Privacy policy

RG Digital is a sole trader (eenmanszaak) registered in the Netherlands under KvK number 97419575. My registered address is Cissy van Marxveldtstraat 71, 1321 LL Almere, the Netherlands. I can be reached at info@rg-digital.dev. For the data described in this policy, I am the controller.

Most of it you fill in yourself. Through the contact form:

• Your name and email address
• The topic, your budget indication and the content of your message

Through the form for booking a call:

• Your name and email address
• Your company name and phone number, if you fill them in
• The type of call, your preferred days and times of day, and how you'd like to talk
• Your note, if you add one

Alongside that, the technical data every website needs in order to work passes through. This site runs on Cloudflare's network, which briefly processes your IP address, browser type and the page requested in order to serve the site and protect it against abuse and overload.

The forms use Cloudflare Turnstile to keep spam and bots out. Turnstile works without cookies; on submission your IP address is sent to Cloudflare together with a one-time token to verify that you are a real visitor. If that check fails, your message is not sent. Your IP address is used for that check only and is not stored alongside your message.

I don't use tracking cookies or advertising pixels. This site uses Cloudflare Web Analytics, a privacy-first analytics service that does not use cookies or any persistent identifiers, and does not track or profile individuals across sites. It reports aggregate metrics such as page views and load performance only.

Two things are kept in your own browser rather than with me. Your browser remembers, for the duration of your visit, which link brought you here (the first page and any campaign codes in the link); that disappears when you close the tab and is only sent along if you submit a form yourself, so I know which channel a request came from. If you pick light or dark with the theme toggle, that choice is stored in your browser so the site looks the same on your next visit. It is never sent anywhere and no cookie is involved.

Contact form messages are used only to respond to your enquiry. Data from the booking form is used to schedule and hold a call with you, and for a Quickscan to write the report and handle the payment. When you submit a form, an automatic confirmation that your message or request has arrived is sent to the email address you gave; that confirmation goes to you only.

Technical data and Turnstile are used to keep the site working and to block spam and abuse. I don't use your data for marketing without your explicit consent, and I don't sell or share it with third parties — other than the processors listed in section 9, which only process on my behalf.

I don't follow you across other websites, I don't buy data about you from anyone, and no decisions about you are made by automated processing or profiling: nothing here automatically predicts or assesses your behaviour, preferences or reliability. What I do keep is a record of who got in touch and what was agreed. That is ordinary administration, and section 4 sets out exactly what it holds.

To run projects properly, I keep an administration in my own dashboard. It runs on a server in Germany that I manage myself; it is not a third party's CRM and nobody else has access. Per person and per company it holds:

• Name, email address, phone number, company name, city, KvK number and language preference
• What you sent through the forms: your message or request, with the topic, budget indication, your preferences for a call and which channel brought you here
• A record of contact moments: which conversations, emails, phone calls and messages there have been, and when
• For clients: the appointments, quotations, projects and payments that belong to them
• Notes I write myself about the assignment — what you need, what was agreed and what still has to happen

When you submit a form it arrives here automatically, so a request doesn't sit unnoticed in a mailbox. The purpose is that I know who I am dealing with and what was agreed; it is not an assessment of you, and it is not used to put you in a category or predict anything about you. If you want to know what it holds about you, or want it corrected or deleted, section 8 applies.

Responding to a message is based on legitimate interest (Article 6(1)(f) GDPR): you contacted me. The same basis covers keeping the site working and secure, keeping spam out, and maintaining the administration in section 4 — a one-person business has to be able to check who was spoken to and what was promised. Scheduling and holding a call or Quickscan, and everything belonging to a running assignment, is based on the performance of a contract (Article 6(1)(b) GDPR). Where you explicitly ask for a follow-up that falls outside that, the basis is consent (Article 6(1)(a) GDPR), which you can withdraw at any time. Keeping invoices rests on a legal obligation (Article 6(1)(c) GDPR).

The administration clears itself out on fixed terms:

• What you typed into a form, and free calls, are deleted after 12 months. If nothing belonging to you is left after that, your contact record itself is deleted too.
• For a paid call such as a Quickscan, your note, preferences, meeting link and referral details are erased after 24 months. What remains is the business record: that an appointment took place and what was paid for it. Your phone number goes at the same time.
• The financial records and invoices required by Dutch law (Belastingdienst) are kept for 7 years and deleted afterwards.

If you become a client, the assignment's data is my own business file: I keep it while the assignment runs and afterwards for as long as needed for warranty, maintenance and the handling of any dispute. Contacts and notes I entered myself are not on an automatic timer, because they are my own notes about the work. If you want them gone sooner, I will delete them on request, unless I am legally required to keep them.

The site is served over an encrypted connection (HTTPS) only. This website has no database and no CMS holding visitor data. The dashboard in section 4 is behind a login and accessible only to me; its backups are encrypted before they leave the server, with a key that is not held on that server, so a leaked backup yields no readable client data. My email and the accounts I use for the work are protected with strong, unique passwords and two-factor authentication. No measure is watertight, but this is what is reasonable for the data that passes through here.

Under the GDPR you have the right to access, correct or erase your personal data, restrict or object to processing, and data portability. That covers the administration in section 4, including the notes I wrote myself. Where you have given consent, you can withdraw it at any time, without affecting processing that already took place. To exercise any of these rights, email info@rg-digital.dev. I will respond within one month; if a request is complex, that period may be extended by two months and I will tell you so within the first month.

You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens.

This website is hosted on Cloudflare's global network. Form submissions are processed by a Cloudflare Worker and arrive in my own dashboard and by email in my inbox; no third-party form service or CMS is involved. The forms use Cloudflare Turnstile to keep spam out, and visitor numbers run through Cloudflare Web Analytics (see section 2). My email runs on Proton Mail. If you book a call, the appointment is placed in my calendar at Google Calendar.

If you pay for a Quickscan, the payment is handled by my payment provider Mollie, which processes your payment details under its own privacy policy; I never see your card or bank details myself.

I have a data processing agreement with each of these parties, and they may use your data only to provide their service to me.

My own administration in section 4 sits on a server in Germany and so stays within the European Economic Area. Cloudflare and Google are US companies with servers worldwide, so processing may also take place outside the European Economic Area. Those transfers rest on their data processing agreements incorporating the European Commission's standard contractual clauses. Mollie and Proton Mail are European parties, processing within the EEA and in Switzerland respectively, which the European Commission has recognised as adequate.

This policy covers the data I process as a controller: visitors to this site, enquiries and clients. Where I build or maintain software holding personal data about your customers or staff, you remain the controller for that data and I am the processor: I work on your instructions and under a separate data processing agreement. That is set out in section 13 of the terms and conditions.

I may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision.

Questions about this policy? Email me at info@rg-digital.dev.