Privacy statement
Version 2.0 · Last updated: October 7, 2026
Data controller
This privacy statement applies to www.draftdigital.nl and to any contact you make with us through this site. The controller for the processing of your data is:
Draft Digital B.V.Hannie Dankbaarpassage 1, 1053 RT Amsterdam
Chamber of Commerce 92888259
info@draftdigital.nl · +31 6 14183114
We have no data protection officer; for all privacy questions, use the email address above.
What this statement covers
This statement describes what happens to personal data you give us through www.draftdigital.nl, and to data your browser leaves behind when you visit. It does not cover other websites we link to, such as LinkedIn or our clients' sites; their own statements apply there.
If you work with us as a client or supplier, the arrangements about data are also set out in the agreement and the data processing agreement we conclude with you.
Which data we process
We only process data you enter yourself or that is needed to run the site securely. Per situation:
| Situation | Data |
|---|---|
| Contact form | Name, email address, company name and phone number (optional), the topic you choose, your message, the page you sent it from, your browser (user agent) and a hashed version of your IP address for spam protection. We do not store the IP address itself. |
| Application form | Vacancy, name, email address, phone number (optional), link to your LinkedIn profile and CV or portfolio (optional), availability (optional), your motivation, plus the same technical data as for the contact form. You cannot upload a CV file here; if you email one, we process it in the same way. |
| Website visit with consent | If you accept analytics: a random visitor number, the pages you view, the source of your visit, your device and browser and your approximate location based on the IP address. Google Analytics 4 does not store the IP address itself. |
| Technical logs | Our hosting (Google Cloud Run) keeps short-lived server logs with IP address, time and requested URL, solely for security and troubleshooting. |
Why, on which legal basis and for how long
We only use your data for the purpose you gave it for. The legal basis comes from Article 6(1) GDPR; the retention period is the maximum, we delete earlier once the purpose is achieved.
| Purpose | Legal basis | Retention |
|---|---|---|
| Answering your question, preparing a proposal or entering into a working relationship | Pre-contractual steps at your request (point b) and our legitimate interest in responding to enquiries (point f) | 12 months after the last contact, unless a working relationship follows |
| Assessing your application and running the procedure | Pre-contractual steps (point b) and legitimate interest (point f) | 4 weeks after the procedure ends; with your consent 1 year, so we can approach you for a later role |
| Client and supplier administration, invoicing | Performance of the contract (point b) and legal obligation (point c) | 7 years after the financial year, the statutory tax retention period |
| Understanding how the site is used and improving it | Your consent (point a), through the cookie banner | Reports in Google Analytics 4: 14 months; cookies: see the cookie statement |
| Preventing spam and abuse of the forms | Legitimate interest (point f) | As long as the enquiry the data belongs to |
| Remembering your language and cookie choice | Necessary for the site to work (Article 11.7a Dutch Telecommunications Act); no consent needed | Language choice 1 year, cookie choice 180 days |
| Securing the site and detecting faults | Legitimate interest (point f) | Server logs for a maximum of 30 days |
Who we share data with
We do not sell data and do not share it with third parties for their own purposes. We do use service providers that process data on our behalf, under a data processing agreement:
- Google Cloud (Cloud Run and Cloud SQL): hosting of the website and storage of form submissions, in the europe-west4 region (the Netherlands).
- Resend: sends the email notification to our team when a message or application comes in.
- Google Analytics 4, via Google Tag Manager: visitor statistics, only after you have accepted analytics. Google Ireland Ltd. is our processor here.
- Cloudflare Turnstile: bot protection on the forms. Not active yet; once it is, a verification token and your IP address go to Cloudflare.
Transfers outside the EEA
Our data is stored in the European Union. Google and Resend may process data in the United States for support or backups. For that we rely on the EU-US Data Privacy Framework, under which both parties are certified, supplemented by the European Commission's standard contractual clauses.
How we secure data
All traffic runs over an encrypted connection (HTTPS) and the site sends strict security headers. IP addresses from form submissions are stored only as a hash. Access to storage is limited to the people who need it, with personal accounts and two-step verification; passwords and keys live in a secure vault, not in the code.
Your rights
You can ask us to access the data we hold about you, to correct or delete it, to restrict processing, to transfer it to another party and to object to processing based on our legitimate interest. If you gave consent, you can withdraw it at any time.
Send your request to the email address at the top of this statement. We respond within one month; a complex request may take two months longer, and we will tell you within the first month if so. If we doubt it is really you, we will first ask for confirmation.
You are not obliged to give us data. Without a name and email address we simply cannot answer a message or application.
Filing a complaint
If you disagree with how we handle your data, please tell us; we would rather resolve it together. You also always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), PO Box 93374, 2509 AJ The Hague, via autoriteitpersoonsgegevens.nl.
Automated decision-making
We do not take decisions about you based solely on automated processing and we do not profile visitors or applicants.
Changes
If what we do changes, we update this statement. The version and date at the top show which text applies. For a material change in how we use your data, we ask for your consent again where needed.