The form asks you to consent before it is sent. That consent is how we justify using the details to reply. You can withdraw it at any time (see Your rights). The rate-limit counter is separate, and is kept so the form cannot be flooded.

Rate limit and server logs

The enquiry address allows five attempts from the same connection, then pauses for 10 minutes. Every attempt that reaches this check counts, including an incomplete form and the hidden spam field, and each of those attempts starts the 10 minutes again. An attempt that is already over the limit does not extend the pause. The counter is stored under a pseudonymised hash of the IP address. The hash is an HMAC, truncated to 128 bits. It is not the raw address, and it is not anonymous. It lives in the server’s memory, or in a Cloudflare key-value store when a rate-limit secret is set. It is not a cookie, and it is not written into the email.

The site’s own access log records the request method, the path and the status code. It does not record IP addresses, form fields or email addresses. If the email service rejects a message, the log records the status code only, not the message body. Railway and Cloudflare probably keep their own connection logs, and those logs probably include IP addresses.

The editor at /admin keeps the raw IP address in memory to slow repeated sign-in attempts (about 15 minutes) and repeated saves (about one hour). The Node server drops an address about once a minute after that window has passed, and also on the next sign-in or save. That list is not written into an enquiry.

Cookies and tracking

The pages we publish do not set a cookie for visitors. A public production page loads Cloudflare Web Analytics, except the page shown when an address is not found. That beacon is cookieless: it does not set a cookie, and it does not receive a name, an email address, or anything typed into the enquiry form. The editor at /admin does not load it. There is no Hotjar, Microsoft Clarity, FullStory, Google Analytics, advertising pixel or session recording, so there is no consent banner. The host can still set its own cookie, for example Cloudflare’s __cf_bm.

The beacon is how we see which public pages are opened and how quickly they load. Cloudflare processes, for us, the page address, the referring address, the browser’s user agent, and the timings for that load. The request also carries the IP address. Cloudflare receives that address with the request, discards it at the nearest data centre, and does not store it in its core databases or logs (Cloudflare, RUM beacon for Web Analytics, https://developers.cloudflare.com/speed/observatory/rum-beacon/). The legal basis is legitimate interest (GDPR Article 6(1)(f)). Cloudflare is the data processor for this measurement.

Cloudflare keeps these figures so they can be viewed for the previous six months. It keeps the full beacon data, without sampling, for 7 days, and then keeps an aggregate of about a tenth of that volume (Cloudflare Web Analytics FAQ, https://developers.cloudflare.com/web-analytics/faq/, “What is the period of time I can access data in Web Analytics?” and “Is the data sampled?”). Cloudflare may handle this measurement in the United States. For that transfer it relies on the EU-US Data Privacy Framework and on the European Commission’s standard contractual clauses in its data processing addendum (Cloudflare, GDPR FAQs, https://www.cloudflare.com/trust-hub/gdpr/).

The editor at /admin does not set a cookie. The browser asks for the editor’s own username and password (HTTP Basic authentication) and may remember them until the window is closed. That password is not sent when someone only browses the public pages. If an older editor cookie named rp_admin is still stored, the editor deletes it.

A private preview of the site can ask the browser for a different username and password (HTTP Basic authentication) when a preview password is configured. That is not a cookie, it is not the editor password, and that password is not used on the public site. A browser may remember the password on its own.

WhatsApp, Instagram and other services

WhatsApp and Instagram on this site are ordinary links. The pages do not load a WhatsApp or Instagram script, font, map or video. Choosing WhatsApp opens wa.me in a new tab, with a short prefilled message. If you send it, Randilen Plains receives your phone number and the message in WhatsApp. This website does not store a copy of that chat. Choosing Instagram opens instagram.com under that service’s own terms.

Typefaces are files on this site (Bodoni Moda and Hanken Grotesk). The map is a drawing in the page, not an external map. Photographs are part of this site. There is no embedded YouTube or Vimeo player, and no font is loaded from Google. The only script from another network is the cookieless Cloudflare Web Analytics beacon on public pages, other than the page for an address that is not found.

Who processes the details

Resend sends the enquiry email. It receives the form fields listed above when you submit, and only then.

Railway hosts the public site and runs the enquiry request. The same files can be hosted on Cloudflare Pages. If that path is the one serving you, Cloudflare handles the request as well. The editor runs on the Railway server, not on Cloudflare Pages.

Cloudflare processes the Web Analytics measurement described above, as data processor. A transfer of that measurement to the United States is made under the EU-US Data Privacy Framework and the standard contractual clauses. Resend and Railway may also handle enquiry details outside the European Economic Area, including in the United States.

Your rights

Where the GDPR or Norwegian privacy law applies, you can ask to see the details we hold, to correct or delete them, to restrict or object to their use, and to receive a copy in a portable form where that right applies. You can complain to Datatilsynet where Norwegian law applies, to the Personal Data Protection Commission where Tanzanian data protection law applies, or to the supervisory authority where you live.

You can withdraw the consent you gave on the form at any time. Withdrawal does not undo a message we have already sent. Write to the privacy contact and we will not use the details any further.

Because this site does not keep its own database, a request is handled from the reservations inbox and from any copy Resend or the host still has.

Write to the privacy contact: res@randilenplains.com