Privacy and personal data
1. Who is responsible?
Geurts, Webdesign en Development
Trading as Geurts Webdesign & Development
James Johnsonstraat 60
3543 GD Utrecht, Netherlands
KvK: 59412259
Email: info@geurtswebdesign.com
Phone: 06 – 310 88 334
We are the controller for data about our website visitors, contacts, clients and suppliers. When we manage or host a website, mailbox or application for a client, we may act as processor for the data it contains. We process that data on behalf of the client and document the arrangement in a data processing agreement where required.
2. What data do we process?
- Name, company name and contact details, such as address, email and phone number.
- Information entered in a contact or quote form, including project description, objectives, scope, budget and timeline.
- Correspondence, quotation and order details, and information needed to provide our services.
- Billing and payment details, including billing address, Chamber of Commerce or VAT details where relevant, and payment status.
- Technical data such as IP address, browser and device data, server logs and security signals.
- Visit and interaction data from Google Analytics and technical signals for Google reCAPTCHA v3, depending on the settings and your consent choices.
Provide only the information needed for your enquiry or project. Do not send special categories of personal data or passwords through a general contact form. If we need access to systems, we will agree on a suitable secure method.
3. Why do we use this data?
| Purpose | Legal basis |
|---|---|
| Answering your enquiry and preparing a quote at your request | Pre-contractual steps at your request. For other business correspondence, our legitimate interest in communication. |
| Providing websites, online shops, domains, hosting, email, maintenance and support | Performance of the contract. For business clients’ contacts, our legitimate interest in carrying out the business relationship. |
| Invoicing and financial administration | Performance of the contract and statutory record-keeping obligations. |
| Security, abuse prevention and troubleshooting | Our legitimate interest in secure, reliable services after weighing the impact on individuals. We also ask for prior consent for device access where required. |
| Website analytics and advertising measurement | Consent where required. Statistics with limited privacy impact are used without consent only if the specific setup is legally permitted and there is an appropriate GDPR legal basis. |
When relying on legitimate interests, we weigh them against your privacy interests. You can object to this processing. Submitting a form does not automatically mean you consent to newsletters or advertising tracking.
4. Who do we share data with?
We share data only when necessary for a defined purpose, at your request or when required by law. Our providers include:
- Google Workspace: email and business communication. Additional service and processing terms apply when we provide Workspace to clients.
- Moneybird: client management, quotes, invoicing and administration.
- STRATO and our own servers: hosting and technical processing required by the environment.
- Google Analytics and Google Tag Manager: website analytics and management of measurement and other tags. Data sent depends on which tags load and on your consent.
- Google reCAPTCHA: assessing and limiting spam and automated form abuse.
Competent public authorities or professional advisers may also receive data where there is a legal basis. We put suitable processing agreements in place where parties act solely on our behalf. We do not sell your personal data as a product.
5. Data outside the EEA
International providers may process or access data outside the European Economic Area. Such transfers require a valid GDPR transfer mechanism, such as an applicable adequacy decision or appropriate safeguards.
6. How long do we keep data?
We keep data only as long as necessary for its purpose or a legal obligation. An ongoing dispute or another legal basis may require longer retention.
- Invoices and core tax records: generally seven years, or longer if a specific legal retention duty applies.
- Contact and quote enquiries that do not become orders: twelve months after the last contact.
- Project files and substantive correspondence: 24 months after project completion.
- Server logs: 30 days.
- Security logs: 90 days.
- Google Analytics: fourteen months for user and event data. This does not automatically determine retention of aggregated reports or cookie lifetimes.
- Remaining client files and backups: generally twelve months from the actual end of the service. This does not extend service or access rights or guarantee recovery.
The 30-day handover period starts when we receive notice of termination. It is not a general personal data retention period. The migration window does not replace statutory record-keeping duties. For data processed solely on a client’s behalf, separate processing agreements govern return, deletion and any necessary temporary retention. The twelve-month period is not blanket permission to retain all personal data.
7. Cookies, Analytics, pixels and reCAPTCHA
We use cookies and similar technologies for site functionality, analytics and spam prevention. We use Google Analytics to measure visits and Google reCAPTCHA v3 to protect forms from spam and automated abuse. reCAPTCHA v3 assesses technical signals and interactions without a standard checkbox.
See our cookie statement for details. Where consent is required, you must be able to make a free and specific choice beforehand and refuse or withdraw consent without unnecessary barriers.
We currently run no ad campaigns. We may use Google Ads, Meta and LinkedIn in the future. Before introducing new tracking for these platforms, we will update our privacy and cookie information and the necessary consent settings.
8. Security
We take appropriate technical and organisational measures based on the nature of the data and risks, including access restrictions, secure connections, maintenance and incident procedures. No internet service can guarantee complete security. Report suspected incidents to the email address above without including unnecessary personal data.
9. Your privacy rights
Depending on the situation, you have rights of access, rectification, erasure, restriction of processing, data portability and objection. Where consent is the legal basis, you can withdraw it at any time. This does not affect the lawfulness of processing before withdrawal. You can always object to direct marketing.
Email requests to info@geurtswebdesign.com. We normally respond within one month. For complex requests, the GDPR allows an extension, which we will notify you of in time. We may ask for proportionate additional information to verify your identity. We do not routinely ask for a full copy of your ID.
You can complain to the Dutch Data Protection Authority. You can also contact us first.
10. Required data and automated decisions
Without required contact, order or billing data, we may be unable to answer an enquiry or perform a contract. Optional fields and consent are voluntary.
reCAPTCHA can automatically assess whether traffic is suspicious and restrict form submissions. If you have difficulty, contact us by email.
11. Changes
We may update this notice when our services or processing change. The current version is on this page. Where necessary, we will inform you directly about significant changes.