Privacy

Privacy statement

This site collects as little as it can. This page lists exactly what it collects, where it goes, and who handles it.

Last updated

Who is responsible

Ktesio is the controller for the personal data described on this page.

  • Ktesio, KVK 42172743
  • Post address: Postbus 21534, 3001 AM Rotterdam, the Netherlands
  • Email: privacy@ktesio.com

Questions about this statement or about your data go to the email address above.

The short version

  • The site sets no cookies. That’s why there is no cookie banner.
  • There are no analytics, no tracking pixels and no advertising.
  • Fonts, images and scripts are served from ktesio.com itself. The one exception is the spam check on the contact form.
  • The site is hosted by Cloudflare. Some of the data a visit or a message creates can be processed outside the EU, including in the United States. The section on where your data is processed explains what and why.
  • If you use the contact form or email Ktesio, your message goes to Ktesio’s mailbox so I can reply, and the provider that hosts that mailbox stores it there. This site doesn’t store it anywhere else, and the form sends you a short confirmation that it arrived.

Visiting the site

The site is hosted on Cloudflare Pages. When your browser asks for a page, Cloudflare receives the technical data that comes with every web request: your IP address, the address of the page, the time, your browser’s user agent and, if your browser sends it, the page that linked to this one. Cloudflare uses this data to deliver the page and to protect the site against attacks.

This site keeps no request logs of its own. Cloudflare’s dashboard shows Ktesio aggregate traffic figures, such as requests per day, not individual visitors.

Legal basis: Ktesio’s legitimate interest in running a secure website that stays online (Article 6(1)(f) GDPR).

The contact form

The form on the contact page asks for your name, your email address, your company and what you’re working on and, if you want to share them, your timing and a budget range. You don’t have to use it: email works just as well. The form can’t be sent without the required fields, because I need them to reply.

When you send it, a small server function on Cloudflare checks the spam protection result (see below) and emails your message to Ktesio’s mailbox through Cloudflare’s email service. It also sends a short confirmation to the address you gave, so you know your message arrived. The function doesn’t write your message to a database or a log.

I use your message to reply to you and, if we decide to work together, to agree a scope.

Legal basis: steps you ask for before a possible contract (Article 6(1)(b) GDPR), and Ktesio’s legitimate interest in answering business enquiries (Article 6(1)(f) GDPR).

How long it’s kept: if your enquiry doesn’t lead to work, I delete it within 12 months of our last message. If it does, the parts that belong to Ktesio’s business records are kept for the seven years that Dutch tax law requires.

Email

Email sent to Ktesio, including messages from the contact form, is routed by Cloudflare: inbound email through Email Routing, and Ktesio’s replies through its Email Service. Cloudflare, Inc. is a US company; these transfers to the United States rest on its certification under the EU-U.S. Data Privacy Framework, with the EU standard contractual clauses as a fallback. The provider that hosts Ktesio’s mailbox stores the email delivered to it, including your enquiry and Ktesio’s replies, mainly in the United States, under the EU standard contractual clauses. The same purposes, legal basis and retention apply as for the contact form.

Spam protection on the form

The contact form uses Cloudflare Turnstile to check that a person, not a bot, is sending it. Turnstile loads only on the contact page, and only once you start using the form. It runs from Cloudflare’s own domain, challenges.cloudflare.com, and processes signals from your browser such as your IP address, TLS fingerprint and user agent. It doesn’t read what you type into the form.

Cloudflare processes these signals on Ktesio’s behalf to protect the form. It also uses them, as a controller in its own right, to improve Turnstile’s bot detection. The details are in Cloudflare’s Turnstile Privacy Addendum.

Turnstile only decides whether the form can be sent. Ktesio makes no other decisions about you by automated means.

Legal basis: Ktesio’s legitimate interest in keeping automated spam out of its inbox (Article 6(1)(f) GDPR).

Where your data is processed

Cloudflare runs a global network. Your request is handled by one of its data centers, normally one close to you, so for most visitors in Europe the page is served from Europe. Some processing can still take place in the United States, such as storing request logs and security data, and the server-side step of the spam check.

Cloudflare, Inc. is a US company. For transfers to the United States it relies on its certification under the EU-U.S. Data Privacy Framework, with the EU standard contractual clauses as a fallback.

The provider that hosts Ktesio’s mailbox processes the email it stores mainly in the United States, and those transfers rest on the EU standard contractual clauses.

Who receives your data

  • Cloudflare, Inc. hosts the site, runs the spam check, routes email to Ktesio and sends Ktesio’s replies. It does this as Ktesio’s processor, under Cloudflare’s data processing terms.
  • The provider that hosts Ktesio’s mailbox stores the email in it, including your enquiry and Ktesio’s replies. It stores that email mainly in the United States, under the EU standard contractual clauses.

Nobody else. Ktesio doesn’t sell your data and doesn’t use it for marketing.

Your rights

You can ask Ktesio for a copy of your personal data, and ask for it to be corrected or deleted. You can ask for processing to be restricted, or for your data in a portable format. Where processing rests on Ktesio’s legitimate interest, you can object to it. Email privacy@ktesio.com and I’ll reply within one month, as the GDPR requires.

If you think your data is being handled wrongly, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

Changes

If what the site collects changes, this page changes with it. The date at the top shows when it last changed.