Privacy
Short version.
We collect little, use it only to reply to you or to see which pages get read, and never sell it. Analytics only run if you accept them.
Short version.
We collect little. Use it to answer you, or to see which page get read. Never sell it. Analytics only run if you say yes.
Two processing activities: contact form submissions (delivered by mail, retained in the mailbox) and Google Analytics 4 (consent-gated). No accounts, no profiling, no third-party sale.
Who is responsible
What we process
| Data | Why | Basis | Retention |
|---|---|---|---|
| Name, email address and message from the contact form | To answer you | Legitimate interest, or steps prior to a contract if you are asking about our work | As long as the conversation is live, then archived in our mailbox |
| Your IP address at the moment you submit the form | Flood protection, and included in the mail so we can trace abuse | Legitimate interest | Hashed in a rate-limit file, cleared after an hour |
| Your answers to the maturity benchmark, under a random session ID | To produce your score, and the written report if you ask for one | Legitimate interest, and steps prior to a contract if you request the report | Stored on our own server when you complete the questionnaire. No name, email address or IP is stored with it. |
| The email address you give when requesting the benchmark report | To send you the report | Steps prior to a contract, at your request | Until the report has been sent and the conversation is over |
| Pages visited, referrer, approximate location, device and browser | Google Analytics — to see which pages get read | Consent | 14 months in Google Analytics |
| Server access logs | Keeping the site up and dealing with abuse | Legitimate interest | Rotated by the web server |
Who else sees it
Google Ireland Limited processes the analytics data on our instruction, and Microsoft hosts the mailbox your message lands in. Both act as processors. Analytics may involve transfer to the United States under Google’s standard contractual clauses. Nobody else receives your data, and we do not sell it.
Google Ireland handle analytics for us. Microsoft hold the mailbox your message land in. Both work on our order. Analytics data may go to United States, under Google standard contract clauses. Nobody else get it. We never sell it.
Processors: Google Ireland Limited (GA4, Google Ads Data Processing Terms), Microsoft (mailbox hosting, MX eoncore-eu.mail.protection.outlook.com). Third-country transfer for analytics under SCCs. No other recipients, no sale.
Your rights
You can ask what we hold about you, have it corrected or deleted, ask for a copy to take elsewhere, object to processing based on legitimate interest, and withdraw consent for analytics at any time — the cookies page has the switch. Mail hello@eoncore.eu and we answer within a month.
If we get it wrong, you can complain to the Autoriteit Persoonsgegevens.
You ask what we hold. You get it fixed. You get it deleted. You take copy elsewhere. You object. You take back your yes for analytics whenever — switch on cookies page. Mail hello@eoncore.eu. We answer inside one month.
We get it wrong, you complain to Autoriteit Persoonsgegevens.
Rights under GDPR art. 15–21: access, rectification, erasure, portability, objection, and withdrawal of consent. Route: hello@eoncore.eu, one-month response. Supervisory authority: Autoriteit Persoonsgegevens.
Security
The site is served over TLS. The contact form posts to our own server and the message leaves through our own mail account, so no third-party form service ever sees it.
Site run over TLS. Contact form post to our own machine. Message leave through our own mail. No outside form service ever touch it.
Transport: TLS (Let’s Encrypt). Form endpoint is first-party PHP on our own host; delivery via our own SMTP relay. No third-party form processor.
What gets stored in your browser: cookies.