Privacy notice

Who is responsible (controller): DutyAhead (operator details: see Legal notice). Contact for all privacy questions and requests: [email protected].

This site has no ads, no advertising or cross-site trackers, and sets no cookies. We use Cloudflare Web Analytics to count page views. It sets no cookies, stores nothing on your device and does not build visitor profiles, so we do not need a cookie banner.

Email alerts

If you subscribe, we store:

• your email address
• the routes you chose (optional)
• the page you signed up on
• the date and time you signed up and the date and time you confirmed
• the version of the consent text you agreed to (currently 2026-10-20-v2; we keep an archive of every version)
• your subscription status, a random code used for your confirm and unsubscribe links, and when we last sent you a confirmation email

We use this data only to send rule-change alerts for the routes you care about. We do not sell or share it, we do not add you to any other mailing list, and we do no profiling or automated decision-making. Only your email address is required; without it we cannot send alerts.

Confirmation (double opt-in): after you subscribe we send one email with a confirmation link. You receive alerts only after you click it. If you are already subscribed and ask for different routes, we email you a link, and nothing changes until you click it.

Legal basis

• Alerts: your consent (GDPR Art. 6(1)(a)). You can withdraw it at any time with the unsubscribe link in every email, or by writing to us. Withdrawal does not affect emails sent before it.
• Abuse prevention: to stop automated mass sign-ups, we keep a one-way hash of your IP address combined with the date (never the IP address itself), together with a request counter. Legal basis: our legitimate interest in keeping the sign-up form and your inbox free of abuse (Art. 6(1)(f)). These records are deleted automatically, normally within a day and at the latest within 7 days.
• Hosting and security logs: Cloudflare processes standard request data (such as IP address and browser type) to deliver the site and protect it from attacks. Legal basis: legitimate interest in running a secure website (Art. 6(1)(f)).

How long we keep it

• Unconfirmed sign-ups: deleted after 30 days.
• Confirmed subscribers: for as long as you stay subscribed.
• After you unsubscribe: we stop all emails at once and remove you from the Brevo list. We keep your address, your consent record and the unsubscribe date for up to 12 months, so we can show that we respected your choice. Then we delete them, including the contact record at Brevo. Ask us and we will delete everything straight away.
• Route-change requests that are not confirmed lapse after 7 days.
• Abuse-prevention hashes: at most 7 days (see above).

Who processes the data for us

• Cloudflare, Inc. (USA) hosts the site and the subscriber database. The database is stored in Cloudflare’s EU jurisdiction. Cloudflare acts as our processor under its Data Processing Addendum.
• Brevo (Sendinblue SAS, France) sends the emails. It receives your email address for each email we send and keeps the addresses of confirmed subscribers in a contact list. Brevo acts as our processor under the data processing agreement in its terms (see also its privacy policy).

Email tracking: Brevo records whether an email was delivered or bounced, because that is needed to send mail reliably. Opens and clicks are counted only anonymously and in aggregate. They are not linked to you or to any individual subscriber. We send every email with Brevo’s “no tracking consent” setting, and our Brevo account is set to anonymous tracking for all contacts. Links in our emails may still pass through Brevo’s redirect service before reaching the destination page. We do not use email data to profile you.

Transfers outside the EU

Cloudflare is a US company and may process data, such as security logs and support access, in the United States. Cloudflare is certified under the EU-U.S. Data Privacy Framework, which the European Commission recognises as providing adequate protection, and its Data Processing Addendum also includes the EU Standard Contractual Clauses. Brevo is based in the EU. Where its sub-processors are outside the EU, Brevo relies on safeguards such as Standard Contractual Clauses (see Brevo’s data processing agreement).

Your rights

Under the GDPR you have the right to:

• access the data we hold about you and get a copy;
• rectification of inaccurate data;
• erasure (“right to be forgotten”);
• restriction of processing;
• data portability (receive your data in a machine-readable format);
• object to processing based on our legitimate interests;
• withdraw consent at any time (one click in every email).

To use any of these rights, email [email protected] from the address concerned. We reply within one month.

Right to complain: you can lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work or where you think the problem happened. Our lead authority is the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Athens, Greece. UK residents can also contact the ICO.

Calculator

Everything is calculated in your browser. Nothing you enter is sent to us.

Hosting

The site is hosted on Cloudflare Pages. Cloudflare may process standard request logs for security and reliability (see Legal basis). Cloudflare also hides email addresses on the site from spam bots with a small script. That script sets no cookies.

Changes

If we change how we use your data, we will update this page and change the date below. If the change matters for alert subscribers, we will tell them by email first.

Last updated: 20 Oct 2026.