Privacy policy.
What personal data Birrejan processes, why, for how long, who else sees it, and what you can ask of me. Short version: as little as possible and never sold.
01Who is responsible
The controller for your personal data is Jan Gimenez Layola, trading as Birrejan, Koraaldijk 22, 4706 KA Roosendaal (NL), Chamber of Commerce (KvK) 42206299.
For anything about your data, email privacy@birrejan.me. I'm a one-person business, so you'll get an answer from me directly, within one month at the latest.
02What I process, why, and for how long
Visiting this website
Like every web server, the one hosting this site records technical data for each request: your IP address, browser, the page requested and the time. IONOS, my hosting provider, keeps these server logs to run the site and protect it against abuse, and deletes them automatically after a short period. I don't use them to identify or follow visitors.
Legal basis: my legitimate interest in a secure, working website (Article 6(1)(f) GDPR).
IONOS Web Statistics provides aggregate information about visits and page requests using hosting records. IONOS says it anonymises IP addresses and does not use cookies for these statistics. The website also stores your light or dark theme preference in your browser when you choose it. Fonts are served by this website; no third-party content is embedded. See Cookies.
The contact form
When you send the contact form, I receive your email address, your message, the selected service, the language of the page and the date. When available, I also receive the first page visited, the referring website and campaign labels to understand where enquiries come from. This information is passed through links within this website and added to the CRM only when you submit the form; it is not stored in your browser. I use them to answer you and, if you want, to prepare a proposal.
- The message is emailed to my mailbox through Postmark, stored in a database on my web server, and added to my self-hosted Odoo Community CRM so I can manage the enquiry.
- The web server deletes database copies older than 12 months when a new enquiry is submitted. I review CRM records and remove enquiry details within 12 months unless an assignment follows. Mailbox copies are kept while relevant, for at most 2 years if no assignment follows.
- To limit spam, the form stores a keyed hash of your IP address. Entries older than one hour are removed when a subsequent request triggers the rate-limit check; they may remain longer without another request. A keyed hash is pseudonymous, not necessarily anonymous.
Legal basis: taking steps at your request before a possible contract (Article 6(1)(b) GDPR), or my legitimate interest in answering questions sent to me (Article 6(1)(f)).
Emailing me directly
If you email me, I process your email address, name and whatever you write, to answer you. Same legal basis and retention as the contact form.
Booking a call
The "Book a 30-min call" button opens a booking page on Proton Calendar. There you enter your name and email address and pick a time. Proton AG processes that data for me, and I use it to hold the call. I delete the booking details within 12 months unless an assignment follows.
Legal basis: steps at your request before a possible contract (Article 6(1)(b) GDPR).
The newsletter
If you subscribe, I store your email address, when you signed up and confirmed, and a confirmation code. You only receive emails after confirming through the link in the first email (double opt-in). Emails are sent through Postmark, with no open or click tracking.
Every email has an unsubscribe link that opens a confirmation page; supported email clients can also offer one-click unsubscribe. When you unsubscribe, I keep your address marked as unsubscribed so you are never emailed again by mistake; email me if you want it erased completely.
Legal basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.
Clients
If you become a client, I process the contact details of you and your colleagues, the agreements, project communication, invoices and payment details, to carry out the assignment and keep my accounts.
Legal basis: performing a contract with you as an individual (Article 6(1)(b) GDPR), my legitimate interest in communicating with business contacts and delivering the client’s project (Article 6(1)(f)), and compliance with legal obligations (Article 6(1)(c)). Dutch tax law requires me to keep my administration, including invoices, for 7 years. Other project data is deleted or returned within 12 months after the work ends, unless we agree otherwise.
When I process personal data for you as part of a project, for example your customers' data in a system I build, I act as your processor and the data processing agreement applies.
Unconfirmed newsletter requests and suppression records remain in the newsletter database until deleted. Backups may retain deleted data until they are rotated or erased; restored data is subject to the same deletion rules. Contact me for the applicable retention period or criteria for server logs and backups. I keep manual backups of Odoo for two years; they can contain enquiries and other CRM data.
When you use the withdrawal form, I process your email address, contract reference or service description, and submission time to handle and confirm your request and retain the record as needed to meet legal obligations or defend claims. The legal bases are legal obligation and legitimate interest (Article 6(1)(c) and (f) GDPR).
03AI tools
I use AI tools, including models from OpenAI and Anthropic, in my work to develop and review software and help with communications. Depending on the task, information you provide may be processed using these tools. Client personal or confidential information is submitted to them only with the client’s authorisation. I may use genuinely anonymised information; pseudonymised data remains personal data. I assess the need, confidentiality and data-protection safeguards before use. Where I process personal data on a client’s behalf, the agreed instructions, authorised providers and safeguards in the data processing agreement apply.
I do not use solely automated decisions that produce legal or similarly significant effects about you.
04Who else processes your data
I do not sell your data or share it for third parties’ own marketing. Depending on the service, the following providers and recipients may process it:
- IONOS SE (Germany): web hosting, the contact and newsletter databases, server logs and aggregate web statistics.
- Postmark, run by AC PM, LLC (United States): sends the contact form and newsletter emails. Postmark keeps a copy of each email for a limited period (45 days by default) to show its delivery status.
- OpenAI and Anthropic: AI services used where relevant to the work, subject to the safeguards and authorisations described above. Their services may involve processing outside the EEA.
- Proton AG (Switzerland): my mailboxes and the call booking page.
- My accountant and the Dutch Tax Administration, for client invoices, when the law requires it.
Switzerland has a European Commission adequacy decision. Postmark’s published data processing addendum includes the European Commission’s standard contractual clauses for relevant international transfers. Contact me for information about the applicable safeguards and how to obtain a copy.
05Your rights
You can ask me at any time to:
- see the personal data I have about you, and get a copy;
- correct it or complete it;
- delete it, when I no longer need it or have no legal reason to keep it;
- restrict how I use it, or object to processing based on my legitimate interest;
- receive the data you gave me in a common format to take elsewhere (data portability);
- withdraw your consent, for example for the newsletter, without affecting what happened before.
Email privacy@birrejan.me. I may ask you to confirm your identity before handing over data.
If you think I handle your data wrongly, please tell me first. You also have the right to complain to a data protection authority: the Autoriteit Persoonsgegevens in the Netherlands, or the authority where you live, such as the AEPD in Spain or the APDCAT in Catalonia.
06Security
The website only works over an encrypted connection (HTTPS). The contact and newsletter data sit outside the public part of the web server, the accounts I use are protected with two-factor authentication, and my laptop is encrypted. Access is restricted to authorised people and service providers as needed to operate and secure the service.
07Changes
If the way I process data changes, I'll update this page and its date. If a change affects newsletter subscribers or clients, I'll tell them by email.