Privacy policy

1. Who is responsible

The controller for the personal data described here is Net Ninjas Consulting, a Netherlands sole proprietorship (eenmanszaak) operated by Jeff Kloythanomsup, Herengracht 420, 1017BZ Amsterdam, Netherlands. You can reach us at hello@netninjas.eu or +31 6 45984313. We are a one-person business and have no data protection officer; Jeff handles every request personally.

2. What we collect, why, and for how long

Visiting the website. The site is hosted on Cloudflare. Like any web server, it records each request: your IP address, the page requested, the time, the browser and device type, and the page that linked you here. We use these logs to keep the site running and secure and to investigate abuse. The legal basis is our legitimate interest in operating a secure website (GDPR article 6(1)(f)). Cloudflare keeps these logs for no more than seven days. Requests from automated agents, including through the markdown endpoints, are logged the same way.

Analytics. If you accept analytics cookies, Google Analytics 4 records the pages you read, how you got here, your approximate location, and your browser and device, using the cookies listed in section 4. Google receives your IP address to work out your approximate location and, by its own account, does not store it for visitors in the EU. We use this to see which pages are read and which are not. The legal basis is your consent (GDPR article 6(1)(a)), which you can withdraw at any time under Cookie settings in the footer; withdrawing it removes the cookies and stops any further collection. Google Analytics is configured to keep visitor-level data for two months. Nothing is sent to Google until you accept.

Booking a call. The booking page shows the Calendly calendar only after you choose to load it. When you book, Calendly asks for your name, email address, and optionally a note, and sends that to us together with the time you chose. We use it to hold the call and to prepare for it. The legal basis is taking steps at your request before entering into a contract (GDPR article 6(1)(b)). We keep booking details for 24 months after our last contact, then delete them, unless you become a client.

Email and phone. If you email or call us, we keep your contact details and what you tell us for as long as the conversation needs, and for up to 24 months after our last contact in case you come back. The legal basis is taking steps before a contract or our legitimate interest in answering you and following up (GDPR articles 6(1)(b) and 6(1)(f)).

Clients. During an engagement we hold the business contact details of the people we work with, correspondence, and whatever is needed to deliver and invoice the work. The legal basis is performance of the contract (GDPR article 6(1)(b)) and, for invoices and accounting records, our legal obligation under Dutch tax law to keep administrative records for seven years (GDPR article 6(1)(c)). Other engagement records are kept for up to five years after the engagement ends, which is the limitation period for contractual claims under Dutch law.

What we do not do. We do not sell personal data, use it for advertising, profile visitors, or make automated decisions about anyone. The site has no accounts and no forms of its own.

3. Who receives your data

We use a small number of service providers who process data on our behalf under data processing agreements. Cloudflare, Inc. (hosting, content delivery, and request logs); Google LLC (Google Analytics, only with your consent, and Google Workspace, which hosts our email and calendar); and Calendly LLC (the call booking calendar). None of them may use your data for their own purposes.

These providers are based in the United States and may process data there. Each is certified under the EU-US Data Privacy Framework, and our agreements with them also include the European Commission's standard contractual clauses as a fallback, so the transfers meet GDPR chapter V.

We share personal data with no one else, unless the law requires it or you ask us to. We do not transfer it to any other country outside the European Economic Area.

4. Cookies and local storage

The site sets no cookies and loads nothing from Google until you accept analytics cookies in the banner. Your choice is stored in your browser's local storage so we do not ask on every page. This table lists everything the site stores in your browser.

You can also block or delete cookies in your browser settings. Doing so does not affect the site, apart from the banner reappearing.

5. How we protect it

The site is served only over HTTPS. Data is held in the systems of the providers named above, protected by their security programmes, and is accessible only to Jeff. We collect as little as the purpose needs and delete it when the retention period ends.

6. Your rights

You can ask us for a copy of the personal data we hold about you, ask us to correct or delete it, restrict or object to how we use it, or receive it in a portable format. Where we rely on your consent, you can withdraw it at any time without affecting what was done before. To use any of these rights, email us. We will reply within one month and will not charge for it.

If you think we have handled your data badly, we would like to hear about it first. You also have the right to complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl.

7. Children

This website and our services are for businesses and are not aimed at anyone under 16. We do not knowingly collect personal data from children.

8. Changes and contact

We may update this policy when the site or our practices change. The date below shows the latest revision; a change that affects what the cookie banner asks for will cause the banner to ask again. Questions about this policy go to hello@netninjas.eu.