Privacy notice

Who is responsible?

DUID. is the advisory practice of Danny Bouwman in Oss, registered with the Dutch Chamber of Commerce under 42157467. Trade names: DUID. and DUID. Eerst begrijpen. Dan verbeteren..

Registered address: Harnas 41, 5346 WR Oss. No visitors received.

Privacy questions: contact@duid.nu.

Which information is processed?

The contact form asks for your name, email address and message. These are sent to DUID. by email through its own hosting at mijn.host. The form uses no cookies or external captcha and does not save your input in browser storage. The website does not store a separate copy of the message. The email follows the retention period for enquiries.

To prevent spam, the form handler temporarily processes an IP-derived identifier protected with a secret key, request counts and used form codes. This identifier is pseudonymous, not anonymous. Message content is not included in this security record or in website analytics.

Depending on the contact or project, this may include your name, email address, phone number, role and organisation; correspondence and appointments; proposal, contract, project, invoice and payment details, including account holder, IBAN, amount and payment reference.

Video calls involve contact details and the image, audio and screen content you share. Education advice may involve education, work experience, development questions and preferences you choose to disclose. The hosting provider processes technical information for security and operation, such as IP address, time, browser and device details.

Do not send a citizen service number, identity document, medical information or other people’s records with an initial enquiry. Before a project, we agree on what information is necessary and how to exchange it safely.

When DUID. analyses or cleans personal data for a client, responsibilities are determined beforehand. Where DUID. acts as a processor, it follows the client’s instructions under a separate data processing agreement.

Information usually comes directly from you. A business client may provide contact or project details. Where DUID. is the controller, it informs the people concerned about the source and use. For education advice arranged by an employer, feedback is agreed in advance; personal conversation content is not automatically shared with the employer.

Purposes and legal bases

Contact form security: short-lived form codes, input validation and temporary request counters limit spam and overload. The legal basis is the legitimate interest in remaining reachable and protecting DUID.’s email service and visitors. No visitor profile is built and no external captcha provider is involved.

Contact, appointments and proposals: answering enquiries and preparing a possible project. For an agreement with you, this is preparation or performance of that agreement. For contact on behalf of an organisation, the basis is the legitimate interest in answering business enquiries and arranging appointments.

Advice: carrying out the agreed process, information or education advice. The basis is your agreement or, for a business contact person, the legitimate interest in carrying out the business project.

Administration and invoicing: settling project fees and meeting statutory tax and administrative obligations, based on the agreement and legal obligations.

Security and limited website analysis: the legitimate interest is maintaining a secure, working and usable website. DUID. uses only limited usage statistics to improve its own website, following a necessity and privacy assessment. No visitor profiles are built. The limited setup, retention periods and immediate objection through the disable-analysis control are described under Cookies and website analysis.

You are not obliged to provide information. Without information necessary for an enquiry, proposal or project, DUID. may be unable to handle it. Consent for any separate processing that requires it is requested separately.

Retention periods

DUID. keeps information for as long as necessary. The following maximum periods apply to its own active administration. The 12-month periods are DUID.’s policy choices, not general statutory obligations. Tax retention requirements take precedence where necessary.

Enquiries without a project: up to 12 months after the last substantive contact. Unaccepted proposals: up to 12 months after rejection or expiry, except documents belonging to the tax administration.

Form security: request counters are active for one hour and used form codes for ten minutes. Expired records are removed on the next request or by hourly scheduled cleanup. When cleanup operates normally, an expired record therefore remains for less than one additional hour. If cleanup has not run for more than two hours, the form stops sending until this is resolved. Technical hosting logs follow the separate provider retention period below.

Working files and education advice: up to 12 months after completion or agreed follow-up. Unnecessary copies and intermediate files are removed sooner. Only necessary tax records are retained separately for longer.

Invoices and tax administration: generally 7 years. For a completed financial year, the period starts at year-end. Information that remains current for longer, such as an ongoing contract, has a later starting point. Statutory exceptions, such as immovable property or the One Stop Shop scheme, require 10 years.

Data processed for a client: returned or deleted at the end of the service in accordance with the processing agreement and the client’s choice, unless statutory retention applies. DUID.’s own file retention period does not automatically apply.

Website analysis: Matomo is configured to automatically delete raw visit data older than 90 days and all aggregated report data older than 24 months. There are no retention exceptions for basic statistics or particular reporting periods. Deletion runs on a weekly schedule, so data may remain for a few additional days. These settings were checked after reloading on 15 October 2026. This confirms the configuration, not the deletion of each individual record. Hosting logs: mijn.host states a maximum of 12 months for technical and security logs where necessary. This is a provider policy, not a legal obligation to retain every log that long.

A specific complaint, dispute or legal obligation may require longer retention of only the necessary information. The reason and review date are recorded; this does not justify retaining an entire file indefinitely.

Deletion includes separate copies, email attachments and deleted-item folders. Deleted iCloud files are normally recoverable for 30 days; DUID. permanently deletes them immediately where possible. Published mijn.host terms specify backup rotation of up to 90 days. Recovery copies are not a working archive; previous deletions must be reapplied after restoration.

Service providers and international processing

DUID. uses mijn.host for business email, hosting and its own Matomo installation. Business files are stored on its own laptop and synchronised with Apple iCloud Drive. Business folders are not shared with other users; within DUID., only Danny Bouwman has access. This does not exclude technical processing by the service providers.

