Privacy statement

1. Who we are

Indevor B.V. ("Indevor", "we") is responsible (the "controller") for processing the personal data described in this statement. We are a technology company based in the Netherlands.

2. What data we process, why, and on what legal basis

Contact form and introduction requests

Name, company name, e-mail address, the subject of your request, your description, the page you came from, your language and the time of sending. We use this to reply, schedule an introduction and, if you want, prepare a proposal.

Legal basis: taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering questions (Art. 6(1)(f) GDPR).

E-mail, phone and WhatsApp

The details and content of your message when you contact us directly. We use this to answer your question.

Legal basis: steps before a contract (Art. 6(1)(b)) or our legitimate interest in answering questions (Art. 6(1)(f)).

Clients

Contact and company details, agreements, project communication and invoicing data, to carry out our agreement and meet our administrative and tax obligations.

Legal basis: performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)).

Spam protection

When you send the form, we temporarily store a one-way encrypted (hashed) version of your IP address for one hour to block automated spam. We do not use a captcha or third-party spam service.

Legal basis: legitimate interest in a secure website (Art. 6(1)(f)).

Website security and server logs

Like every website, our web server processes technical data such as IP address, browser type and the time of your visit, to deliver the site and protect it against abuse. These logs are kept only for a short period.

Legal basis: legitimate interest in a working, secure website (Art. 6(1)(f)).

Article statistics

For our articles we count how often they are visited by AI search engines and via AI answer sites. To avoid double counting, a hashed IP address is kept for at most 30 minutes. We do not build visitor profiles.

Legal basis: legitimate interest in understanding the reach of our content (Art. 6(1)(f)).

We do not use automated decision-making or profiling that has legal or similarly significant effects for you. We do not process special categories of personal data, and this website is not intended for children under 16.

3. Cookies

This website uses functional cookies: "ind_lang" remembers whether you prefer Dutch or English, and "ind_consent" remembers your cookie choice. They contain no personal data, are not shared with anyone and expire after one year. Because they are strictly functional, no consent is required.

We only place analytics cookies (Google Analytics) after you have given permission via the cookie notice. We use Google Consent Mode: without your permission no analytics cookies are placed. IP addresses are anonymised, data is not shared for advertising and is only used to improve the website. You can change your choice at any time via “Cookie settings” at the bottom of every page.

We do not use advertising or social media cookies. Fonts and icons are hosted on our own server, so your visit is not passed on to third parties unasked.

4. Who we share data with

We never sell your personal data. We only share it with parties that help us run our business, such as our hosting provider and e-mail provider, and — for clients — our accountant. These parties process data only on our instructions and under a data processing agreement (Art. 28 GDPR), or are themselves bound by confidentiality.

Some links take you to services that have their own privacy policy. If you click a WhatsApp button, WhatsApp (Meta) processes your data under its own terms. If you use our booking link, the booking service processes the details you enter. We may also share data when the law requires us to.

5. Transfers outside the EU/EEA

If personal data is transferred to a country outside the European Economic Area, we only do so when an adequate level of protection is guaranteed, for example through an adequacy decision of the European Commission or the EU Standard Contractual Clauses.

6. How long we keep your data

Contact requests: deleted automatically 24 months after we receive them, unless you become a client or ask us to keep in touch.
Client and invoicing data: 7 years, as required by Dutch tax law.
Spam-protection data: 1 hour. Article statistics: 30 minutes.
If you withdraw your consent or ask us to delete your data, we do so without undue delay, unless the law requires us to keep it.

7. How we protect your data

We take appropriate technical and organisational measures, including an encrypted (HTTPS) connection, limited access for authorised staff only, strong authentication, regular updates and backups. If a data breach occurs that poses a risk to you, we will report it to the Dutch Data Protection Authority and, where required, inform you.

8. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you;
have incorrect data corrected;
have your data deleted ("right to be forgotten");
restrict the processing of your data;
receive your data in a machine-readable format (data portability);
object to processing based on our legitimate interest;
withdraw your consent at any time, without affecting processing that took place before.

Send your request to hello@indevor.eu. We respond within one month. To make sure we give the data to the right person, we may ask you to verify your identity — never send us a copy of your passport or ID without hiding your photo and citizen service number (BSN).

9. Complaints

Not happy with how we handle your data? Please tell us first, we will do our best to resolve it. You also have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via autoriteitpersoonsgegevens.nl.

10. Changes to this statement

We may update this privacy statement when our services or the law change. The latest version is always on this page, with the date of the last update at the top.