Privacy policy
Last updated: 2026-09-15
This page explains what personal data we collect through civsecsmart.com, why, how long we keep it, and what your rights are. Short version: we only collect what you send us through the contact and quote forms, we never sell data, and we use no advertising trackers.
1. Who is responsible
CivSec S.M.A.R.T B.V. is responsible for the personal data processed through this website (the "controller" under the GDPR).
- Registered name: CivSec S.M.A.R.T B.V.
- Chamber of Commerce (KVK): 98045768
- VAT (BTW): NL868337237B01
- General contact: hello@civsecsmart.com
- Privacy questions and requests: dpo@civsecsmart.com
- Security disclosures: security@civsecsmart.com (see security.txt)
- Legal: legal@civsecsmart.com
CivSec S.M.A.R.T B.V. is a subsidiary of CivSec Group B.V. (KVK 98032615), a Dutch holding company. CivSec Group B.V. does not process data collected through this website.
2. What we collect and why
| What you do | What we collect | Why | Legal basis (GDPR) |
|---|---|---|---|
| Send the contact form | Subject, first and last name, email address, country or region, your message, and if you fill them in: company name, phone number, service of interest | To answer your question | Our legitimate interest in replying to people who contact us (Art. 6(1)(f)); for questions about an assignment: steps before a contract (Art. 6(1)(b)) |
| Send a quote request | Name, email address, country or region, service, your answers about the project (scope, planning, budget range, materials you already have), and if you fill them in: company name, phone number, current website, how you found us, preferred way of contact | To scope your project and send a proposal | Steps before a contract at your request (Art. 6(1)(b)) |
| Message us on WhatsApp or email | Whatever you send us, plus your phone number or email address | To reply | Legitimate interest (Art. 6(1)(f)); for assignments: Art. 6(1)(b) |
| Visit the website | Technical data that any web server receives: IP address, browser type, time of the request, requested page | To deliver the pages, keep the site secure, and block abuse (rate limiting on the forms) | Legitimate interest in a working, secure website (Art. 6(1)(f)) |
3. Who receives your data
We do not sell or rent personal data. The following companies process data on our behalf, only for the purposes above:
| Company | What they do for us | Where |
|---|---|---|
| Vercel, Inc. | Hosts the website, runs the form handlers, and measures cookieless visitor and speed statistics | The site is served from the EU region; the company is in the United States. Transfers are covered by the EU-US Data Privacy Framework, under which Vercel is certified, and by Standard Contractual Clauses |
| Resend, Inc. | Delivers the email that your form submission becomes | United States; Standard Contractual Clauses |
| Zoho | Hosts our mailbox, where your message arrives and is stored | European Union (EU data centre) |
| Cloudflare, Inc. | DNS and protection against abuse | United States and EU; Standard Contractual Clauses |
If you contact us on WhatsApp, Meta Platforms processes that conversation under WhatsApp's own terms. We do not use Meta's business tools on this website.
4. How long we keep your data
| Data | How long | Why |
|---|---|---|
| Contact form messages | 2 years after our last contact | To answer follow-up questions |
| Quote requests that do not lead to a project | 1 year after our last contact | To answer follow-up questions |
| Quote requests and messages that lead to a project | 7 years after the project ends | Dutch tax law requires us to keep business records for 7 years |
| Technical server data | Kept by our hosting provider for a short period only | Security and troubleshooting |
| Statistics | Aggregated page and speed counts, kept by Vercel according to the plan we are on. No data about an individual visitor is stored | Statistics |
5. Cookies and analytics
This website sets no cookies. Visits and page speed are measured without cookies and without a persistent identifier, through Vercel Web Analytics and Vercel Speed Insights, so there is nothing to consent to and nothing to withdraw. Read our cookie policy for what is measured.
6. Your rights
Under the GDPR you can ask us to:
- show you the personal data we have about you (access)
- correct data that is wrong or incomplete (rectification)
- delete your data, unless the law requires us to keep it (erasure)
- limit what we do with your data (restriction)
- give you your data in a common file format (portability)
- stop processing based on our legitimate interest (objection)
Email dpo@civsecsmart.com with your name and the email address you used. We may ask you to confirm your identity. We reply within 1 month; for complex requests we may need up to 2 more months and will tell you if so.
Not happy with how we handle your data? You can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or go to court.
7. Our Shopify apps
CivSec S.M.A.R.T B.V. also publishes apps for Shopify merchants. Each app has its own privacy policy, which covers the data that app processes:
- Emanuel (AI live chat): privacy policy · terms of service
- GivePro (donations): privacy policy · terms of service · charges and payments
This page covers civsecsmart.com only.
8. Children
This website is for businesses. We do not knowingly collect data from anyone under 16. If we learn that we have, we delete it.
9. Changes
We update this page when our website or the law changes. The date at the top shows the latest version. If a change affects you and we have your email address from an ongoing project, we will tell you by email.
10. Which law applies
Dutch law and the GDPR apply to this policy. If you live outside the European Union, local privacy laws may give you additional rights; you can always exercise the rights above with us.