Privacy statement

What this site doesn't do

• No cookies are set, not even functional ones.
• There are no analytics services, trackers, ad networks or social media buttons.
• There are no forms on the site.
• Fonts and images are on the same server as the pages, so your browser doesn't connect to Google or anyone else.
• The link to my LinkedIn profile is an ordinary link, not a button or an embedded window. Only when you click it do you go to LinkedIn, and LinkedIn's privacy policy applies there.

What the server logs

Like every web server, the server at my hosting provider TransIP records the requests it receives. Those logs include your IP address, the time and the page requested.

TransIP processes this data as a processor on my behalf, to secure the server and keep it running. The legal basis is legitimate interest (Article 6(1)(f) GDPR): a website can't be run securely without logs. I don't use the logs to track visitors or build profiles.

I also use these logs to count how often pages are viewed and which websites visitors come from. I do this on my own server. I keep only daily totals, without IP addresses or any other data that could identify you. The legal basis for this is also legitimate interest: I want to know whether people find the site.

The logs themselves are kept no longer than needed to secure and manage the server. In my hosting environment they are deleted automatically after three days.

If you email me

If you email me, I receive your name, your email address and what you write. I use that to reply to you and, if it leads to an engagement, to carry out that engagement. If you include your phone number, I use it only to call you back.

If your email is about a possible engagement, the legal basis is taking steps before entering into a contract, or performing one (Article 6(1)(b) GDPR). If you write on behalf of an organisation, or about something else, such as a vulnerability report, the legal basis is my legitimate interest in answering messages and working with clients (Article 6(1)(f) GDPR).

My email runs through Microsoft 365. Microsoft stores the messages on my behalf, as a processor, in data centres in the European Union and the EFTA countries. Microsoft is an American company and may access or process data outside the European Union for administration and support. That transfer is covered by the European Commission's standard contractual clauses, which are part of Microsoft's data processing terms.

If it doesn't lead to an engagement, I delete the email no later than 24 months after our last contact. If it does, I keep quotes, engagement letters and invoices for seven years, because Dutch tax law requires it (Article 52 of the Algemene wet inzake rijksbelastingen, the General State Taxes Act). The legal basis for that is a legal obligation (Article 6(1)(c) GDPR).

Who I share data with

I don't sell personal data. These parties process data on my behalf, as processors:

• TransIP hosts this website.
• Microsoft handles my email.
• My bookkeeper and the accounting software Exact Online process my invoices. These contain the name of the company and of the contact person.

Beyond that, I only pass data to others when the law requires me to, for example to the Dutch Tax Administration (Belastingdienst).

Security

The site can only be reached over an encrypted connection (HTTPS). The server sends security settings that tell the browser the pages may not load code or files from other servers, and may not appear in a frame on another site.

Your rights

You can ask what data I hold about you, and ask me to correct or delete it. You can also object to processing, ask me to restrict it, or request your data in a form you can take with you.

Email your request to alex@arcturus-advisory.nl. I respond within one month, as the GDPR requires. Sometimes I'll first ask you to confirm that the request really comes from you, so that I don't give data to the wrong person.

You're under no obligation to email me or give me any data. I don't make decisions about you that are taken by a computer alone.

Making a complaint

If you're unhappy with how I handle your data, please tell me first. If we can't resolve it together, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). You can also go to them straight away.

Changes

If anything about this site changes that affects personal data, I'll update this statement. The date at the top shows when that last happened.