Privacy

Who is responsible

ZICHTGROEI is a brand operated by NOORDVARO V.O.F. The registration and privacy contact details below identify the responsible business.

Project enquiries

Start Project collects your name, company name, email and, when relevant, WhatsApp number and reply preference. It also asks about your business, requested services, existing website, languages, goals, functionality, budget, timeline and optional project context. Avoid sensitive information in free-text fields.

These details support assessing and responding to your enquiry and preparing a possible proposal. Where applicable, we take steps at your request before a contract (GDPR Article 6(1)(b)); we also rely on legitimate interests (Article 6(1)(f)) to answer B2B enquiries, communicate with business contacts and protect the service from abuse.

Attribution and measurement

Permitted UTM source, medium, campaign, term and content values, the landing pathname and referring origin may accompany an enquiry. Attribution is kept in memory until submission; landing queries and fragments and full referring URLs are excluded. Do not put personal data in campaign parameters.

The analytics abstraction accepts only fixed event names and bounded metadata. It excludes names, email addresses, phone numbers, free text, URLs, UTM values and full enquiries. No analytics network provider is currently enabled.

Storage, notification and access

Validated enquiries are stored on the server in a PostgreSQL database. Acceptance depends on durable storage. Access to the owner admin requires authentication; enquiries are not a public dataset.

An email notification contains only a lead identifier and an HTTPS link to the protected owner admin. It contains no customer contact fields or full enquiry. The configured email provider is listed below; an inactive alternative is not listed as a processor. A failed notification does not remove an already stored enquiry.

Minimisation and browser drafts

The browser can save non-sensitive wizard choices for up to seven days. Drafts exclude identity and contact information, website URLs, free text, attribution and consent. You can discard a draft; private fields must be entered again after recovery.

Security and operational logging

The application uses server validation, protected admin sessions, same-origin checks and shared rate limiting. Abuse identifiers are hashed using a server secret; a client IP is used only when a trusted gateway header is explicitly configured. Public application errors and logs must not expose raw sensitive payloads.

Hosting, database and email providers process information needed to operate the service. The providers currently supporting this site are listed below. Operational logs and backups are governed by their respective retention and deletion arrangements; security measures are not a guarantee against every risk.

Marketing is a separate choice

An enquiry can be submitted without marketing consent. The optional marketing choice is separate from enquiry processing and receives its own timestamp. No marketing delivery integration is currently implemented. Any future marketing use requires its own reviewed purpose and a way to withdraw consent.

Retention

Prospective project enquiries, related internal notes and notification statuses are kept for 12 calendar months after the last substantive customer contact about the enquiry. If there is no follow-up contact, the period starts when the enquiry is received. We review potentially expired enquiries at least monthly and erase them after checking the actual correspondence and any separate legal obligation; internal admin updates and automated notifications do not restart this period. Signed client engagements, accounting and claims records follow separate applicable retention requirements. Owner Admin supports manually confirmed deletion, not an automated purge. Mailbox copies, operational logs and backups have separate applicable retention and deletion arrangements.

Your choices and requests

You may request access, correction or deletion and, where applicable, restriction, portability or object to processing. You may withdraw consent for a consent-based purpose and raise a complaint with the relevant data protection authority, including the Dutch Autoriteit Persoonsgegevens. Applicable rights and any required retention must be assessed for the request.

Use the confirmed privacy contact below for a request and provide only enough information to identify the enquiry. Do not submit a privacy request through the project wizard.

Configured service providers

The listed services support the site and enquiry processing. Their role and data handling depend on the configured production services.

• Vercel
• Neon (PostgreSQL)
• Cyber_Folks (SMTP)

Privacy requests