Privacy statement

Pulsify is a one-person business. This statement sets out what personal data we process when you visit this site, contact us or work with us, why we do it, how long we keep it and what you can ask us to do about it. We ask for the minimum the work needs and nothing beyond it.

1. Who is responsible for your data

Pulsify is the controller within the meaning of the General Data Protection Regulation (GDPR, in Dutch the AVG). That means we decide why and how your personal data is processed.

Trade name

Pulsify

Legal form

Sole proprietorship (eenmanszaak)

Address

Box D1135, Oder 20
2491 DC Den Haag
Netherlands

Email

pulsify.zakelijk@gmail.com

Chamber of Commerce

42071996

VAT identification

NL005472819B41

Data protection officer

None appointed. A business of this size and type is not required to have one.

2. When this statement applies

It applies whenever you:

• visit this website;
• send us an email or otherwise get in touch;
• ask for or receive a proposal;
• are a client, or work for a client, during and after an assignment.

3. What we process

Only what the contact or the assignment actually requires:

• Contact details — your name and email address, and anything else you choose to put in your message. For business clients also the company name, address, Chamber of Commerce number and VAT number.
• Correspondence — the content of the emails you send us and the replies we send back.
• Project data — what you tell us about your business, and the material you supply for the work: text, images, logos, and where needed access credentials for a domain, hosting account or channel.
• Invoicing and administration — invoice details, amounts, payment status and the account details visible on an incoming payment.
• Technical data — our hosting provider may record standard server logs, including IP addresses and requested pages, to keep the site available and secure.

4. Why we process it, and on what legal basis

• Answering your enquiry and drawing up a proposal — necessary for steps taken at your request before entering into a contract, article 6(1)(b) GDPR.
• Carrying out the assignment, delivering a website or content, and handing over access — performance of a contract, article 6(1)(b) GDPR.
• Invoicing, bookkeeping and tax retention — compliance with a legal obligation, article 6(1)(c) GDPR, in particular article 52 of the Dutch General Tax Act.
• Keeping the website available and secure — legitimate interest, article 6(1)(f) GDPR.
• Handling a complaint, or establishing or defending a legal claim — legitimate interest, article 6(1)(f) GDPR.

We do not build advertising profiles, we do not use your data for marketing to third parties, and we do not sell or trade it. There is no automated decision-making and no profiling.

5. Cookies, analytics and third-party requests

This website sets no cookies. There is no analytics, no tag manager, no advertising pixel, no embedded video and no social media plug-in. Nothing is stored on your device and no consent banner is needed.

Two files are loaded from outside our own server: the typeface Plus Jakarta Sans, from Google Fonts, and the interface icons, from the unpkg content delivery network. To deliver those files your browser has to contact those services, which means your IP address and basic browser information reach them. No cookies are set by those requests and we receive no data from them. If you would rather avoid this entirely, a browser extension that blocks third-party requests will stop it; the site remains readable.

6. Who we share it with

Your data stays with us unless a supplier is needed to do the work. We use the following categories of recipient:

• Hosting provider — for the website and, where applicable, your project environment.
• Email provider — our business mailbox runs through Google (Gmail), so email you send us is stored on Google's systems.
• Accounting software and our accountant — for invoicing and the annual return.
• Bank and payment provider — for processing payments.
• Government bodies — where the law obliges us, for example the Dutch tax authority.

Where a supplier processes personal data on our behalf, we conclude a processor agreement with them, as the GDPR requires. We do not pass your data to anyone else without your instruction or a legal obligation.

7. Transfer outside the European Economic Area

Our email runs through Google, an American provider, so email correspondence may be stored on or accessible from servers outside the European Economic Area. The same applies to the content delivery services named in section 5. Such transfers take place on the basis of the European Commission's adequacy decision for the EU–US Data Privacy Framework and, where that decision does not apply, the European Commission's standard contractual clauses.

8. How long we keep it

• Enquiries that do not lead to an assignment — at most 12 months after the last contact.
• Correspondence within a project — for the duration of the assignment and up to 2 years after it ends.
• Invoices and administration — 7 years, because Dutch tax law requires it.
• Material you supplied — returned or deleted at your request; otherwise kept with the project file for the same period.
• Access credentials you gave us — deleted at handover, or as soon as they are no longer needed. We ask you to change them afterwards.
• Server logs — for the short period set by the hosting provider, normally days to a few weeks.

9. How we protect it

• Only the owner has access. There are no other employees.
• Devices are protected by full-disk encryption, a password and two-factor authentication where the service offers it.
• The website is served over an encrypted connection (TLS).
• Suppliers are chosen partly on their security and their willingness to sign a processor agreement.

No system is completely safe. If a data breach occurs that is likely to affect you, we report it to the Dutch Data Protection Authority within 72 hours where the law requires, and we tell you directly where the law requires that too.

10. Your rights

Under the GDPR you can ask us to:

• Give you access to the personal data we hold about you (article 15).
• Correct data that is wrong or incomplete (article 16).
• Delete your data, where no legal retention obligation stands in the way (article 17).
• Restrict processing while a dispute about accuracy or lawfulness runs (article 18).
• Hand over the data you provided, in a common machine-readable format (article 20).
• Stop processing based on a legitimate interest, by objecting to it (article 21).
• Withdraw consent at any time, where consent was the basis. Withdrawal does not affect what was lawful before it (article 7(3)).

Send your request to pulsify.zakelijk@gmail.com. We answer within one month. If a request is complex we may extend that by two months, and we will tell you within the first month if we do. We may ask a question to confirm that you are who you say you are — but we will never ask for a copy of your identity document. Exercising these rights is free of charge.

11. Complaints about how we handle your data

Tell us first, by email: it is usually the fastest way to fix something. If that does not resolve it, you have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl. If you live or work in another EU member state, you may also complain to the supervisory authority there.

12. Automated decision-making

We take no decisions about you by automated means that produce legal effects or similarly significantly affect you. Automated tools are used in producing content, which is described in our terms and conditions; those tools do not make decisions about you as a person.

13. Changes to this statement

We may amend this statement, for example when we change a supplier or a service. The current version and its date are shown at the top of this page. For a significant change affecting an ongoing assignment, we tell you by email.