Legal
Privacy policy
This page explains which personal data CivSec Group B.V. processes through civsecgroup.nl, why, for how long and what your rights are. In short: we process what you send us yourself and, only with your consent, how you use the website. We never sell data and we use no advertising trackers.
Last updated: 27 September 2026
1. Who is responsible
- Controller
- CivSec Group B.V.
- KvK
- 98032615
- VAT
- NL868332501B01
- Location
- Weert, Limburg, the Netherlands
- Privacy questions and requests
- legal@civsecgroup.nl
The website and projects of CivSec S.M.A.R.T B.V. are covered by the privacy policy at civsecsmart.com. The holding does not process data collected there.
2. What we process and why
| What you do | Which data | Why | Legal basis (GDPR) |
|---|---|---|---|
| You send the contact form | Subject, name, email address, message and, if you fill it in, your organisation | To reply to you | Our legitimate interest in replying (Art. 6(1)(f)); for a partnership proposal: steps before a contract (Art. 6(1)(b)) |
| You email or call us | What you send us, plus your email address or phone number | To reply to you | As above |
| You visit the website | Technical data every web server receives: IP address, browser, time, requested page | To deliver the pages, keep the site secure and block abuse of the form | Legitimate interest in a working and secure website (Art. 6(1)(f)) |
| You allow statistics | Pages viewed, clicks, device and browser, approximate location (country and city, derived from the IP address, which Google Analytics itself does not store) and a random cookie ID | To see how the website is used and improve it | Your consent (Art. 6(1)(a)); you can withdraw it at any time through Cookie settings at the bottom of every page |
3. Who receives your data
We do not sell or rent personal data. The following companies process data on our behalf, only for the purposes above.
| Company | What they do | Where |
|---|---|---|
| Vercel, Inc. | Hosts the website and processes the form | Server functions in the EU region; the company is based in the United States. Transfers under the EU-US Data Privacy Framework and standard contractual clauses |
| Resend, Inc. | Delivers the email your form submission becomes | United States; standard contractual clauses |
| Zoho | Hosts our mailbox, where your message arrives and is stored | Data centre in the European Union |
| Cloudflare, Inc. | DNS, protection against abuse and the bot check on the form | United States and European Union; standard contractual clauses |
| Google Ireland Limited (Google Analytics) | Statistics, only if you consent | European Union and United States (Google LLC). Transfers under the EU-US Data Privacy Framework |
4. How long we keep your data
| Data | How long | Why |
|---|---|---|
| Messages through the form or by email | 2 years after our last contact | To answer follow-up questions |
| Messages that lead to an agreement | 7 years after the agreement ends | Dutch statutory retention period |
| Technical server data | Briefly, according to the retention period of the hosting provider | Security and troubleshooting |
| Statistics (only with consent) | 14 months in Google Analytics; the cookies in your browser expire after 13 months | Statistics |
5. Cookies and statistics
With your consent we use Google Analytics to measure how the website is used. Without consent, Google Analytics does not load and we set no statistics cookies. Advertising features and Google Signals are off, and email addresses and names are filtered out of measured addresses. More, including the cookie names and retention periods, in the cookie policy.
6. No profiling
We do not build profiles and make no automated decisions about you.
7. Your rights
Under the GDPR you can ask us for access, rectification, erasure, restriction, portability and objection. Email your request to legal@civsecgroup.nl, with your name and the email address you used. We may ask you to confirm your identity. We reply within one month; for a complex request this can take two more months, and we will tell you if so.
If you are not satisfied, you can complain to the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl) or go to court.
8. Children
This website is intended for organisations. We do not knowingly process data of anyone under 16; if we learn that we have, we delete it.
9. Changes
We update this policy when the website or the law changes. The date at the top shows the latest version.
10. Governing law
This policy is governed by Dutch law and the GDPR.