Skip to content
DataDream

Persónuverndarstefna

DataDream, based in Middelburg, is responsible for the processing of personal data as described in this privacy statement. Last updated: 9 May 2026.

Contact details

DataDream
Middelburg, Zeeland (no fixed visiting address — service-area model)
info@datadream.nl
+31 85 124 95 22
CoC: 76220540

Personal data we process

DataDream processes the following categories of personal data:

  • Contact form (/contact): name, email address, phone number, company name and the content of your message.
  • AI Scan (/ai-scan): website URL you submit, optional competitor URL, your email address. The submitted URL is fetched and analysed; we store the URL and the resulting analysis.
  • Calendly bookings: name, email and any details you provide when scheduling a call. Calendly is the controller for the data you enter on its booking page; we receive the booking details from Calendly.
  • Server logs: IP address, user-agent and timing data are processed by our hosting provider to deliver the site, mitigate abuse and rate-limit the contact form.
  • Cookies and analytics: only after you grant consent in the cookie banner. See /cookies for the full list.

Purposes and legal bases

  • Replying to enquiries, sending quotes and delivering services — performance of a contract or legitimate interest (Article 6(1)(b)/(f) GDPR).
  • Generating an AI Scan report — performance of a service you requested (Article 6(1)(b) GDPR).
  • Operating the site, security and abuse prevention — legitimate interest (Article 6(1)(f) GDPR).
  • Analytics, advertising and conversion tracking — your consent (Article 6(1)(a) GDPR), withdrawable at any time via the cookie settings.
  • Legal obligations (e.g. invoicing, tax retention) — Article 6(1)(c) GDPR.

Data processors and recipients

We use the following processors and infrastructure providers. Each is engaged under a Data Processing Agreement (DPA) where applicable:

  • Vercel Inc. — hosting and serverless functions for datadream.nl. Primary processing region: Frankfurt (fra1, EU). DPA: vercel.com/legal/dpa.
  • Upstash (Vercel Marketplace) — short-term key-value storage for AI Scan session state.
  • Vercel BotID — invisible bot detection on the contact form (powered by Kasada). Processes request signals to classify automated traffic.
  • ProtonMail (Proton AG, Switzerland) — inbound mail for info@datadream.nl. Switzerland is recognised as having an adequate level of protection by the European Commission.
  • Resend, Inc. — transactional email delivery for contact-form replies and AI Scan reports.
  • Anthropic PBC — generates portions of AI Scan reports. We send the URL and the analysis prompt; Anthropic does not train on data submitted via the API.
  • Google LLC (Gemini API) — performs grounded web research for AI Scan reports.
  • Calendly LLC — scheduling and booking flow when you click "Book a call".
  • Google LLC — Google Tag Manager, Google Analytics 4 and Google Ads conversion tracking, only after consent.
  • Meta Platforms Ireland Ltd. and LinkedIn Ireland Unlimited Company — advertising pixels, only after consent.
  • Ahrefs Pte. Ltd. — privacy-friendly visitor analytics, only after consent.

Where processors are based outside the EEA (e.g. Anthropic, Google, Meta, LinkedIn, Resend, Calendly, Ahrefs), data transfers are protected by EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework where applicable.

Retention

Contact-form messages: up to 2 years after our last contact, or longer if needed for project documentation. AI Scan submissions and reports: up to 2 years. Server logs: typically 30 days. Invoicing data: 7 years (Dutch tax law).

Cookies

DataDream uses Google Consent Mode v2: analytics and advertising cookies are denied by default and only activated after you give explicit consent in the cookie banner. Technically necessary cookies (language preference, session, security) are placed without tracking personal behaviour. You can change your choice at any time via the cookie settings at the bottom of the site. The full inventory is on /cookies.

Your rights

You have the right to access, correct, delete or restrict the processing of your personal data, the right to object, and the right to data portability. You may withdraw any consent at any time. Send your request to info@datadream.nl. We respond within 30 days.

If you believe we are not handling your personal data correctly, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

Security

DataDream takes the protection of your data seriously. The site is served exclusively over HTTPS with HSTS, a strict Content Security Policy, X-Frame-Options DENY and a Permissions-Policy that disables unused browser features. The contact form is protected by Vercel BotID (invisible bot detection), an origin allow-list, a honeypot field, IP-based rate limiting and length validation. Email authentication is enforced via SPF and DMARC (p=quarantine). We exclusively work with GDPR-compliant processors.

Changes

We may update this statement to reflect changes in our processing or in the law. The "last updated" date at the top reflects the latest revision.