Privacy statement

Casa Lab. is responsible for the use of personal data described in this statement. In the words of the GDPR (in Dutch: AVG), the European privacy law, we are the controller.

Business

Casa Lab., sole proprietorship (eenmanszaak)

Chamber of Commerce (KvK) number

97816930

VAT number

NL002397505B81

Address

Kleine Kolonieweg 104, 8075 PC Elspeet

E-mail

info@casa-lab.eu

We have no data protection officer; for a studio of our size this is not required. For any question about privacy, e-mail info@casa-lab.eu.

Which data

Technical data your browser sends, such as your IP address, the type of browser and device, the page you request and the time.

Why

To show you the pages and keep the site secure and reachable, for example to recognise attacks and outages.

Legal basis

Legitimate interest (Article 6(1)(f) GDPR): a website cannot work without this data.

How long

Our hosting provider Vercel keeps it briefly in log files, for security and to fix outages. We do not keep it ourselves and build no profiles from it.

This site sets no cookies and uses no trackers or visitor statistics. The fonts are on our own server, so your browser contacts no other party for them.

The example sites under /voorbeeld show photos from Unsplash, a stock photo library. Those photos come from our own server, so your browser contacts no other party for them.

Which data

The address of the website you enter, your IP address, and what the measured site itself states about the business.

Why

We use the address only to measure that site and show you the result. We use your IP address only to prevent misuse: the server counts how often someone uses the check.

Legal basis

Legitimate interest (Article 6(1)(f) GDPR): you ask for the measurement yourself, and we want to keep the check available and secure.

How long

We do not keep the address: our server writes it nowhere, and the result exists only in your browser. The server does not keep your IP address itself either, but a code derived from it with a secret key that exists only in its working memory. That code is never in a file or database. The server erases it ten minutes after your last check, and a restart removes everything at once.

For the measurement our server fetches the page and a few public files of the site whose address you enter. We also look up in the DNS, the address book of the internet, which service handles the e-mail of that domain.

For the speed measurement and the screenshot we send the address of the site to Google PageSpeed Insights. Google then opens the site itself. Google receives the address of the site, not your IP address.

Images of the measured site, such as its logo, are loaded by your browser directly from that site. That site sees your IP address.

If you start the check through a link that contains the address, such as /en/website-check?address=…, or if JavaScript does not work in your browser, the address is part of the page link. That link may then end up in our hosting provider's log files (section 2).

The check also reads the details the measured site states itself, such as business name, phone number, e-mail address, address and opening hours. For a sole proprietorship these can be personal data. We only show them to the person running the check and do not keep them. If that person requests a proposal from the result, we send them along with the request (section 4). If it is your site and you have a question about this, e-mail us.

Which data

What you fill in on the request form: the name and type of your business, a link to your current site or profile, your wishes for the site, your name, your e-mail address and, if you wish, a note. If you request the proposal from the website check, we also send what the check found on your site, such as business name, phone number, e-mail address, address and opening hours.

Why

To make a free design and proposal for you, e-mail you about it and send you a confirmation of your request.

Legal basis

You request the proposal yourself. If you are a sole proprietor, freelancer or partner, we use your data to prepare a possible agreement at your request (Article 6(1)(b) GDPR). If you request it on behalf of a private or public limited company (bv or nv), foundation, association or other legal entity, the legal basis is our legitimate interest in handling your request (point f).

How long

If no assignment follows, we delete your request, the design and the e-mails about it at the latest three months after we sent you the proposal, or three months after your request if we send no proposal, or earlier if you tell us you are not interested. If you become a client, section 7 applies.

Our server does not keep your request. It sends it as an e-mail, through the sending service Resend, to our mailbox at Google Workspace, and sends you a confirmation by e-mail. That confirmation only lists the choices you made, not what you typed yourself. Resend keeps sent e-mails in its sending log, according to its own retention period. Apart from that, those two e-mails are the only record of your request.

As long as you have not sent the form, your browser keeps your answers in its own temporary storage (sessionStorage), so they are not lost if you reload the page. We cannot access it. The answers disappear as soon as you send the request or close the tab.

If sending fails and you choose ‘Send by e-mail’, your own e-mail program opens with your request. It then reaches us through your own e-mail service.

To prevent misuse, the server counts how often a request comes from an IP address. The server does not keep your IP address itself for this, but a code derived from it with a secret key that exists only in its working memory. That code is never in a file or database. The server erases it ten minutes after your last request, and a restart removes everything at once.

Sometimes we make a design for a new site for a business on our own initiative, and offer it once.

Which data

Public business data: business name, address, phone number, e-mail address, opening hours, services and prices, and the texts your business puts online itself, on your site, your Google Business Profile or your social media. For a sole proprietorship this may include your name. We only use your photos and your logo once you have supplied or approved them; until then the example uses photos from a stock library or neutral images.

Why

To make a design for your new site and offer it to you once.

Legal basis

Legitimate interest (Article 6(1)(f) GDPR): we want to show entrepreneurs what we can make for them. We only use public business data, the design is not public and you can always object.

How long

If you do not respond or are not interested, we delete the design and your data at the latest three months after our first message. If you object, at once.

The design sits behind a personal link that we give only to you. Search engines do not find it, and we show it to no one else.

