Privacy & legal
Company details
- Company
- Refrect VOF, trading as Refrect
- Legal form
- Vennootschap onder firma (VOF), the Netherlands
- Chamber of Commerce (KvK)
- 42124298
- VAT ID
- NL869836067B01
- info@refrect.com
- Website
- refrect.com
Privacy policy
This policy explains which personal data Refrect VOF (“Refrect”, “we”) processes through refrect.com, why we do so, how long we keep it and what your rights are.
Who is responsible
Refrect VOF is the controller for the processing described in this policy. For any privacy question or request, contact us at info@refrect.com. We have not appointed a data protection officer, as this is not required for our activities.
Contact form
If you leave your email address through the contact form, we receive it together with the time of your request and use it only to get back to you. The notification is delivered to our inbox through our email provider, Resend. We do not use your address for newsletters or marketing.
Legal basis: taking steps at your request before a possible agreement, and our legitimate interest in responding to enquiries (Art. 6(1)(b) and (f) GDPR). Leaving your email address is voluntary; without it we cannot get back to you. You can also email us directly.
How long we keep your data
We keep your email address and our correspondence for as long as needed to handle your enquiry, and delete it no later than 12 months after our last contact. If your enquiry leads to an agreement, we keep the relevant correspondence for as long as the agreement runs and afterwards for as long as the law requires, such as the seven-year retention period for business records under Dutch tax law.
Resend keeps a copy of each notification and its delivery logs for 30 days. Technical data used for spam protection and hosting is kept only briefly, as described below.
Spam protection: Cloudflare Turnstile
To protect the contact form against spam and automated abuse, we use Cloudflare Turnstile in Invisible mode. It runs in the background when you visit the website and does not ask you to solve a puzzle. To distinguish people from bots, Turnstile processes technical signals from your browser and connection, such as your IP address, TLS fingerprint and browser user agent, together with our site key and the website’s origin.
For this bot check, Cloudflare acts as our processor. Cloudflare also uses these signals as an independent controller to improve its bot detection. Our legal basis is our legitimate interest in keeping the website and our inbox secure (Art. 6(1)(f) GDPR). The check is automated: if a request is identified as automated, the form submission is refused. It has no other consequences for you, and you can always reach us by email. For details, see Cloudflare’s Turnstile Privacy Addendum and Privacy Policy.
To limit repeated submissions, our server also keeps your IP address briefly in temporary memory. It is not stored permanently.
Hosting
The website is hosted by Vercel. To deliver pages and keep the service secure, Vercel processes technical data such as your IP address and browser information in server logs, which are kept for a limited period. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).
Website statistics: Vercel Web Analytics
To understand how many people visit the website and which pages they view, we use Vercel Web Analytics. It does not use cookies and does not follow you across other websites. For each page view it records the page address, the referring website, the time, your approximate location (country, region and city) and your browser, operating system and device type. Instead of a cookie, visits are recognised by a hash calculated from your request, which is discarded after 24 hours. We only see aggregated statistics, not individual visitors.
Vercel provides this service as our processor. Legal basis: our legitimate interest in understanding and improving our website (Art. 6(1)(f) GDPR). See Vercel’s Web Analytics privacy information for details.
Cookies and tracking
We do not use cookies for analytics, advertising or tracking: our website statistics work without them, and our fonts are served from our own domain. Cloudflare Turnstile processes only the signals described above, which are strictly necessary for bot detection; see Cloudflare’s Cookie Policy for more information.
Service providers and international transfers
We share personal data only with the providers named in this policy: Vercel (hosting and website statistics), Resend (email delivery) and Cloudflare (spam protection). They process it on our behalf under data processing terms. Some of this data is processed outside the European Economic Area, including in the United States. These transfers are protected by the EU Standard Contractual Clauses and, where applicable, the EU–U.S. Data Privacy Framework. We do not sell personal data or use it for advertising.
Other websites
Our website links to Instagram. When you follow that link, Instagram’s own privacy policy applies.
Your rights
Under the GDPR you have the right to access, correct or delete your personal data, to restrict or object to its processing, and to data portability. To exercise these rights, email info@refrect.com. We respond within one month. You can also lodge a complaint with the Dutch Data Protection Authority, Autoriteit Persoonsgegevens.
Changes
We may update this page from time to time. The date at the top shows the latest version.