Back

Privacy & cookies

Last updated October 2026

Who is responsible

This site is run by Alfred Westerveld, a sole trader (eenmanszaak) based in the Netherlands. I am the data controller under the GDPR. For anything on this page, including access, correction or deletion requests, email hello@alfredwesterveld.com. I have no data protection officer.

What I collect

When you send a form. The performance check asks for your website and email address. The contact form asks for your name, email address, message and, optionally, a website. The quote form asks for the same, plus your company, a call-back checkbox and a careers-page checkbox. Each submission also records the page path and which form it came from. I need these details to respond; without them I cannot.

The form is delivered by Cloudflare's email service to my mailbox, which is hosted by Google (Gmail). The notification email contains a signed reply link that encodes your email address, name, website and the start of your message; the link expires after 30 days. There is no CRM, no mailing list and no advertising platform. I keep correspondence for up to 24 months after our last contact, and for 7 years where work was invoiced (tax law requires this). I delete it earlier on request.

Spam protection. Forms use Cloudflare Turnstile, loaded only on pages that have a form. It processes your IP address and browser characteristics to tell people from bots and sets no cookie. Your IP address is sent to Cloudflare once for server-side verification. My server also counts submissions per IP address for about 2 minutes to stop flooding, then the count is deleted automatically. If you are wrongly blocked, email me.

Analytics

Before you decide anything. Google Analytics 4 runs in consent mode with storage denied: no cookie and no identifier on your device. Google receives the page, the referrer and your browser type, and it receives your IP address, which it truncates. I also record button clicks and whether a form was sent, never what you typed into it. The basis is my legitimate interest in understanding how the site is used; object by email and I will exclude you.

Cloudflare Web Analytics. Records the page, referrer, browser type and load speed, plus a country derived from your IP address. The IP address is not stored, there is no cookie or fingerprint, and the results are aggregate. Data is kept for a limited period set by Cloudflare.

Counting form submissions. When a form is sent successfully, the server adds one tally: which form, the language and the page. It is stored at Cloudflare for 3 months and then deleted. It holds no name, email address or IP address. Basis: legitimate interest.

If you allow analytics. Only then:

  • Google Analytics 4 switches to cookies, so a visit is seen as one journey and returning visitors are recognised. User- and event-level data is kept for 2 months; aggregated statistics, which cannot be traced to individuals, are kept longer for trend analysis.
  • Microsoft Clarity loads for the first time. It makes session recordings and heatmaps of clicks, scrolls and mouse movement. Typed text is masked. Retained for 13 months.

Advertising storage is always refused and nothing goes to advertisers.

What is stored on your device

Without consent: two localStorage keys, analytics-consent (your choice) and theme (light or dark). They are functional and never leave your device. With consent: the Google Analytics cookies (_ga, _ga_*) and the Clarity cookies (_clck, _clsk and similar).

Who processes your data

Google and Microsoft act as processors for the measurement described above. Cloudflare, Inc. (US) is a processor for hosting, email delivery, spam protection and Web Analytics. Google hosts my mailbox. Data reaches servers outside the EU on the basis of the EU–US Data Privacy Framework and standard contractual clauses.

Legal basis

  • Consent (GDPR 6(1)(a), Telecommunications Act 11.7a): cookies and Clarity. You can withdraw it at any time.
  • Legitimate interest (6(1)(f)): cookieless measurement, lead counting, spam protection, rate limiting and hosting.
  • Contract (6(1)(b)): once we agree on work.
  • Legal obligation (6(1)(c)): keeping invoiced records.

Changing your mind

Reopen the banner and choose again; it takes effect immediately. Refusing after allowing erases the Clarity cookies on your device and stops Clarity. Email me if you also want data already collected deleted.

Your rights

You can ask for access, correction, deletion, restriction, objection and a portable copy. Email me and I will reply within one month. If you are not satisfied, you can complain to the Dutch DPA, the Autoriteit Persoonsgegevens.