What I do with
your data.

Who is responsible

Webframer, a trade name of VTS Solutions (Bas Voets), registered with the Dutch Chamber of Commerce under number 70168741, VAT number NL002433367B42, based in Berkel en Rodenrijs, is the data controller for the data processed through this website.

Contact: bas@webframer.nl or +31 6 47 00 62 07.

What data I process

If you get in touch by email, phone or WhatsApp, I process the details you provide yourself: your name, email address, phone number, company name and the content of your message.

If you become a client, the details needed for the job and the invoicing come on top of that: address, VAT number, bank details and the correspondence about the project.

When you visit the website, technical data is processed that is needed to serve and secure the site, such as your IP address, browser type and the page requested. That sits in the hosting provider's server logs.

Why I process it

To answer your question and be able to write a quote (performance of, or steps leading up to, a contract).

To carry out a job, invoice it and provide support (performance of the contract).

To meet the statutory retention obligation for business records (legal obligation).

To keep the website available and secure (legitimate interest).

How long I keep it

Requests that do not lead to a job I keep for at most one year, so I know what an earlier conversation was about.

Invoices and the related records I keep for seven years, because Dutch tax law requires it.

Project data and correspondence I keep for as long as we work together and for at most two years after that, unless we agree otherwise.

Who I share it with

Only with parties needed to do my work: the host of this website, my email provider and my accounting package. A data processing agreement is in place with each of them.

Hosting of this site and of the software I build runs inside the European Union as standard. If a specific project needs a party outside the EU, you hear about it beforehand and I record the legal basis for that transfer.

I do not sell your data and I do not use it for advertising.

Cookies and analytics

This website uses Google Analytics to see which pages get read. That script only loads after you have given permission; if you decline or choose nothing, not a single request goes to Google.

No advertising cookies are set, and the statistics are not used to profile you or approach you. Your IP address is processed in truncated form.

You can withdraw your consent at any time on the cookie statement at /cookies. That page also lists exactly what gets recorded.

Security

Traffic to this site runs exclusively over an encrypted connection. Access to systems is protected with strong passwords and two-factor authentication.

In software I build for clients, access is restricted per role and per user as standard, so someone can only reach the data that belongs to their job.

Your rights

You have the right to see your data, have it corrected or have it deleted. You can also object to processing or ask for your data to be transferred.

Send a message to bas@webframer.nl for that. You get an answer within four weeks. If you disagree with how it is handled, you can file a complaint with the Dutch Data Protection Authority.

No profiling or automated decisions

No decisions about you are made on the basis of automated processing, and no profiles are built of your behaviour on this site.

If I build software under contract where that does happen, the client is the data controller for it and we record in the processing agreement what is allowed.

Transfers outside the EU

This site and the software I build run on servers inside the European Union as standard.

If a service outside the EU is unavoidable for a project, you hear about it beforehand and I record the legal basis for that transfer, for example the European Commission's standard contractual clauses.

When I am your processor

If I build or maintain software holding personal data of your customers, you are the controller and I am the processor. You are offered a data processing agreement as standard, listing the sub-processors I use.

In that role I process only what the job requires, report a data breach to you within 24 hours of discovering it, and delete or return the data when our work together ends.

If you process special categories of data, medical data for example, we discuss beforehand what extra measures are needed and whether a DPIA is required.

Minors

This website is aimed at businesses and does not knowingly collect data from people under 16. If you think that has happened anyway, let me know and I will delete it.

Changes

This statement can change if my services or the tools I use change. The current version is always on this page, with the date of the last change at the top.