Privacy

What I process, why, and on which legal basis

When you email me

When you email me, I receive your name, your email address and whatever you choose to write, such as your company and the project you have in mind. I use this only to answer you and, if it comes to that, to discuss and plan an assignment.

Legal basis: taking steps at your request before entering into a contract (article 6(1)(b) GDPR), or otherwise my legitimate interest in answering the messages I receive (article 6(1)(f) GDPR).

The contact form

The contact form asks for your name, email address and message, and optionally your company. Nothing else. I use it for the same purpose, and on the same legal basis, as an email.

When you send the form, your submission is emailed to me with your address as the reply-to, so I can answer you directly. No copy is mailed to the address you typed in. A copy of the submission is also stored on the web server. A hidden field filters out spam; no third-party captcha is used.

Clients and suppliers

For clients and suppliers I keep names, company details, contact details, agreements, invoices and the correspondence that goes with them. I need these to carry out the assignment, to invoice and to keep the accounts that Dutch tax law requires.

Legal basis: performing the contract (article 6(1)(b) GDPR) and complying with a legal obligation (article 6(1)(c) GDPR).

Website statistics

This website doesn't collect visitor statistics. If that changes, this statement will say what is collected before it starts.

Server logs

Like any web server, mine logs each request: IP address, date and time, the page requested and the browser. These logs are used only to keep the site secure and to fix problems.

Legal basis: my legitimate interest in a secure, working website (article 6(1)(f) GDPR).

Cookies and local storage

This website sets no tracking, advertising or third-party cookies, which is why you don't see a cookie banner. It only uses what is needed for the site to work, or what you ask for yourself:

• two functional cookies, a session cookie and XSRF-TOKEN, which protect forms against misuse and expire after two hours;
• in your browser's local storage: your light or dark theme choice (theme), your recent searches in the site search (pfb-recent-searches) and whether you found the coffee (pfb-coffee-found). These stay in your browser and are never sent to me. You can clear them in your browser's settings.

Who else handles your data

I don't sell personal data and only share it when that is needed for the purposes above or required by law, for example with the tax authorities. I use these service providers:

• Hosting: Hetzner Online hosts the server that runs this website and the contact form, in a data centre in Nuremberg, Germany.
• DNS and email: Vimexx (the Netherlands) handles the domain's DNS and my email.
• Accounting: MoneyMonk (the Netherlands) holds my accounts, invoices and business contacts.

MoneyMonk stores data primarily within the European Economic Area. A few of its supporting service providers process some data in the United States, under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

How long I keep it

• Client and supplier records: seven years, the retention period that Dutch tax law requires for business records (article 52 of the Algemene wet inzake rijksbelastingen).
• Enquiries, contact form submissions and server logs: no longer than needed for the purpose they were collected for. When an enquiry leads to an assignment, it becomes part of the client records.

Your rights

You have the right to:

• see the personal data I hold about you (access);
• have it corrected if it's wrong (rectification);
• have it deleted (erasure), unless the law requires me to keep it;
• object to processing based on my legitimate interest (objection);
• have its processing limited while a question about it is being settled (restriction);
• receive the data you gave me in a common, machine-readable format, or have it sent to someone else (portability).

Email me to use any of these rights. I respond within one month; if a request is complex I may extend this by up to two more months, and I'll tell you why within that first month. I may ask you to confirm your identity first. It costs you nothing.

If you are not satisfied with how I handle your data, please let me know. You also have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (opens in a new tab).

Security

The site is only served over HTTPS, the server and its software are kept up to date, and access to personal data is limited to me.

Changes

When the way I process personal data changes, I update this statement. The version date below shows when that last happened.

Version: 17 October 2026