Privacy statement

This is a translation. The Dutch version is legally binding; in case of any difference, the Dutch version prevails. Read the Dutch version.

1. Who is responsible

Clovay is a sole proprietorship, established in Voorburg, registered with the Netherlands Chamber of Commerce (Kamer van Koophandel, KVK) under number 89092848, with VAT identification number NL004690750B51. Clovay is the controller for the processing described in this statement. Questions can be sent to info@clovay.com.

2. What data and for what purpose

The contact form. Your name, your email address and the text you enter. We use these to contact you about your request. We ask for nothing more, and no fields are sent along without you knowing.

Email and telephone. What you send or tell us when you contact us directly, including the data contained in that correspondence.

WhatsApp. If you send us a message via WhatsApp, we use it only to reply to you. WhatsApp also processes that message itself, under its own privacy policy.

Customer administration. For an assignment: the contact details of the people we work with, and what is needed for the administration and the invoicing.

Visitor behaviour is not tracked. The site has no analytics, no tracking pixels and no advertising networks.

3. Legal basis

For contact following your request: our legitimate interest in responding to those who approach us, and the steps prior to entering into an agreement (Article 6(1)(f) and (b) of the GDPR, the General Data Protection Regulation; in Dutch: Algemene verordening gegevensbescherming, AVG).

For the performance of an assignment: the agreement itself (point (b)). For the administration: our statutory retention obligation (point (c)).

4. How long we keep data

Requests that do not lead to working together are deleted within six months.

We keep customer data for as long as the agreement runs and after that for as long as necessary. The statutory retention period of seven years applies to the financial administration.

5. Who else sees your data

We do not sell anything on and do not provide anything to third parties for their own purposes.

To run the website, to process the contact form and for our email, we engage a limited number of service providers. They process data exclusively on our behalf and according to our instructions, and a data processing agreement has been concluded with each of them. The contact form is processed within the European Union.

If you would like to know which parties these are, we will send you that list on request. Email privacy@clovay.com.

6. Cookies

This website does not place cookies and therefore does not ask for consent. What does get stored on your device is set out in the cookie statement.

7. Security

The site can only be reached over https. Data from the contact form goes directly to our mailbox and is not stored in a database of the website. Access to the mailbox and to the systems of clients is limited to those who need that access and is protected with two-factor authentication.

To prevent the contact form from being misused by automated programs, we check every submission. In doing so we look at a hidden field that a person never fills in, at the time between opening and sending, and at the number of submissions from the same network address. In addition, we use Cloudflare Turnstile, a check that tells people and programs apart.

Turnstile is only loaded once you touch the form, places no cookie and stores nothing on your device. No profile of you is built and the result is not kept: we are told once whether the check was passed, and that is where it ends. Cloudflare already delivers this website anyway, so no new party is added for this. More about this is in the cookie statement.

8. Your rights

You may access your data, have it corrected, have it deleted, have the processing restricted, and object to processing on the basis of legitimate interest. You can also ask for your data to be transferred.

Email info@clovay.com for this. We respond within one working day and in any case within the statutory period of one month. We may ask you to confirm that it is you, so that we do not give data to the wrong person.

9. No profiling

We do not make decisions about you based on automated processing, and we do not create profiles. What you send us is read by a person.

10. Data breaches

If something goes wrong with personal data, we report it within 72 hours to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) when the law requires this, and directly to you when it is likely to result in a high risk to you.

11. Complaints

If we cannot resolve it together, you can file a complaint with the Dutch Data Protection Authority. We would rather hear about it ourselves first, so that we can put it right.

12. Changes

If the way we handle data changes, we will update this statement. The date at the top shows which version applies.