Privacy policy

tefer.io is operated by Tefer Consolidate PLC, which trades as Tefer. We are a software development and outsourcing studio. We decide what this site collects and why, which makes us the controller of the personal data described below.

Legal entity

Tefer Consolidate PLC

Trading name

Tefer, tefer.io

Registered address

Elsadol Building Suite 806, Mikeyleland Street, Addis Ababa, Ethiopia

Email

hello@tefer.io

Phone

+251989-77-77-70

Anything to do with your personal data goes to hello@tefer.io: access, correction, deletion, a complaint, or a question about a line in this document.

We collect what you type into one of five forms, plus a small amount of technical data that arrives with every web request, plus the campaign tags on the address you arrive at if you came from one of our adverts. There is nothing else. We do not buy data about you, we do not enrich what you give us from other sources, and we do not build profiles.

The contact form

Used when you send an enquiry from the contact section of the site. Stored in a database collection called leads.

• Your name.
• Your email address.
• Your company, if you fill it in. This field is optional.
• Which service you are interested in: product engineering, dedicated team, staff augmentation, MVP development, or not sure yet.
• A budget range, if you pick one. This field is optional and includes a prefer-not-to-say option.
• Your message.
• Alongside those: the time of submission, the label tefer.io as the source, a status we use to track follow-up, the address of the page you submitted from, and the browser identification string (user-agent) your browser sends.

The call booking form

Used when you ask for an introductory call. Stored in a collection called bookings.

• Your name.
• Your email address.
• Your phone number.
• The date you asked for and the half-hour slot you picked.
• The timezone your browser reports, for example Africa/Addis_Ababa, so that we propose a time in your own clock rather than ours.
• If you reached us from an advert or a tagged link: the campaign tags on the address you arrived at (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the advertising platform's own identifier for the click when one is present, for example fbclid from Meta or gclid from Google, the page you landed on, and the site that linked you. This is kept in your browser's own storage from the moment you arrive and sent with the form, so that we know which advert produced the call. We do not use it to build a profile of you and we do not share it.
• Alongside those: the time of submission, the source, a status that starts at requested, the referring page address, and the user-agent string.

Event registration

Used when you register for one of our events. Stored in a collection called registrations. Read section 04 before you register: these are the only records we may share with other organisations.

• Which event you are registering for.
• Your name.
• Your email address.
• Your phone number.
• Your company name.
• Your company sector, picked from a list.
• Whether you plan to attend in person or by livestream, or that you are on the waitlist because the room is full, and in that case whether you told us you would also join the livestream.
• Whether the newsletter box was ticked when you submitted.
• Alongside those: the time of submission, the source, a status that starts at registered, the referring page address, and the user-agent string.

The future-events signup

Shown in place of the registration form once a session is full, when you ask to hear about the next one. It creates a record in a collection called event-notifications. It holds your email address in lower case, your name, your company if you filled it in, which page you signed up from, whether you also ticked the newsletter box, your subscription status, and when the record was created and last updated. The record is keyed on your email address, so signing up twice updates one record instead of creating a duplicate.

The newsletter opt-in

Ticking the newsletter box on a form also creates a subscriber record in a collection called newsletter. It holds your email address in lower case, your name, your company, whether you are subscribed, where the opt-in came from, and when the record was last updated. The record is keyed on your email address, so opting in twice updates one record instead of creating a duplicate.

Technical data

• Your IP address, read from the request headers when you submit a form. We use it to count submissions per address, at most five in any ten minutes, and the counter is held in the server's memory only. The IP address itself is not written to the database with your submission.
• The referring page address and the browser user-agent string, stored with each submission. They help us tell a genuine enquiry from a scripted one and see which page a question came from.
• Every form carries a hidden field that a person never sees. If it comes back filled in, we treat the submission as automated: it is discarded and nothing is stored.
• Our hosting provider keeps ordinary server logs, which normally record IP addresses, requested pages and timestamps. Those logs belong to the provider and are kept on their schedule, not ours.
• A decorative background video on the home page is served from a content delivery network, and the event page embeds a map. Loading either means your browser requests a file from that provider directly, so it sees your IP address. See section 11.

What we do not collect

We do not ask for identity documents, payment card details, or special category data such as health, religion, politics or biometrics, and we have no field for any of it. Please do not put that sort of information into a message box. If you do, we will delete it.

Each thing we collect has one purpose, and we do not reuse it for another one without asking you.

Replying to an enquiry

You asked us to. Sending a reply is the step you requested, and we have a clear interest in answering people who contact us.

Scheduling a call

To confirm a time that works in your timezone and to send you the details. Your phone number is there in case the email bounces or the call drops.

Running an event

To check you in, count seats against venue capacity, send joining links for the livestream, and follow up with materials and the recording.

Sending the newsletter

Your consent, given by leaving the newsletter box ticked when you submit a form. You can withdraw it at any time and we stop.

Blocking automated submissions

Our interest in keeping the forms usable and the database free of junk. This is the rate-limit counter and the hidden field described above.

