Privacy statement

Who is responsible

What I collect, and why

Booking and contact forms: your name, email address, and — depending on the form — your company, a preferred date, and any notes you write. I use these only to answer you and to arrange a workshop. The legal basis is the steps taken at your request before entering into an agreement (Article 6(1)(b) GDPR).

Signing up for a pop-up workshop: your name and email address are stored in a database (Supabase, hosted in the EU), so that I know who is coming and how many seats are left. Nobody else can see that list — the website only ever publishes the number of seats remaining, never who took them. If you book on your employer's account you also give the company name, invoice address and, optionally, its VAT number. Every sign-up is invoiced, and that invoice is stored. The legal basis is the agreement itself (Article 6(1)(b) GDPR) and, for keeping the invoice, my legal obligation to do so (Article 6(1)(c) GDPR).

Feedback form: your name, company, your feedback, optionally your email, and your yes/no answer to whether I may quote you. Quoting you on this site happens only if you answered yes — that publication rests on your consent (Article 6(1)(a) GDPR), and you can withdraw it at any time by emailing me.

Spam prevention: submissions pass through an anti-abuse check and a rate limiter. The anti-abuse check processes your IP address; the rate limiter only ever stores a one-way hash of it, briefly, and never the address itself. The basis is my legitimate interest in keeping the forms usable (Article 6(1)(f) GDPR).

Analytics and advertising: only if you accept them in the cookie banner. The basis is your consent, and you can withdraw it by clearing this site's data in your browser, which makes the banner ask again.

What I do not do

I do not sell your data, and I do not send marketing email to addresses collected through these forms. Form submissions reach my mailbox, and — for pop-up sign-ups only — the attendee list described above. They go nowhere else.

How long it is kept

Inquiry and booking emails: for as long as needed to answer you and to run the workshop, and after that for as long as tax and administrative obligations require.

Pop-up attendee lists: deleted within three months of the workshop taking place. Ask sooner and I will remove you sooner.

Invoices: kept for seven years. Dutch tax law requires it, so this is the one thing I cannot delete on request — an invoice records what you agreed to pay and stays as issued.

Feedback: until you ask me to remove it. A published quote is removed on request.

Cookies: for the periods listed in the cookie table below.

Who processes data on my behalf

These providers handle data as part of running the site. Some are established outside the EU; those transfers rely on the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.

Cookies

Nothing in the analytics or advertising categories is set until you accept. Declining leaves only the two functional items at the bottom of this table, which are needed for the site to remember basic choices.

Your rights

You can ask to see the data I hold about you, to correct it, to delete it, to restrict or object to its use, and to receive it in a portable form. The one exception is an issued invoice, which the seven-year retention obligation above puts beyond my discretion. Where processing rests on your consent, you can withdraw that consent at any time, which does not affect what was lawful beforehand.

Email auke@hilosemantics.com and I will handle it. If you are not satisfied, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

Changes

If this statement changes materially, the cookie banner will ask again rather than assume your earlier answer still applies.