Privacy Statement

VasteStroom (KvK number 71734163, VAT number NL002473429B33), referred to below as 'we' or 'VasteStroom', is the data controller for the personal data processed through this website. For questions about this privacy statement, please contact us at info@VasteStroom.nl or +31 6 85005076.

We only collect the data you enter yourself in the contact form on this website:

This website does not collect personal data from you in any other way: there is no account and no login, and your browsing behaviour is neither tracked nor profiled. We do count, anonymously and only as totals, how often pages are visited, without cookies and without recognising you; see section 10.

We use your data solely to contact you, at your own request, about your quote request or question. The legal basis for this is Article 6(1)(b) GDPR: the processing is necessary to take pre-contractual steps at your request, with a view to a possible agreement between you and VasteStroom.

When you submit the contact form, its content is sent directly as an email to VasteStroom's own business mailbox. There is no database and no CRM system in which your data is separately stored: the email itself is the only place your request ends up. Your email address is set as the reply-to address, so that we can reply to you directly.

If you attach a photo to the contact form, it is sent as an attachment with that same email. We do not store the photo anywhere ourselves: there is no upload folder on the server, and it is not kept in any archive or database. Technically, the web server does place the file in a temporary file for the duration of the upload, which the server deletes automatically as soon as your request has been processed. After that, the photo exists only as an attachment in our mailbox.

To protect the contact form against spam and abuse, we keep one technical security measure: for a maximum of 10 minutes, a temporary file on the server stores a one-way SHA-256 hash of your IP address, together with the time of your submission. Your actual IP address is never stored, only the hash. This data expires after 10 minutes and is cleaned up automatically on a subsequent submission; it is used for no other purpose. The legal basis for this is our legitimate interest (Article 6(1)(f) GDPR) in securing the website and preventing abuse.

Besides the form, you can also choose to contact us via the WhatsApp button on this website. If you do, you leave our website and start a conversation in WhatsApp, a Meta service. That conversation, and any data you share in it, falls outside our website and is governed by WhatsApp's/Meta's own privacy policy. We have no influence over how WhatsApp/Meta processes that data; please consult WhatsApp's privacy policy for details.

On the contact page we do not show a map by default. Only once you click 'Accept' in our cookie banner, or otherwise click the 'Show map' button yourself for that one visit, do we load an interactive Google Maps map in an embedded window (iframe). Before that moment, nothing is sent to Google and Google places no cookies on your device.

As soon as the map loads, Google receives data such as your IP address and browser information, and Google may place its own cookies from that point on. This processing is governed by Google's privacy policy, over which we have no control. See our cookie statement for more information.

As is standard for almost any website, our hosting provider keeps standard server logs (such as IP address, time, and requested page) for the technical operation, security, and troubleshooting of the website. We do not use these logs for profiling or marketing purposes.

We keep simple visitor statistics for this website: per day the number of page views, an estimate of the number of different visitors, which pages were visited, which website visitors may have arrived from, and the mobile/desktop split. These are totals only: no profile is built, no visitor is followed and no individual visit is kept.

No cookies are used for this and nothing is placed on your device or read from it. The counting happens on our own server; no third parties are involved and no data is shared with analytics services such as Google Analytics.

To be able to estimate how many different visitors a day had, we process your IP address only temporarily on the server: it is immediately turned into an irreversible SHA-256 hash, together with your browser's technical details (the so-called user agent) and a secret value (salt) that changes every day. Your IP address itself is never stored. A day's hashes are erased at the end of that day - so within 24 hours - after which only a number remains, which can no longer be traced back to a person.

The legal basis for this is our legitimate interest (Article 6(1)(f) GDPR) in the proper functioning and the improvement of this website. We do not use these figures for profiling, for advertising, or for automated decision-making.

Your request, as an email, stays in our mailbox for as long as needed to handle your request and, if it results in an assignment, for as long as the statutory (tax) record-keeping obligation requires. The rate-limit hash of your IP address is deleted automatically after no more than 10 minutes.

We never sell or rent out your data to third parties. Your data is only 'shared' in the following cases:

Under the GDPR you have the right to access, correct, or delete your data, to object to its processing, to have processing restricted, and, where applicable, to have your data transferred. To exercise these rights, contact us at info@VasteStroom.nl or +31 6 85005076. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

We may amend this privacy statement, for example when the website is extended with new functionality. The most current version is always available on this page.