Privacy and cookies

Meraky Consulting is the controller for the personal data described here. You can reach us at pr@merakyconsulting.com, and by post at Arenastraat 41, 2492WV The Hague, the Netherlands.

This notice covers this website only. It does not cover systems we build or operate for clients, where the client is normally the controller and separate arrangements apply.

Nothing on this site writes a cookie to your browser, and no advertising or profiling technology runs on it. That is why you were not asked to accept anything on arrival — a banner would be theatre.

Fonts are served from this domain rather than from a font provider, so loading a page does not disclose your visit to a third party.

We use Vercel Analytics to count page views and see which pages are read. It is cookieless and does not build a profile of you or follow you across sites. It records aggregate figures such as page path, referrer, country, and a coarse device type.

The lawful basis is our legitimate interest in knowing whether the site is working, balanced against a measurement method that was chosen specifically because it does not identify you.

The form collects your name, email address, optionally your company, what you are interested in, and your message. It is sent to our inbox as an email. It is not stored in a database on this site, not added to a marketing list, and not used to send you anything you did not ask for.

Resend acts as processor for that delivery. Your submission passes through their service in order to reach us, and they process it on our instructions only.

The lawful basis is that the processing is necessary to take steps at your request before entering into a contract, or our legitimate interest in replying to a business enquiry where no contract follows.

If sending your message fails, the error is reported to an error tracking service so that we find out rather than you. What is sent is the failure itself — what went wrong and where in the code. Your name, address and message are deliberately not attached, and neither is your IP address.

The site also applies a simple rate limit, which briefly holds the time of recent submissions against the requesting IP address in memory. It is there to stop automated abuse, is not written to disk, and is discarded within minutes.

The referral form collects your name and email address, optionally your company or role, and details of the introduction: the company, the name and role of your contact there, how you know them, what they need and an estimated budget. It also records the time of registration and any campaign tags in the link you arrived from, such as which post it was.

It is sent to our inbox as an email, and a confirmation is sent to you, both through Resend on the same terms as the contact form. It is not stored in a database on this site. The same rate limit and error reporting apply, and neither carries what you typed.

The lawful basis is our legitimate interest in recording who made an introduction and when, so that eligibility can be decided and any fee paid. The form asks you to confirm you have permission to share your contact’s details. If you are that contact, you can ask us what was shared about you and have it deleted.

Enquiries that do not lead to work are deleted within twelve months. Where an enquiry becomes an engagement, the correspondence is kept for as long as the business relationship lasts and afterwards for as long as Dutch administrative and tax retention obligations require.

Referral registrations are kept for the nine-month attribution window, because that is what decides whether a fee is owed. Where a fee is paid, the record is kept as long as those same retention obligations require. Registrations that lead to no fee are deleted within twelve months of the window closing.

Waitlist entries are kept until you leave the list or enrol, and are deleted within twelve months of the sign-up if enrolment has not opened by then.

The code that receives a form submission runs in Frankfurt, and Resend delivers the resulting email from its Ireland region. The path your message takes therefore stays inside the EU.

The pages themselves are static and are served from a content delivery network with locations worldwide, so the page you are reading may have been sent from a server outside the EEA. That content is public and carries no personal data; only the request itself, including your IP address in transit, reaches that layer.

Both providers are established in the United States and can in principle be reached by their US parent. Where that matters, the transfer safeguards those providers have in place apply, and we keep the data reaching them to the minimum the form needs.

You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, or object to processing based on legitimate interest. Email us and we will deal with it — in practice this usually means deleting an email thread, and we will confirm when it is done.

If you are not satisfied with how we handle it, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Any change is published on this page with a new date at the top. If a change materially affects someone who has already contacted us, we will tell them directly rather than relying on this page.