Privacy Policy Handled.nl
Last updated: 10 September 2026
Handled ("we", "us" or "our") cares about protecting your personal data. This privacy policy explains what data we collect through handled.nl, why we collect it, how long we keep it and what rights you have. In doing so, we comply with the General Data Protection Regulation (GDPR).
1. Who is responsible for your data
The party responsible (the "controller") for processing your personal data is:
- Company name: Handled B.V.
- Address: Boompjes 40, 3011 XB Rotterdam, the Netherlands
- Chamber of Commerce (KvK) number: 42030946
- VAT number: NL869388290B01
- Email: privacy@handled.nl
If you have any questions about this policy or about how we handle your data, please get in touch using the details above.
2. What personal data do we process?
2.1 Details you share with us through the contact form
When you contact us through the contact form or by email, we process the following details:
- Your first name and surname
- Your email address
- Your company name (if provided)
- The contents of your message and any attachments
The contact form is operated for us by Tally (see section 5).
2.2 Data collected automatically
When you visit our website, a small amount of data is processed automatically by our hosting provider statichost and by Plausible. Each of these services is explained below.
3. Why we process your data, and on what legal basis
We only process personal data where the GDPR gives us a valid legal basis:
| Purpose | Legal basis |
|---|---|
| Responding to messages and enquiries sent through the contact form | Performance of a (pre-)contractual relationship (Article 6(1)(b) GDPR), or - where no contract follows - our legitimate interest in following up enquiries (Article 6(1)(f) GDPR) |
| Processing and storing form submissions (Tally) | Performance of a (pre-)contractual relationship (Article 6(1)(b) GDPR) |
| Hosting, serving and securing the website (statichost) | Legitimate interest |
| Improving our website through statistics (Plausible) | Legitimate interest |
| Meeting legal obligations | Legal obligation |
4. Hosting by statichost
Our website is hosted by statichost.eu (Variable Object Assignment), based in Stockholm, Sweden. statichost acts as a processor within the meaning of the GDPR, and we have signed a data processing agreement with them.
What does statichost process when you visit the website?
To deliver the website, statichost processes your device's IP address. statichost also keeps anonymous usage statistics that contain no personal data. It sets no cookies and stores nothing on your device.
Location: statichost processes all data within the European Union, on its own servers. No data is transferred outside the European Economic Area (EEA).
Retention: statichost does not keep visitor data; your IP address is only processed for as long as it takes to deliver the page you requested. For more information, see the statichost privacy policy at statichost.eu/privacy.
5. Contact form by Tally
Our contact form is provided and processed by Tally BV, based in Ghent, Belgium. When you fill in the form, the details you enter (see section 2.1) are stored on Tally's servers within the European Union. Tally acts as a processor, and we have signed a data processing agreement with them.
The form sets no cookies. It does use functional storage in your browser (localStorage) to hold on to what you have typed while you complete the form. This storage is strictly necessary for the form to work and therefore falls within the exemption in section 11.7a of the Dutch Telecommunications Act. See also our cookie policy.
We delete submissions from Tally in line with the retention periods in section 10.
6. Statistics through Plausible Analytics
We use Plausible Analytics to understand how our website is used. Plausible is a privacy-friendly analytics tool: it sets no cookies and stores nothing on your device (no localStorage, sessionStorage or device fingerprinting). Plausible receives IP addresses server-side and immediately converts them into an irreversible hash; the IP address itself is never stored or logged. Although an IP address formally remains personal data under the GDPR, individuals cannot be identified through Plausible. Plausible is based in the EU and processes data on servers within the EEA.
More information is available in Plausible's privacy policy.
7. Cookies
Handled.nl uses as few cookies as possible. Because our tools work without cookies (Plausible), we set no analytics, tracking or marketing cookies. Apart from the strictly necessary, functional storage used by our contact form (see section 5), we use no other means of storing or reading information on your device (such as localStorage, sessionStorage or device fingerprinting). Under section 11.7a of the Dutch Telecommunications Act, no consent is required for strictly necessary, functional cookies and storage.
8. Sharing with third parties
We do not pass your personal data on to third parties, unless this is necessary to provide our services or to meet a legal obligation. With parties that process data on our behalf (such as our hosting provider statichost, our email provider, Tally, and Plausible) we sign data processing agreements to make sure your data is properly protected. A complete, up-to-date list of our processors is available on request via privacy@handled.nl. We also keep an internal record of processing activities as required by Article 30 GDPR, which can be shared with the regulator or a data subject on request.
9. Transfers outside the EEA
We process your data within the European Economic Area (EEA). Our hosting provider statichost (Sweden), form processor Tally (Belgium) and Plausible all process data within the EU/EEA. No personal data is structurally transferred outside the EEA.
10. How long we keep your data
We keep personal data no longer than necessary:
- Messages sent through the contact form: up to 24 months, unless a client relationship follows; submissions are stored with Tally and deleted by us from Tally within this period
- Client and contact details relating to an assignment: up to 7 years after the assignment ends, in line with Dutch tax retention rules
- Hosting data (statichost): statichost does not keep visitor data; your IP address is only processed to deliver the page
- Statistics (Plausible): aggregated; individuals cannot be identified
11. Security
We take appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access. These include encrypted connections (TLS/HTTPS), access controls and regular updates to our systems.
12. Your rights
Under the GDPR you have the right to:
- see the personal data we hold about you
- have incorrect or incomplete data corrected
- have your data deleted (the "right to be forgotten")
- restrict how your data is processed
- object to processing based on legitimate interest
- receive your data in a common, machine-readable format (data portability)
- withdraw consent, where processing is based on consent
You can submit a request via privacy@handled.nl. To prevent misuse we may ask you to verify your identity. We will normally respond within four weeks.
13. Direct marketing and newsletters
We only use the contact details you share through the contact form to handle your message or enquiry. We will not use your details for newsletters or any other form of direct marketing without your explicit consent.
14. Automated decision-making and profiling
We make no decisions about individuals based solely on automated processing that have legal or similarly significant effects (Article 22 GDPR). We do not profile individuals.
15. Children
Handled.nl is aimed exclusively at business customers. We do not knowingly collect personal data from anyone under 16. If you believe we have processed a child's data without parental consent, please contact us via privacy@handled.nl and we will delete it.
16. Complaints
If you are unhappy with the way we handle your personal data, please contact us first. If we cannot resolve the matter together, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via autoriteitpersoonsgegevens.nl.
17. Changes to this policy
We may update this privacy policy from time to time. The latest version is always available on this page. If we make significant changes, we will let you know where we reasonably can.