Privacy policy

Last updated

1. Who is responsible for your data?

LD ICT is responsible for the processing of personal data through this website and our services. We are the controller within the meaning of the General Data Protection Regulation (GDPR).

  • Company name: LD ICT
  • Address: Zandweg 3, 6942JE Didam, the Netherlands
  • Chamber of Commerce (KvK) number: 42161041
  • VAT ID: NL005545544B72
  • Email: contact@ldict.nl

This privacy policy explains which personal data we process, for what purpose, on which legal basis, how long we keep it, who we share it with and what rights you have. Do you have a question? Email us at the address above.

2. Which data do we process, why and on which legal basis?

We only process data that we need for the purpose stated below. We do not use your data for advertising or profiling. The website has no analytics, tracking, advertising or social media cookies.

Contact form

  • Data: name, email address, optionally company and phone number, your message, the chosen language, your browser's user agent and a salted hash of your IP address.
  • Purpose: to answer your question and get in touch with you. You also receive an automatic confirmation by email, at most once per hour per email address. The confirmation does not repeat your message.
  • IP address: we do not store your IP address itself. We only keep a salted hash of it, solely to limit the number of messages and prevent abuse.
  • Legal basis: our legitimate interest in answering questions and preventing abuse of the form (Article 6(1)(f) GDPR). If your question concerns a possible agreement, the legal basis is taking steps at your request before entering into an agreement (Article 6(1)(b) GDPR).

Booking an appointment

  • Data: name, email address, optionally phone number, company and message, the booked service and the chosen time slot.
  • Payment: depending on the service, prepayment is optional or required. The payment is handled by Revolut Business (Revolut Merchant checkout). We never see your card details. The payment data we receive back from Revolut: [fill in, for example payment status and reference].
  • Purpose: to schedule and confirm your appointment, process the payment and carry out the appointment. We send confirmation emails via Resend.
  • Legal basis: performance of an agreement or taking steps before entering into an agreement (Article 6(1)(b) GDPR). For our accounting and tax obligations, also a legal obligation (Article 6(1)(c) GDPR).

Support

  • Data: emails you send to the support address, including your email address, your name if it appears in the email, the content of your message and any attachments.
  • Purpose: to handle your support request. We receive the emails via Resend and store them as support tickets, together with the attachments.
  • Legal basis: performance of an agreement if you are a client (Article 6(1)(b) GDPR). Otherwise, our legitimate interest in handling questions properly (Article 6(1)(f) GDPR).

Video meetings

You can join a video meeting through an invitation link (/meet/<id>). You do not need an account.

  • Data: the display name you enter, your chat messages, whether your microphone, camera or screen share is on, and the times you joined and were last active. This data is stored in our database at Neon.
  • Audio, video and screen sharing: these go directly between the participants' browsers (WebRTC, peer to peer). We do not record or store them. As a result, your IP address is visible to the other participants' browsers.
  • STUN and TURN services: to set up connections, your browser contacts public STUN servers of Google and Cloudflare. They can see your IP address when this happens. If a direct connection is not possible, audio and video are relayed, encrypted, through Cloudflare's TURN service.
  • Cookie and local storage: a participant cookie (7 days, httpOnly) recognises you when you reload the page. Your browser keeps the last display name you used in local storage.
  • Purpose: to make the video meeting work and to recognise you as a participant.
  • Legal basis: performance of an agreement with the organiser or with you (Article 6(1)(b) GDPR) or our legitimate interest in making the meeting service work (Article 6(1)(f) GDPR).

Spam protection

We use Cloudflare Turnstile on the contact and booking forms. When the form is shown, a script from Cloudflare is loaded. Turnstile may use its own storage in your browser to tell people from bots. It does nothing other than recognise bots. No decisions with legal effects are made about you.

The legal basis is our legitimate interest in protecting our forms and website against spam and abuse (Article 6(1)(f) GDPR).

Staff login

LD ICT staff who log in to the admin area receive session cookies from the login system (Better Auth). These cookies are needed to log in and to secure the admin area. Visitors to the website do not receive these cookies.

3. Cookies and local storage

We only place cookies and storage that are needed to make the website work or to remember your choices. That is why we do not ask for consent.

  • Cookie locale (1 year): remembers your language choice.
  • Participant cookie for video meetings (7 days, httpOnly): recognises you when you reload the page.
  • Local storage for theme: your light or dark choice is kept in your browser's local storage, not in a cookie.
  • Local storage for display name: the last display name used in video meetings.
  • Better Auth session cookies: only for staff who log in.
  • Cloudflare Turnstile: may use its own storage to tell people from bots.