As a company registered in Ethiopia, Ethiopian data protection rules apply to us. Where a law with a formal list of legal bases applies to you, for example if you are in the European Economic Area or the United Kingdom, read the right-hand column above as our statement of the basis we rely on: consent for the newsletter, and the performance of a step you requested or our legitimate interest for everything else.

Who the partners can be

• Co-hosts and programme partners who run the session with us.
• Sponsors of that specific event.
• The venue operator or building management, where they need an attendance list for access or safety.
• Livestream, webinar and registration platform providers we use to deliver the session.

What we share

Only the registration details, and only these: your name, email address, phone number, company name, company sector, and attendance mode (in person or livestream). Nothing else from your registration goes to a partner.

Contact form enquiries and call bookings are separate records and are never shared with event partners. That means your message, your budget range and your call details stay with us.

Why we share it

• Attendee check-in at the door.
• Capacity and venue management: seat counts, access lists, catering numbers, safety requirements.
• Provisioning livestream or webinar access and sending you the joining link.
• Event-related follow-up: session materials, the recording, and a note about what comes next.

The limits we put on partners

• They may use the details only for that event and the follow-up listed above.
• They may not add you to their own unrelated marketing lists.
• They may not pass your details on to anyone else.
• We share the shortest list that does the job, and only with partners involved in the event you registered for.

How to object

Email hello@tefer.io before the event, tell us which event, and say you do not want your details passed to partners. We will keep you off the shared list and confirm it. If a list has already gone out, we will tell you which partner has your details and ask them to delete your entry.

Events may also be recorded, streamed and photographed, and attendees can appear in that material. That is set out in section 04 of the terms and conditions.

The only route onto our list is the newsletter checkbox on a form. We do not add people because they sent an enquiry, booked a call or walked into an event.

What we send: occasional notes on what we are building, invitations to our own events, and the odd write-up of a session. We do not carry other companies' advertising, and we do not sell, rent or swap the list.

How to unsubscribe

• Use the unsubscribe link at the bottom of any newsletter email.
• Or email hello@tefer.io with the word unsubscribe. A person will take you off the list by hand.

When you unsubscribe we mark the record as unsubscribed rather than deleting it, so that a later form submission does not quietly add you back. Ask us to delete it outright and we will.

Replies to your enquiry, call confirmations and event logistics emails are not marketing. Unsubscribing from the newsletter does not stop us answering a question you asked us.

Google

Every record described in section 02 is stored in Google Cloud Firestore. Google acts as our sub-processor: it holds the data on our instructions and its own terms govern how it runs the service.

Our hosting provider

Serves the pages, runs the code that handles form submissions, and keeps ordinary server logs.

Our email provider

Carries our replies to you, event emails and the newsletter, which means it processes your email address and the contents of those messages.

Event organising partners

Event registration details only, on the terms set out in section 04.

Advisers and authorities

Only where the law requires it, or where we need to establish or defend a legal claim.

We do not sell personal data. Apart from the measurement tags described in section 11, we do not share it with anyone for advertising.

Where the data sits

Firestore, our hosting and our email are all run by companies based outside Ethiopia, on servers outside Ethiopia. Submitting a form on this site means your data will be stored and processed outside Ethiopia, and outside your own country if you are somewhere else again. We use established providers and rely on the transfer terms they publish for their services.

Contact enquiries

24 months from our last contact with you, then deleted. If we are still talking, the clock restarts each time.

Call bookings

24 months from the call, or from our last contact about it.

Event registrations

12 months after the event, then deleted. What we keep for our own records after that is counts and totals, not your details.

Future-events signups

Until you ask us to stop. We then mark the record unsubscribed rather than deleting it, so you are not added back by a later signup, and we delete it outright if you ask us to.

Newsletter

Until you unsubscribe. After that we keep the email address marked as unsubscribed so we do not add you back, unless you ask us to delete it.

Rate-limit counters

Minutes. They live in the server's memory and disappear as the ten-minute window passes or when the server restarts.

Server logs

Kept by our hosting provider on their own schedule, normally weeks rather than years.

We may keep a record longer where we have to, for example an unresolved dispute or an accounting requirement. Ask us and we will tell you what we still hold and why.

• Every submission is checked on the server against a strict schema before anything is written. Fields that are not in the schema are dropped, and lengths and formats are enforced.
• Database credentials live in environment variables on the server. They are not in the code and not in the repository.
• The dashboard where our team reads submissions is private, behind an email and password sign-in, and the session is carried by a signed token that expires after seven days.
• Forms are rate limited per IP address and carry a hidden honeypot field, which together stop most automated submissions before they reach the database.
• The site is served over HTTPS, so what you type is encrypted on its way to us.
• Access to the stored records is limited to the people at Tefer who need it to reply to you or run an event.

No website can promise perfect security. If we find a breach that puts you at risk, we will tell the people affected and the relevant authority without unnecessary delay, and we will say plainly what happened.

Whatever your country, you can ask us for all of the following. We do not make you prove a legal entitlement first.

