Privacy statement

1. Controller

Initial Commit (sole proprietorship (eenmanszaak)), Herculesstraat 1, 7521 DJ Enschede, the Netherlands. KVK number 42120516. For questions about your data: abdullahtopal@proton.me.

2. Which data and what for

We use no analytics, no advertising or tracking techniques, and make no automated decisions about you.

• Contact form: name, company name, email address, phone number (if you enter it), the chosen service, budget, timing and your description. We use this to answer your enquiry. The enquiry reaches us by email and you receive a confirmation with the same details; it is not stored in our database.
• Subscription and account: name, business name, KVK number, email address, phone number (optional), the chosen plan, a preferred domain name (and its transfer code, if you provide one; we delete it after the transfer), your change requests, the content and images of your website, and the version and time of your acceptance of the terms. This is needed to provide the subscription.
• Payment: payments are handled by Mollie. We only store Mollie's references (customer, subscription, mandate), no bank or card details.
• Signing in: you sign in with a one-time link sent by email. We only store a hash of that link, which is valid for 15 minutes.
• Security: we use your IP address briefly, in the server's memory, to limit abuse of forms. If our spam filter is triggered, the IP address is written to the server log.

3. Legal bases

• Performance of the contract: account, subscription and payment.
• Steps prior to a contract, at your request: answering an enquiry.
• Legitimate interest: protecting the website against abuse.
• Legal obligation: keeping invoice records.

4. Who receives the data

We use these parties. They process data only on our instructions.

• Brevo — sending email (confirmations, sign-in links, notifications to us).
• Mollie — handling payments and automatic collection.
• Neon — hosting the database with account data.
• OVHcloud — the server that holds the website and uploaded images, in Frankfurt, Germany.

5. Public data

Everything you put on your own website, including images, is public once you publish the site. Uploaded images can be reached by anyone who knows the address of the image.

6. Retention

• Account data and website content: for as long as your subscription runs. After it ends we delete them at your request.
• Signups that are not paid for: 30 days, so you can still complete the order. After that we delete them automatically.
• Sign-in links: expire after 15 minutes and are deleted at the next sign-in request.
• Invoice and payment records: 7 years, because of the Dutch tax retention obligation.

7. Your rights

You have the right to access, correct, erase, restrict, object to and port your data. In your account you can download all your data. For erasure or other requests, email abdullahtopal@proton.me; we respond within one month.

If you disagree with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

8. Cookies

We only set cookies that are needed to sign in. See the cookie statement.