There are no analytics, tracking, advertising or social media cookies. You can always delete cookies and stored data yourself through your browser settings.

4. How long do we keep your data?

We do not keep personal data for longer than necessary for the purpose for which we collected it. After that, we delete or anonymise it.

  • Contact messages: 1 year
  • The salted hash of your IP address: 1 year
  • Appointments and booking data: 2 years
  • Payment and invoice data: 7 years
  • Support tickets and attachments: 2 years
  • Video meeting data (name, chat messages, status and times): 1 year
  • Participant cookie: 7 days
  • Cookie locale: 1 year

5. Who do we share your data with?

We do not sell your data. We only share it with parties we need in order to offer our website and services. These parties work on our behalf (processors), unless stated otherwise below.

  • Vercel: hosting of the website (Next.js) and storage of uploaded images (Vercel Blob).
  • Neon: the Postgres database in which we store data such as form, booking, support and meeting data.
  • Resend: sending and receiving email, such as contact messages, confirmations and support emails.
  • Revolut Business: processing payments when you book an appointment. Revolut's terms and privacy policy also apply to the payment.
  • Cloudflare: spam protection (Turnstile) and the TURN service for video meetings. Cloudflare's STUN servers can also see your IP address.
  • Google: the public STUN servers your browser uses for video meetings. They can see your IP address when this happens.
  • Other participants in a video meeting: they can see your display name, your chat messages, your status (microphone, camera, screen) and, through their browser, your IP address.

We have recorded agreements with our processors on the processing of personal data: [confirm/fill in data processing agreements]. We also provide data to public authorities or other parties if the law requires us to.

6. Does your data leave the European Economic Area (EEA)?

Some of the parties above, such as Vercel, Neon, Resend, Revolut, Cloudflare and Google, may process personal data outside the EEA. This can also happen through the data connection of a video meeting, depending on where the participants are located.

If data ends up outside the EEA, we make sure there is an appropriate level of protection. This can be, for example, an adequacy decision of the European Commission or standard contractual clauses. The safeguards that apply per party: [fill in transfer mechanism per processor]. The same goes for the region in which our data is stored at Vercel and Neon: [fill in region].

7. How do we secure your data?

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. Examples:

  • We do not store your IP address itself, only a salted hash of it.
  • Your card details never reach us. Payments go through Revolut.
  • We do not record audio, video or screen sharing in video meetings. When media is relayed through Cloudflare TURN, this is done encrypted.
  • The participant cookie for video meetings is httpOnly, so scripts on the page cannot read it.
  • Only staff who need it for their work can log in to the admin area.

Do you suspect that your data is not properly secured, or is there any sign of misuse? Please contact us at contact@ldict.nl.

8. What rights do you have?

Under the GDPR you have the following rights:

  • Access: you can ask which personal data we process about you.
  • Rectification: you can have incorrect or incomplete data corrected.
  • Erasure: you can ask us to delete your data, for example if we no longer need it.
  • Restriction: you can ask us to temporarily restrict the processing of your data.
  • Data portability: you can ask to receive data you provided yourself in a commonly used format, or to have it transferred to another party, if we process it on the basis of an agreement.
  • Objection: you can object to processing that we base on our legitimate interest. We will then stop that processing, unless we have compelling legitimate grounds that override your interests.
  • Withdrawing consent: if we ever process data on the basis of your consent, you can withdraw that consent at any time.

How do you exercise your rights?

Send an email to contact@ldict.nl and tell us which right you want to exercise. To prevent someone else from requesting your data on your behalf, we may ask you to confirm your identity. We will respond as soon as possible and no later than one month after receiving your request. If your request is complex or we have many requests to deal with, we can extend this period under the GDPR. We will let you know within one month if so.

You do not have to pay to exercise your rights, unless your request is manifestly unfounded or excessive.

9. Not satisfied? File a complaint

If we cannot resolve the matter together, you can file a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (Dutch Data Protection Authority). See autoriteitpersoonsgegevens.nl for more information and how to file a complaint. We would appreciate it if you contact us first, so that we can look for a solution together.

10. Do you have to provide data?

You are not obliged to give us personal data. However, without certain data we cannot handle a contact request, appointment or support question. On the contact and booking forms, the fields that are not marked as optional are required for this.

11. Changes to this privacy policy

We may change this privacy policy, for example if our website or services change. The most recent version is always on this page. For important changes, we will also inform you in another way where possible.