Gekko is used for accounting and necessary customer, invoice and administrative information, not substantive advisory conversations or complete project files. Gekko states that processing terms, including customer data, are in its user agreement and privacy statement. Archiving in Gekko is not deletion. Tax retention periods remain relevant to necessary records; availability at a supplier does not justify keeping other information indefinitely.

Payments use a Rabobank business account. The bank also processes payment data for its own statutory responsibilities as an independent controller.

The video-call service is agreed before an online appointment. Its provider processes information necessary for the connection. DUID. does not routinely record or automatically transcribe calls. Any recording requires separate agreements, prior information and an appropriate legal basis. This notice is updated where necessary when additional services are introduced.

Other disclosure only takes place where necessary and lawful for the project or a legal obligation. Personal data is not sold. Appropriate processing terms are required for providers acting as processors. mijn.host publishes a data processing agreement and a list of its service providers.

Apple’s privacy policy describes international processing and European standard contractual clauses for transfers. Synchronisation uses a personal iCloud account with standard data protection, without Advanced Data Protection. Information is encrypted, but iCloud Drive is not end-to-end encrypted with this setup. DUID. therefore does not claim exclusive technical access or storage solely within the European Economic Area. A separate business data processing agreement for this account has not been confirmed.

Gekko privacy statement · mijn.host processing agreement · Apple privacy policy · Rabobank privacy statement

Cookies and website analysis

During the transition, DUID. uses limited website analysis through its own Matomo installation at mijn.host, via analytics.duid.nu. Analysis is disabled in private previews and local tests. It measures, for example, which sections are reached, whether a section remains continuously in the central area of the active window for 5 or 15 seconds, and which links or experience examples are used. This does not establish whether someone reads or understands the text. Hidden tabs do not count towards these time thresholds.

The website disables analytical cookies and respects Do Not Track and the opt-out below. URL query parameters and external referrers are not transmitted. The server check on 15 October 2026 confirmed three-byte IP masking, use of the masked IP address for geolocation and cookieless tracking. The checked retention setup is described above under retention periods.

Matomo initially processes visit data to create reports; viewing only aggregates does not automatically anonymise the underlying records. DUID. does not use session recordings or advertising profiles and does not transmit analysis data to Matomo Cloud.

Your opt-out is stored only in your browser and contains no visitor identifier. Display language and appearance preferences are also stored locally to remember your choice, without a visitor identifier. LinkedIn links open an external website with its own privacy statement.

Limited analysis on DUID.’s own hosting

During the technical trial, only deliberately marked test visits use the own receiver. Regular visits continue to use limited Matomo analysis until the end-to-end check has passed and the production switch is explicitly enabled.

Use of predefined navigation links, contact links and experience disclosures is counted through fixed action codes. These counts and section click maps are different measurements and are not added together as a total number of clicks.

Once the matching DUID. receiver is enabled, the website uses its own limited analysis instead of Matomo. Its sole purpose is to improve this website’s clarity, navigation and usability. Under the Dutch exception for limited analytics with little privacy impact, no prior permission is requested. Where personal data are processed, DUID. relies on its legitimate interest in that improvement and in preventing misuse, following a necessity and privacy assessment. You can object immediately using the control below, without affecting the website or contact form.

This analysis uses a fixed page code, website layout version, a broad window-size class, appearance and counts of page displays. Actual window dimensions are not transmitted. On the homepage it also records coarse click positions within predefined sections, reached scroll depths and whether a section is visible in the central area of the active window for 5 or 15 continuous seconds. These are schematic section maps, not exact page overlays, eye tracking, average reading time or proof of reading. Technical checks are kept separate from regular traffic.

No names, email addresses, form interactions or contents, typed text, URLs or referrers are sent in the analysis payload. There is no visitor or session identifier, fingerprint or recording. A one-off batch code prevents a repeated transmission from being counted twice; it is not a permanent browser identifier. The server necessarily receives an IP address during transport and may use it briefly for abuse prevention. This is not a claim that all technical processing is anonymous.

Do Not Track, Global Privacy Control and your earlier opt-out take precedence. Disabling analysis stops collection and clears unsent events; it does not erase already received aggregate counts, which cannot be selected by visitor. Only preferences and a migration flag are saved locally, without an identifier. The website never sends the same page display to both systems. Once this browser has used the own receiver, an outage pauses analysis rather than silently restoring Matomo. There is no persistent event queue. Unmeasured visits or failed deliveries are gaps, not zero activity. A different window-size class or appearance ends that measurement sample so different contexts are not silently mixed.

The own receiver aggregates events directly into daily totals and does not retain the raw event body. Aggregate reports are kept for up to 24 calendar months. Batch codes with payload hashes used to prevent duplicate counting are kept for 31 days. Abuse counters use a daily keyed IP-derived code, not a stored raw IP address, for at most 24 hours. These are technical policy periods, not general legal retention duties. Hosting-provider logs are separate and follow the periods described above.

Your rights

You can request access, correction, deletion, restriction or transfer of personal data, or object to processing. Email contact@duid.nu. Additional identification may be requested to protect the data. Applicable rights depend on the processing. You may also complain to the Dutch Data Protection Authority, Autoriteit Persoonsgegevens.

You normally receive a response within one month. For a complex request, this may be extended by up to two months; the reason is communicated within the first month. Where processing is based on consent, you may withdraw it at any time. This does not affect the lawfulness of earlier processing.

Contact the Dutch Data Protection Authority

Security and changes

DUID. takes appropriate technical and organisational measures to protect personal information. This notice is updated when the website, services or providers change. The current version date is shown above.