Gizlilik bildirimi

1. Who handles your information

Sumeria is an independent B2B sourcing and coordination initiative facilitating introductions between prospective U.S. seasonal employers and international Work and Travel agencies. For privacy inquiries, data subject requests, or questions about how we handle business contact records, email [email protected].

2. B2B information we collect

When you submit an inquiry on behalf of an agency or U.S. business, we collect:

• Business contact details: Your name, work email address, organization name, country or U.S. worksite location, and optional organization website.
• Inquiry context: Proposed seasonal roles, approximate staffing or student volume, and the message you choose to provide.
• Technical & campaign metadata: Submission timestamp, page path, UTM campaign parameters (if present) and a client-generated idempotency identifier to prevent duplicate submissions.

Prohibited sensitive data: Our forms are strictly for B2B partnership inquiries. Do not submit student passport scans, Form DS-2019 copies, visa records, Social Security numbers, government ID numbers, or financial/payment information. Any inadvertently submitted sensitive student documents are deleted upon discovery.

3. Purpose and legal basis for processing

We process B2B inquiry information solely to:

• Review and respond to your partnership or seasonal staffing inquiry (consent under GDPR Art. 6(1)(a) and pre-contractual/legitimate business interest under GDPR Art. 6(1)(b) and 6(1)(f)).
• Maintain an accurate record of prior B2B correspondence and prevent duplicate outreach.
• Protect the website and submission endpoints against automated spam, abuse and denial-of-service attacks (legitimate interest in network and information security).

We do not sell, rent or share your personal or business contact information for third-party cross-context behavioral advertising (including under the California Consumer Privacy Act / CPRA).

4. Edge security, Turnstile verification & IP hashing

To protect our forms from automated abuse without invasive tracking, we use Cloudflare Turnstile challenges and server-side rate limiting. We do not store raw client IP addresses in our lead database. Instead, our edge function computes a SHA-256 hash of the network address combined with a 10-minute time window to limit repeated submissions. A scheduled cleanup removes expired rate-limit records.

5. Subprocessors & international data transfers

Inquiry submissions are processed through the following infrastructure providers:

• Cloudflare, Inc. (Cloudflare Pages, Workers, D1 database and Turnstile verification) for edge hosting, bot mitigation and encrypted database persistence.
• Telegram Messenger Inc. for real-time operational notification delivery of inquiry summaries to the Sumeria coordination team.

Because Sumeria coordinates cross-border introductions between international agencies and U.S. seasonal employers, your inquiry data may be processed in the United States and other jurisdictions where our infrastructure providers operate, subject to their respective security and data protection commitments.

6. Data retention schedule

• B2B inquiry records: Retained in Cloudflare D1 for up to 12 months to support seasonal planning cycles, after which inactive records are reviewed for deletion unless an active business conversation is ongoing or earlier deletion is requested.
• Rate-limit hashes: Used for 10-minute rate-limit windows. A scheduled worker removes expired windows; cleanup timing depends on the worker running successfully.

7. Cookies and tracking technologies

This website does not set advertising cookies, analytics trackers, or third-party retargeting pixels. While a form page remains open, a temporary submission identifier is held in browser memory so that retrying the same inquiry does not create duplicate records. This identifier is not stored in cookies or browser storage. Your chosen display language is saved locally in your browser as sumeria-language so it applies across the site; you can change it at any time using the language selector.

8. Your privacy rights

Depending on your jurisdiction (including the EEA/UK under GDPR and California under CCPA/CPRA), you have the right to request access to, rectification of, or erasure of your inquiry record, to restrict or object to processing, and to withdraw consent at any time. To exercise these rights, email [email protected] from the work email address used in your inquiry.