We contact you at most once, and only in a way the law allows: by post, or by e-mail to the general address that a private or public limited company (bv or nv) or other legal entity publishes for contact itself. We send no unsolicited e-mail and no messages through WhatsApp or social media to sole proprietorships, freelancers, general partnerships (vof) or professional partnerships (maatschap). Our first message says who we are, where we got your data, that you can object and how, and links to this statement.

If you do not want to be approached, or want us to delete everything, reply ‘stop’ to our message or e-mail info@casa-lab.eu. We then stop at once and delete the design and your data. So as not to approach you again, we keep only your business name and the address at which we approached you, on a list of businesses we do not approach.

Which data

Your name, your e-mail address, the name of your business and what you write to us.

Why

To answer your question and record agreements with you.

Legal basis

Legitimate interest (Article 6(1)(f) GDPR): answering your question. If your e-mail is about an assignment, preparing or performing an agreement (point b).

How long

As long as needed to deal with your question, and after that at most two years. E-mails about a proposal without an assignment we delete sooner (sections 4 and 5). E-mails that belong to our accounts we keep for seven years.

Which data

Name, business name, address, e-mail address, phone number, KvK number, VAT number, your answers in the delivery form, your payment details, such as your account number, and our correspondence.

Why

To make your site, put it online and host it, register your domain name in your name, invoice you and keep our accounts.

Legal basis

Performing our agreement (Article 6(1)(b) GDPR) or, if you are a contact person of a client that is a legal entity, our legitimate interest in performing that agreement (point f); and our legal duty to keep accounts (point c).

How long

As long as you are a client. We then keep invoices and the rest of our accounts for seven years, because tax law requires it. We delete other data at the latest two years after the agreement ends, unless we need it for a dispute.

To register your domain name, we pass your business details to our registrar and to the organisation that manages the extension, such as SIDN for .nl. They are responsible for this themselves. Some business details are visible in their public lookup service (WHOIS).

If visitors leave data on a site we host for a client, for example through a contact form, or if their data ends up in the hosting logs, we process it on behalf of that client. The client is responsible for it; we are the processor and use that data for nothing else. The arrangements are in our data processing agreement.

If you visit such a site and have a question about your data, ask the business behind that site. We help that business with the answer.

We sell your data to no one. We only share it with parties we need for our work, and only what they need for it.

Parties working on our instructions

These parties only process data for us (processors). With each of them, arrangements on that processing apply, as the GDPR requires:

• Vercel: hosting of this site and of our clients' sites;
• Resend: sending the e-mails of the request form;
• Google (Google Workspace): our e-mail;
• our accounting software: invoices and accounts.

Parties responsible themselves

• Google, for the speed measurement of the website check (PageSpeed Insights): only the address of the measured site;
• our domain registrar and the organisation that manages the extension, such as SIDN: the data for registering your domain name;
• our bank: your payments;
• the Dutch Tax Administration and other authorities, if the law obliges us to provide data.

Vercel, Resend and Google are American companies. Your data may therefore also be processed in the United States. The server that processes the website check and your request runs in a data centre in Frankfurt.

Data only goes to a country outside the European Economic Area with the safeguards the GDPR requires: the EU-US Data Privacy Framework, for companies certified under it, or the standard contractual clauses of the European Commission, fixed model terms on privacy. If you want to know which safeguard applies to a party, e-mail us.

Website check

Not the address. A code of your IP address only in working memory, until ten minutes after your last check (section 3).

IP address with a request

A code of your IP address only in working memory, until ten minutes after your last request (section 4).

Request without an assignment

At the latest three months after we sent you the proposal, or three months after your request if we send no proposal.

Design for a business we approach

At the latest three months after our first message; at once if you object.

List of businesses we do not approach

Only business name and the address at which we approached the business, as long as we approach businesses ourselves.

Other e-mail

At most two years after your question was dealt with.

Client data

As long as you are a client, then at most two years.

Invoices and accounts

Seven years, because the law requires it.

We take appropriate measures to protect your data:

• all connections to this site are encrypted (https);
• the request form and the website check store nothing in a database; requests only arrive as e-mail;
• only we have access to our mailbox and our accounts;
• we protect those accounts with strong passwords and two-step verification: signing in with an extra code;
• we work with hosting and e-mail services that apply strict security requirements themselves;
• we delete data as soon as we no longer need it.

If something still goes wrong with your data, a data breach, we report it where required within 72 hours to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), and to you if it poses a high risk to you.

You have these rights:

• access: ask which data we hold about you;
• rectification: have incorrect data corrected;
• erasure: have your data deleted;
• restriction: ask us to stop using your data for a while;
• objection: object to use based on legitimate interest. If you object to us approaching your business, we always stop;
• portability: receive the data you gave us yourself in a common file format.

You are not obliged to give us data. Without your name and e-mail address we cannot send you a proposal, and without the details for invoices and the registration of your domain name we cannot perform an agreement. We make no decisions about you based solely on automated processing, and we build no profiles.

E-mail your request to info@casa-lab.eu. It is free, and we respond within one month. We may ask you to show that the request comes from you, for example by replying from the e-mail address we know you by.

If you disagree with how we handle your data, please tell us first; we are glad to solve it. You also always have the right to complain to the Autoriteit Persoonsgegevens, the Dutch supervisory authority: autoriteitpersoonsgegevens.nl.

We update this statement when our work or the law changes. The date at the top shows which version you are reading. If a change matters to clients, we e-mail them.

This English text is a translation of the Dutch privacyverklaring. If the texts differ, the Dutch text prevails. Please also read the terms and conditions.