Access

A copy of what we hold about you, and where it came from.

Correction

Fix anything wrong or out of date.

Deletion

Delete your records. We will do it unless we have to keep something, and then we will tell you what and why.

Objection

Object to a particular use, including the sharing of event registration details with event partners described in section 04.

Withdrawing consent

Withdraw your newsletter consent at any time. Withdrawing it does not undo emails already sent.

Portability

A copy in a common machine-readable format, such as JSON or CSV.

Send requests to hello@tefer.io. We answer within 30 days. If a request is complicated we will say so inside those 30 days and give you a date. We do not charge for any of this. We may ask you to write from the email address the data was submitted with, so that we do not hand your data to someone else.

If you are unhappy with how we handled a request, tell us and we will look at it again. You can also complain to the data protection authority in your country.

This site is aimed at founders, operators and companies. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. Our events are for adults.

If you believe someone under 18 has submitted a form here, email hello@tefer.io and we will delete the record.

This site sets two cookies of its own.

tefer_region

Set for every visitor. Records one word: consent if your connection appears to come from the European Union, the rest of the European Economic Area, the United Kingdom or Switzerland, and default if it appears to come from anywhere else. The site reads it to decide whether to ask before measurement loads, as described below. It holds no identifier, is not sent to anyone else, and expires after one day.

tefer_admin_session

Strictly necessary. Set only when a member of the Tefer team signs in to the private admin dashboard. It carries a signed, expiring session token, is marked httpOnly so scripts cannot read it, and lasts seven days. An ordinary visitor never receives it.

Neither identifies you as a visitor, and neither is used for measurement or advertising.

Separately from cookies, and separately from everything below, this site keeps the campaign tags from your arriving address in your browser's own storage, so that a call you book a few pages later can still be matched to the advert that brought you. It stays in your browser, it is read only when you submit the booking form, and it is cleared along with the rest of this site's site data. It is not an identifier, it says nothing about you, and it is described in section 02.

Measurement and advertising

We use the Meta Pixel, and the other tags listed below when we have them switched on, to measure which pages lead to someone booking a call. Whether they load straight away depends on where you are:

• In the European Union, the rest of the European Economic Area (Iceland, Liechtenstein and Norway), the United Kingdom and Switzerland, we ask for your consent first. None of these scripts is fetched until you press Accept, and if you press No thanks they are never fetched, so there is nothing to switch off afterwards.
• Everywhere else they load when you arrive, and you can turn them off at any time with the Your privacy choices link at the foot of every page. Once you do, they stop loading in that browser.
• Wherever you are, if your browser sends a Global Privacy Control signal we honour it as a refusal, and none of these scripts loads, whatever else you have chosen.

We tell the two groups apart by the country your connection appears to come from, which our hosting provider works out from your IP address when the page is requested. If it cannot tell, we treat you as being in the first group and ask. Declining or turning the tags off changes nothing about what you can read or do here.

Meta Pixel

Meta Platforms. Records that a page was viewed, that a booking button was pressed and that a call was booked, so we can measure and target advertising on Facebook and Instagram. Sets its own cookies and can match the visit to a Meta account if you have one.

Google Analytics 4

Google. Aggregate traffic reporting: which pages are read, roughly where visitors are, which of them go on to book. Sets its own cookies and assigns a random identifier to your browser.

LinkedIn Insight Tag

LinkedIn. Reports which company-side audiences reach us and which of them book, for advertising on LinkedIn. Sets its own cookies and can match the visit to a LinkedIn account if you have one.

Not all three are necessarily running at any given time; we turn on what we are actually using. What we send them is the page you were on, which booking button you pressed if you pressed one, and, when it happens, the fact that a call was booked. We do not send them your name, email or phone number.

You can change your answer at any time, in either group, with Your privacy choices. Your choice is stored in your browser's local storage, not in a cookie, so the record of the decision is not itself something you have to be asked about. Clearing your site data for tefer.io resets it: in the first group you will be asked again, and elsewhere the tags will load again until you turn them off.

These tags are how we find out that advertising works, and each of these companies uses what it receives for its own purposes as well as ours. That is why we ask first where the law expects it, and make turning them off a single click everywhere else.

Our web fonts are served from our own domain, so opening a page does not call a font provider.

Embedded and hosted content

Two parts of the site do reach out to other companies when they load, and those requests are covered by the provider's privacy policy rather than this one:

• The event page embeds a Google map so you can find the venue. The map is loaded by Google, which sees the request and can set its own cookies or browser storage once it does.
• The decorative background video on the home page is fetched from a content delivery network, which receives your IP address as part of serving the file.

If we add another measurement or advertising provider, we will list it here, and where we ask first we will ask you again before it loads, rather than folding it into an answer you gave about a shorter list.

If we change what we collect, why we collect it, or who else sees it, we will update this page and change the date at the top. The version on this page is the one that applies.

Where a change materially affects data you have already given us, and we have your email address, we will tell you by email rather than leave you to notice.

Your use of the site is also covered by our terms and conditions.