Privacy Policy

1. Data Controller Information

The data controller responsible for the processing of personal data collected through this website is:

2. Scope of Personal Data We Process

We adhere strictly to the principle of data minimization. We only collect and process personal data when you voluntarily provide it through our project inquiry form:

• Identification details: Full Name.
• Professional contact data: Business email address, company or organization name.
• Project parameters: Solution area of interest, estimated budget range, timeline, and submitted project requirements.
• Technical diagnostic data: IP address (masked for rate-limiting), submission timestamp, and browser metadata for spam prevention.

3. Legal Basis for Processing (Article 6 GDPR)

We process your data under the following lawful bases:

• Performance of Pre-Contractual Steps (Art. 6(1)(b) GDPR): Responding to your inquiry and preparing project scopes or commercial proposals.
• Legitimate Interests (Art. 6(1)(f) GDPR): Ensuring website security, network defense, spam suppression, and business communication integrity.
• Consent (Art. 6(1)(a) GDPR): For any non-essential analytics cookies, if explicitly granted via our cookie preferences banner.

4. Data Retention Periods

We do not retain personal data longer than necessary for the fulfillment of the purposes outlined:

• Inquiry messages: Retained for a maximum of 24 months to support ongoing commercial dialogue, after which they are securely deleted unless a binding service contract is executed.
• Security logs & IP records: Retained for a maximum of 30 days for abuse prevention and then automatically overwritten.

5. Third-Party Disclosures & Sub-Processors

We never sell, rent, or trade your personal data. Data is processed exclusively by verified infrastructure partners operating under formal Data Processing Agreements (DPAs):

• Hosting & Edge Infrastructure: Vercel Inc. (compliant with standard contractual clauses).
• Transactional Email Dispatcher: Resend / SMTP provider (only when configured).

6. Your Rights Under GDPR / AVG

As a data subject in the European Economic Area, you hold the following rights:

• Right of access to your personal data (Art. 15 GDPR).
• Right to rectification of incorrect data (Art. 16 GDPR).
• Right to erasure (“Right to be forgotten”) (Art. 17 GDPR).
• Right to restriction of processing (Art. 18 GDPR).
• Right to data portability (Art. 20 GDPR).
• Right to lodge a complaint with a supervisory authority (in the Netherlands: Autoriteit Persoonsgegevens).

To exercise any of these rights, contact us at info@nability.nl.