Privacy Policy

1. Who is responsible

The data controller for the processing described here is:

2. What data we collect

Depending on how you interact with us, we may process:

• Fit-call / contact form: your name, email address, company, and the message you send us.
• Scheduling: the details you provide when booking a call via our calendar link (name, email, chosen time).
• Engagement data: the information you share with us while we work together (business context, marketing accounts, documents, and communications). Where this includes personal data about your own customers or staff, we act as your processor — see our Data Processing Agreement.
• Billing data: the details needed to invoice you (company name, contact, VAT number, billing address). Card details are processed by our payment provider (Mollie) and are never stored by us.
• Website usage: if you consent, anonymous analytics about how the site is used (see section 8).

3. Why we use it

• To respond to your enquiry and hold a fit call.
• To deliver the engagement you have agreed to (Blueprint, Build, Operating System, Deep Dive, workshop).
• To send invoices and process payments.
• To meet legal obligations, including statutory bookkeeping and tax retention.
• To understand and improve how the website performs (with your consent).

4. Lawful basis

We rely on the following bases under Article 6 GDPR:

• Performance of a contract: to deliver an engagement and process payment for it.
• Legal obligation: for invoicing and the statutory retention of financial records.
• Legitimate interest: to respond to enquiries you send us and to keep the site secure.
• Consent: for analytics and any marketing cookies. You can withdraw consent at any time via the Cookie preferences button on any page.

5. How long we keep it

• Fit-call / enquiry data that does not lead to an engagement: up to 12 months after last contact.
• Client engagement records: for the duration of the engagement and up to 2 years afterwards, unless a longer statutory term applies.
• Invoices and financial records: 7 years (Dutch fiscal retention obligation).
• Analytics data: retained for the period set in Google Analytics (currently 14 months), in aggregated form thereafter.

6. Who we share it with

We share your data only with the service providers we need to run the business, and only where the GDPR permits. These are our sub-processors:

We never sell your data to third parties for marketing purposes.

7. International transfers

Some providers above may process data outside the European Economic Area (for example in the United States). Where that happens, transfers are covered by the EU Standard Contractual Clauses and/or the provider's certification under the EU–US Data Privacy Framework.

8. Cookies & analytics

This site sets only necessary cookies by default. Analytics and marketing cookies are set only after you give consent through the cookie banner. We use Google Consent Mode v2: until you accept, analytics and marketing storage stay denied. Full detail is in our Cookie Policy. You can change your choice at any time via the Cookie preferences button in the bottom-left of any page.

9. Security

We apply appropriate technical and organisational measures to protect your data against loss, misuse, and unauthorised access, including encrypted connections (HTTPS), access controls, and limiting who can see personal data.

10. Your rights

Under the GDPR you have the right to:

• Access the data we hold about you;
• Rectify data that is inaccurate;
• Erase your data, where no legal retention obligation applies;
• Restrict or object to processing in certain situations;
• Data portability — receive your data in a common format;
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these, email raoul@heerdenco.com. We respond within four weeks.

11. Complaints

If you have a complaint about how we handle your data, please contact us first at raoul@heerdenco.com. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

12. Changes to this policy

We may update this policy to reflect new services, changes in the law, or improved practices. The date at the top shows the last revision. Please check back from time to time.