Privacy and cookies

Meraky Consulting is the controller for the personal data described here. You can reach me at pr@merakyconsulting.com, and by post at Arenastraat 41, 2492WV The Hague, the Netherlands.

This notice covers this website only. It does not cover systems I build or operate for clients, where the client is normally the controller and separate arrangements apply.

Nothing on this site writes a cookie to your browser, and no advertising or profiling technology runs on it. That is why you were not asked to accept anything on arrival — a banner would be theatre.

Fonts are served from this domain rather than from a font provider, so loading a page does not disclose your visit to a third party.

I use Vercel Analytics to count page views and see which pages are read. It is cookieless and does not build a profile of you or follow you across sites. It records aggregate figures such as page path, referrer, country, and a coarse device type.

The lawful basis is my legitimate interest in knowing whether the site is working, balanced against a measurement method that was chosen specifically because it does not identify you.

The form collects your name, email address, optionally your company, what you are interested in, and your message. It is sent to my inbox as an email. It is not stored in a database on this site, not added to a marketing list, and not used to send you anything you did not ask for.

Resend acts as processor for that delivery. Your submission passes through their service in order to reach me, and they process it on my instructions only.

The lawful basis is that the processing is necessary to take steps at your request before entering into a contract, or my legitimate interest in replying to a business enquiry where no contract follows.

If sending your message fails, the error is reported to an error tracking service so that I find out rather than you. What is sent is the failure itself — what went wrong and where in the code. Your name, address and message are deliberately not attached, and neither is your IP address.

The site also applies a simple rate limit, which briefly holds the time of recent submissions against the requesting IP address in memory. It is there to stop automated abuse, is not written to disk, and is discarded within minutes.

Enquiries that do not lead to work are deleted within twelve months. Where an enquiry becomes an engagement, the correspondence is kept for as long as the business relationship lasts and afterwards for as long as Dutch administrative and tax retention obligations require.

The code that receives a contact form submission runs in Frankfurt, and Resend delivers the resulting email from its Ireland region. The path your message takes therefore stays inside the EU.

The pages themselves are static and are served from a content delivery network with locations worldwide, so the page you are reading may have been sent from a server outside the EEA. That content is public and carries no personal data; only the request itself, including your IP address in transit, reaches that layer.

Both providers are established in the United States and can in principle be reached by their US parent. Where that matters, the transfer safeguards those providers have in place apply, and I keep the data reaching them to the minimum the form needs.

You can ask for a copy of what I hold about you, ask me to correct it, ask me to delete it, ask me to restrict what I do with it, or object to processing based on legitimate interest. Email me and I will deal with it — in practice this usually means deleting an email thread, and I will confirm when it is done.

If you are not satisfied with how I handle it, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Any change is published on this page with a new date at the top. If a change materially affects someone who has already contacted me, I will tell them directly rather than relying on this page.