Last updated: 18 October 2026
SecureHabits (KVK 78029260, VAT NL003278436B94, Willemspoort 102, Den Bosch, 5223WV Netherlands) is
the controller for personal data processed through this website. We sell training and advisory
services to companies; we do not sell personal data, build advertising profiles, or make automated
decisions about you. Questions and requests: [email protected].
What we process, and why
- Requests you send us. When you book a call, submit a quote request, use the chat, or email us,
we receive the details you provide (name, work email, phone, company, your message). We use them to
answer you and to prepare the engagement you asked about (legal basis: taking steps prior to a
contract, or our legitimate interest in responding). Booking, forms, chat, and our CRM (Zoho CRM)
run on Zoho, hosted in Zoho’s EU data centers, acting as our processor.
- EU CRA Self Assessment. Your answers and scores stay in your browser (session storage, cleared
when you close the tab), and the PDF report is created there too; we never receive them. When you
click “Download the PDF”, we receive only the contact details you enter (name, company, role, work
email) and store them in our CRM (Zoho CRM). We use them to follow up on your report, for example
to offer to go through the results with you (legal basis: our legitimate interest in responding to
a business inquiry). We do not add you to a newsletter or mailing list on this basis.
- Technical logs. The site is static and served from Scaleway (Amsterdam, EU). Serving requests
produces short-lived infrastructure logs (IP address, requested URL, user agent) used for security
and operations (legitimate interest).
- Analytics, only with consent. If you choose “Accept all” in the cookie banner, we load Google
Tag Manager, Google Analytics 4, and Microsoft Clarity to understand how the site is used (pages
visited, interactions; Clarity may record anonymized session replays). Nothing loads if you pick
“Essential only”, and you can change your mind at any time via the cookie settings link in the
footer (legal basis: consent). On the EU CRA Self Assessment page, analytics records only that the
check was started, completed, and its report downloaded, never your answers or score, and Microsoft
Clarity does not record session replays of that page.
- Embedded videos. Videos are click-to-load through YouTube’s privacy-enhanced domain; YouTube
sets cookies only after you press play.
Recipients and transfers
We share personal data only with the processors named above (Zoho, Scaleway, and, with your consent,
Google and Microsoft). Zoho and Scaleway process in the EU. Google and Microsoft may transfer data to
the United States; both certify under the EU–US Data Privacy Framework and use standard contractual
clauses.
Retention
Inquiries and chat transcripts are kept while we are in contact and deleted when no longer needed.
Contact details from the EU CRA Self Assessment are deleted 24 months after our last contact with
you, unless they become part of an engagement. Records that become part of a contract (quotes,
invoices) follow Dutch bookkeeping retention (seven years). Analytics data follows the vendors’
default retention (Google Analytics: 14 months).
Your rights
Under the GDPR you can request access, correction, deletion, restriction, portability, and object to
processing based on legitimate interest; where processing rests on consent you can withdraw it at any
time without affecting earlier processing. Write to
[email protected]; we respond within one month. You can also lodge a
complaint with the Dutch supervisory authority, the
Autoriteit Persoonsgegevens.
