Privacy statement.

This statement explains which personal data ACT en Verbeeld processes, why, and what your rights are.

Who is responsible?

ACT en Verbeeld, Fleur de Fouw, Willibrorduslaan 5, 5521 KA Eersel, the Netherlands. KvK 99936941. Questions about privacy can be sent to info@actenverbeeld.nl.

Which data and what for?

• Contact form and chat window: your name, email address, possibly your phone number and your message. I use these to respond to your question and plan an introduction. You do not have to share anything about complaints here.
• Phone, email and WhatsApp: what you share yourself, so I can answer you. Do not share medical details via WhatsApp. WhatsApp is a service of Meta. If you prefer not to use it, call or email instead.
• Therapy: during a programme I keep a file. You can read more about this in the terms and conditions. I only share the file with your explicit consent.
• Invoicing: the data needed for the invoice and the administration.
• Website visits: I count page visits. This records the page, the type of device and the browser, plus an obscured code instead of your IP address. That shows me which pages are read, not who you are.

On what legal basis?

• Answering your question and planning an introduction: steps you request before we enter into an agreement, and my legitimate interest in responding to messages.
• Therapy and file: the performance of our agreement. Health data is a special category of personal data; I only process it with your explicit consent.
• Invoicing and administration: my legal obligation.
• Website visits and security: my legitimate interest in keeping the site secure and seeing which pages are read.

Cookies

The website only uses cookies it needs to work, for example to secure the contact form. There are no advertising or analytics cookies.

Who receives your data?

I do not sell your data. The website is technically managed by an external administrator, who has access to the data on the server for that purpose. I also work with Hetzner (hosting, Germany), Cloudflare (image storage, without visitor data) and Resend (sending messages from the form and chat). Fonts come via jsDelivr and Bunny Fonts and the map on the contact page via OpenStreetMap. These services see your IP address when doing so.

My email and administration are with Proton, based in Switzerland, with servers in Switzerland, Germany and Norway. Switzerland has a level of protection recognised by the European Commission, and the GDPR applies in Norway.

Is data processed outside Europe?

Resend is an American company and stores data in the United States. The EU-US Data Privacy Framework and the standard contractual clauses of the European Commission apply. WhatsApp (Meta) may also process data outside Europe.

How long do I keep data?

• Financial administration: as long as the Dutch Tax Administration requires, usually seven years.
• File and messages: no longer than needed for the purpose they were collected for.

Your rights

You can view, correct or delete your data, as far as the law allows. You can also restrict its use, object to it, have your data transferred and withdraw any consent given. Send an email to do so. If you are not satisfied with how I handle your data, you can file a complaint with the Dutch Data Protection Authority.