PRIVACY & DATA PROTECTION
Privacy Policy
This Privacy Policy explains how Dana Najmah handles personal data in accordance with the General Data Protection Regulation (GDPR, in Dutch: AVG). It covers this website, the contact form, WhatsApp and email contact, and client projects.
Controller
Dana Najmah, freelance web and graphic designer based in the Netherlands, is the controller for the processing described here. Contact: [email protected].
Data We Process
Contact form: name, email address, country, phone number, selected service, budget range, project details, and a record of your consent (date, time and IP address). Direct contact: the details you share by email or WhatsApp. Clients: billing and project details needed to deliver the work. Website use: technical data such as IP address and browser type in server logs, and, only with your consent, statistics via Google Analytics.
Purposes and Legal Bases
Answering your enquiry and preparing a proposal: your consent and steps prior to a contract (GDPR Art. 6(1)(a) and (b)). Delivering and invoicing a project: performance of a contract and legal obligation (Art. 6(1)(b) and (c)). Security, spam and bot prevention: legitimate interest (Art. 6(1)(f)). Website statistics: your consent (Art. 6(1)(a)). We do not use your data for automated decision-making or profiling.
Processors and Recipients
Your data is never sold. We only use service providers bound by processing agreements: Hostinger (hosting and email, EU), Cloudflare Turnstile (bot protection for the contact form) and Google Analytics (Google Ireland Ltd., only after consent, with IP data handled under Google's EU settings). If you contact us via WhatsApp, WhatsApp's own privacy terms also apply. Data may be shared with authorities only when legally required.
Transfers Outside the EU
Some providers (Cloudflare, Google) may process data in the United States. Such transfers rely on the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses approved by the European Commission.
Retention
Enquiries that do not lead to a project are deleted within 12 months of the last contact. Project correspondence is kept for up to 2 years after completion. Invoices and administration are kept for 7 years, as required by Dutch tax law. Analytics data is retained for a maximum of 14 months.
Your Rights
You have the right to access, rectify or erase your data, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting earlier processing. Send your request to [email protected]; we respond within one month. We may ask you to confirm your identity.
Complaints
If you believe your data is not handled correctly, please contact us first. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): autoriteitpersoonsgegevens.nl.
Security and Minors
The website uses an encrypted HTTPS connection, access to data is limited, and the form is protected against spam and bots. Our services are not directed at children under 16, and we do not knowingly collect their data.
Changes
This policy may be updated when our services or the law change. The latest version is always published here with its update date.