Skip to main content

Privacy Policy

How SDKode Management BV handles personal data on sanderkorf.nl: what I collect, legal bases, processors, retention, transfers, and your GDPR rights.

When you visit sanderkorf.nl or email me, I may process personal data about you. This page explains what I collect, why, on which legal basis, how long I keep it, and what you can ask me to do with it.

I may update this policy when the law or my services change. Check back occasionally if you want the latest version.

When this policy applies

This policy covers personal data I process through sanderkorf.nl and related domains. That includes visitors, clients, and business contacts who reach out or use the site.

Personal data is any information that can identify you, such as your name, email address, IP address, or browsing behaviour linked to you. The Dutch Data Protection Authority publishes more background on what counts as personal data.

Who is the controller?

I run SDKode Management BV (SDKode). That company is the controller for the processing described here.

SDKode Management BV
Elzenhagensingel 325
1022 LA Amsterdam
The Netherlands

Chamber of Commerce (KvK): 94719489
VAT (BTW): NL866870702B01
Email: sander@sdkode.dev

Whose data do I process?

I process personal data from people who contact me or use the website, including:

  • Website visitors
  • Private clients
  • Business clients
  • Contact persons at partner organisations

How do I receive your data?

Most often you give it to me directly when you:

  • Submit a form on the website
  • Email or message me
  • Sign up for updates (if offered)

Some technical data is collected automatically when you visit the site (for example through hosting and analytics tooling described below).

What data do I collect?

I keep it minimal. Depending on how we interact, I may process:

  • Name
  • Email address
  • Job title
  • Company name
  • Message content and related correspondence
  • Technical data such as IP address, browser/device signals, approximate location derived from IP, and page-view or performance metrics (via hosting and analytics)

I don't sell data, run ad profiles, or collect more than I need for the conversation, project, or site operation at hand. You can reach me through the contact form on the site or by email.

I only process personal data when a GDPR legal basis applies. Here is the mapping by purpose.

Respond to enquiries and communicate

Data: name, email, company (if you provide it), project scope, stack, timing, budget notes (optional), message content, and technical metadata such as hashed IP and browser fingerprints I use to limit abuse.

Legal basis: legitimate interests (Art. 6(1)(f)), namely answering people who contact me; pre-contractual steps at your request (Art. 6(1)(b)) when you ask about freelance work; or consent (Art. 6(1)(a)) where you opt in to a specific channel.

Deliver freelance / client work

Data: name, email, company, project details.

Legal basis: performance of a contract (Art. 6(1)(b)), including pre-contractual steps at your request.

Invoicing, tax, and accounting

Data: name, company, billing details.

Legal basis: legal obligation (Art. 6(1)(c)), including Dutch tax retention rules.

Host and secure the website

Data: IP address, logs, security events.

Legal basis: legitimate interests (Art. 6(1)(f)), namely keeping the site available and secure.

Understand traffic and fix performance

Data: coarse analytics and speed metrics.

Legal basis: legitimate interests (Art. 6(1)(f)), namely improving the site. I do not use this for advertising profiles.

Where I rely on legitimate interests, those interests are operating and improving a professional website and business without disproportionate impact on you. You can object (see Your rights).

I do not use your data for automated decision-making or profiling that produces legal or similarly significant effects about you.

How long do I keep your data?

Retention depends on the category:

  • Website analytics and performance metrics: kept only as long as needed for aggregated reporting and troubleshooting, typically up to 14 months unless the tool's shorter default applies
  • Hosting and security logs: kept for a short operational period (usually weeks to a few months) unless a security incident requires longer review
  • Contact form inquiries and correspondence: kept for the conversation and a reasonable follow-up period (generally 12 to 24 months after last contact if no engagement starts), unless you ask me to delete sooner where that is allowed
  • Active clients and project files: for the engagement, then as long as needed for handover, warranty, or disputes
  • Invoices and accounting records: seven years under Dutch tax and accounting rules
  • After that: only what I must keep for legal or dispute-handling purposes

Ask me if you want detail on a particular category.

