Who we are
This website is run by Damen Commerce, trading as basecamp-design, an eenmanszaak registered with the Dutch Chamber of Commerce (KvK) under 73462195, established in Rotterdam. For anything in this policy, including a request about your own data, write to business@basecamp-design.com.
For the personal data on this website we are the controller under the General Data Protection Regulation (the AVG in Dutch law).
What this policy covers
This policy covers the data this website collects. It does not cover the subscriber data held inside a client’s own email platform. When we work in a client’s account we act on that client’s instructions as their processor, and they remain the controller of their own list. That arrangement is set out in our terms and in a separate processing agreement.
What we collect, and why
The contact form. Your name, work email, website and message. We use them to answer your enquiry and, if it leads to work, to prepare a quote. The legal basis is the steps taken before entering into a contract, and our legitimate interest in replying to people who ask us something. The form posts to an endpoint on this website rather than to an outside form service, and that endpoint sends your message to our mailbox through Resend, our email delivery provider. Only the four fields you fill in are sent: we do not add your IP address, your browser or your location. Nothing is stored on the website itself, so our mailbox is the only copy.
Booking a call. Bookings run through Cal.com, which receives the name, email address and time you enter. The legal basis is the same as above. Cal.com processes that booking on our behalf. Their calendar is embedded in our pages, so on any page showing it your browser contacts Cal.com as the page loads, before you book anything and whether or not you go on to book. That request is what fetches the calendar; it is not analytics and we receive nothing from it.
The self-audit. The eight questions and your score stay in your browser. Nothing you answer is sent to us or to anyone else unless you then choose to contact us, in which case only what you type into the form or the booking reaches us.
Server logs. Our hosting provider, Vercel, records requests to the site, including IP address, the page requested, the time and your browser’s user agent. This happens for every website and is needed to serve the pages and to keep the site secure and available. The legal basis is our legitimate interest in a working, secure website. These logs are kept by Vercel for a short period and we do not use them to build profiles.
Email and calls. If we correspond, that correspondence sits in our mailbox and is kept as part of our business records.
Cookies, consent and tracking
Nothing is measured on this site unless you agree to it first. There are no advertising pixels and no cross-site tracking. The fonts are served from our own domain rather than from Google, so loading a page does not tell Google that you visited.
The consent banner. Your answer is stored in your own browser, under the key c15t, and
nowhere else. No consent-management company is involved: the banner is software running in the
page, not a service you are sent to.
To know whether a banner is legally required where you are, the page asks our own server which country your connection comes from. Our host, Vercel, already receives that in order to send you the page at all; we read the two-letter country code, use it to decide whether to ask you, and store nothing. That is why you are asked in the European Economic Area, the United Kingdom and Quebec, where consent is required before measurement, and not elsewhere. Where you are not asked, visit measurement runs without a banner, as local law allows.
If you say no, nothing further is loaded and nothing is measured. If you say yes, Google
Analytics is loaded to count visits and show which pages are read. It sets its own cookies,
_ga and _ga_*, which last up to two years, and it does not tell us who you are.
Changing your mind. Select “Cookie settings” at the foot of any page. You can switch measurement off again at any time, and it is no harder than switching it on.
Measurement is switched on as of 22 October 2026, which is why you may see the banner. Nothing is requested from Google before you answer it, and if you never answer, nothing is requested at all.
Who else sees the data
We use a small number of providers, each of them processing data on our behalf and under a processing agreement:
- Vercel, hosting and server logs.
- Cal.com, scheduling, when you book a call.
- Resend, delivering contact form submissions to our mailbox.
- Google Workspace, our mailbox, where that correspondence is then held.
Some of these are based in the United States. Where data reaches them, it is covered by the European Commission’s standard contractual clauses or by the EU-US Data Privacy Framework.
We do not sell personal data, and we do not share it with anyone else unless the law requires it.
How long we keep it
- Enquiries that do not become work: up to 12 months after our last contact, so we can pick up the thread if you come back.
- Client records, invoices and the administration around them: seven years, which Dutch tax law requires.
- Server logs: the short retention period set by our hosting provider.
Your rights
Under the AVG you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or hand it to another provider. You can object to processing we base on legitimate interest. Where we rely on consent, you can withdraw it at any time.
Write to business@basecamp-design.com and we will answer within one month. There is no charge. If you are not satisfied with how we handle it, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Security
The site is served over HTTPS. Two pieces of third-party code can run on it, and nothing else: the Cal.com booking calendar, which loads on the pages that show it so that it can display our availability, and Google Analytics, which loads only if you allow measurement. Access to our mailbox and to client platforms is protected by two-factor authentication.
Children
This site is aimed at businesses. We do not knowingly collect data about anyone under 16.
Changes
If this policy changes we update the date at the top. Anything that materially affects a client is also sent to them by email.
Last updated: 22 October 2026.