Who receives your data?

I do not sell personal data or hand it to advertisers.

I use processors to run the site and related tools. Processors relevant to this website include:

  • Vercel Inc. (hosting, Vercel Analytics, Vercel Speed Insights)
  • Convex Inc. (database and server functions for the contact form, anonymous post reactions, blog writing Q&A, and cached weather lookups for ambient site tint)
  • Open-Meteo (weather API for coarse ambient tint only; no account, no API key on my side)
  • Resend Inc. (email delivery for inquiry notifications and acknowledgements)
  • Cloudflare Inc. (Turnstile verification on the contact form)

Each acts as a processor on my instructions, under their terms and data processing agreements where those apply. Other providers may show up for project delivery when we work together; I will tell you when that matters for a specific engagement.

I process client and contact data within SDKode Management BV. Hosting, analytics, the form backend, email, and bot verification still run through the vendors above.

Analytics

I use Vercel Analytics and Vercel Speed Insights to understand traffic patterns and site performance. They are privacy-oriented and do not use tracking cookies for advertising. They may still process technical data (such as IP-derived information or device/browser signals) as part of how the service works. I do not use that data to build an advertising profile of you. See the cookies page for more.

Where is data stored and transferred?

The site is hosted on Vercel. Processing and storage may take place in the United States and other locations where Vercel or its subprocessors operate, not only inside the EEA.

When personal data leaves the EEA/UK to a country without an adequacy decision, I rely on appropriate safeguards, in particular:

  • Standard Contractual Clauses (SCCs) in Vercel's data processing terms, and/or
  • the EU-US Data Privacy Framework (DPF) where Vercel participates and that framework applies

Details of Vercel's processing and transfer mechanisms are described in Vercel's documentation and data processing addendum. Ask me if you want a pointer to the current terms.

How do I protect your data?

  • Encrypted connections (HTTPS) and hosted infrastructure with regular updates
  • Access limited to what the work requires
  • Secure channels for client communication

Ask if you want more detail on a specific measure. No security setup is perfect; I take reasonable technical and organisational measures appropriate to the risk.

Your rights

Under the GDPR you can:

Right to information

This policy is meant to satisfy that. I explain what I do and how you can exercise control.

Right of access

Ask for an overview of personal data I hold about you.

Right to rectification

Tell me if something is wrong or incomplete and I'll correct it.

Right to object

You can object to processing based on legitimate interests, including analytics where that applies. Say the word and I'll assess and, where required, stop.

Right to withdraw consent

Where processing is based on consent, you can withdraw that consent at any time. Withdrawal does not affect processing already done lawfully before you withdrew.

Right to data portability

Where applicable (for example data you provided under contract or consent, processed by automated means), you can request a copy in a common format.

Right to restriction

In some cases you can ask me to store data but not use it actively.

Right to erasure

You can ask me to delete data that identifies you, except where I must keep it by law (for example tax records for seven years).

Right to lodge a complaint

Contact me first at sander@sdkode.dev. You may also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). Disputes may be brought before the courts in Amsterdam, where SDKode Management BV is established.

How to submit a request

Email sander@sdkode.dev. I respond within 30 days; complex requests may take up to 60 days, and I'll tell you if that's the case. I may ask you to confirm your identity before releasing data.

This policy follows:

  • The General Data Protection Regulation (GDPR)
  • The Dutch GDPR Implementation Act (Uitvoeringswet AVG)
  • Other applicable Dutch privacy law

Cookies

No tracking cookies for advertising. Privacy-oriented analytics and performance tools only, with the caveats above. Details on the cookies page.

Minors

This site is not aimed at people under 18. If you are under 18, use the site only with a parent or guardian's permission.

Questions?

Email: sander@sdkode.dev
LinkedIn: linkedin.com/in/sanderkorf

Last updated: September 19, 2026