This policy explains what personal data Portera collects through this website, why we collect it, who helps us process it, and what you can ask us to do about it.
1Who we are
Portera B.V. is the controller of the personal data collected through portera.nl.
Portera B.V., Beethovenstraat 502, 1082 PR Amsterdam, the Netherlands. KVK 60752262.
Data protection contact: gdpr@portera.nl.
Where we process personal data on behalf of a client as part of delivery work, the client is the controller and a separate agreement governs it. This policy does not cover that.
2What we collect and why
Enquiries you send us. The forms on this site ask for:
- the enquiry form: your name, work email address and message, plus the page you sent it from;
- the “request more information” form: your name, work email address and message, plus the topic you opened it from and the page you sent it from;
- the become-a-client form: your name, work email address, company and message, your confirmation that you agree to this policy, and the page you sent it from;
- the AI use case quick scan: your name, work email address and answers to the scan. We use them to email you a summary and send a copy to our team. We contact you about your results and follow-up discussions only if you tick the box on the form.
We use these details only to reply to your enquiry and, where a conversation follows, to carry it forward. Providing them is voluntary, but we cannot reply without a name and an email address. Your enquiry is sent to us by email; it is not stored on this website or in a database.
Spam protection. When you open or start filling in a form, we load Cloudflare Turnstile, a check that tells people from automated bots. It looks at technical signals from your browser and device, and at your IP address. We use the result only to accept or reject the form.
Website analytics. With your consent, we use Google Analytics to understand how visitors use the site: which pages are viewed, for how long, and whether an enquiry was sent. Nothing from Google is loaded until you accept analytics cookies. Google Analytics does not store your IP address, and we have switched off Google signals and all advertising features.
Technical data. Our hosting provider processes standard technical data, such as your IP address and browser type, to deliver pages and keep the site secure. The logs of the form service record whether a submission succeeded, not what it contained.
We do not sell personal data, and we do not share it with third parties for their own purposes.
3Our legal basis
- Enquiries: Article 6(1)(b) GDPR, steps taken at your request before entering into a contract. Where an enquiry is not about working with us, Article 6(1)(f), our legitimate interest in replying to people who contact us.
- Quick scan: Article 6(1)(b) GDPR for the summary you ask for; Article 6(1)(a), your consent, for contacting you about your results and follow-up discussions.
- Spam protection and security: Article 6(1)(f), our legitimate interest in keeping the site and our inbox free of abuse.
- Analytics: Article 6(1)(a), your consent. Analytics cookies are placed only after you accept them in the cookie banner, and you can withdraw consent at any time.
4Who we share it with
We use the following processors, each under a data processing agreement that limits them to acting on our instructions:
- Microsoft (Azure): hosting of the website and the form service;
- Twilio SendGrid: delivering form submissions to our inbox, and quick scan summaries to you, by email;
- Cloudflare (Turnstile): spam protection on the forms;
- Google (Google Analytics): website analytics, only with your consent.
We disclose data to authorities only where the law requires it.
5Where it is held
The website and the form service run in Microsoft’s West Europe region. Twilio SendGrid, Cloudflare and Google may process data outside the European Economic Area, including in the United States. Where they do, the transfer relies on the EU–US Data Privacy Framework where the provider is certified under it, or on the European Commission’s standard contractual clauses.
6How long we keep it
- Enquiries and quick scans: for as long as needed to handle your enquiry or scan and any business relationship that follows. Those that do not lead to an ongoing relationship are reviewed periodically and deleted.
- Email delivery records: kept by Twilio SendGrid for a limited period, in line with its own retention policy.
- Analytics data: 14 months, as set in our Google Analytics configuration.
- Form service logs: 30 days.
- Hosting logs: kept by Microsoft for a limited period, in line with its own retention policy.
7Automated decision-making
We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.
8Your rights
Under the GDPR you have the right to:
- access your personal data;
- have inaccurate data corrected;
- have your data deleted;
- restrict how we process your data;
- object to processing based on our legitimate interest;
- receive your data in a portable format;
- withdraw consent at any time; withdrawal does not affect processing that took place before it.
To exercise any of these rights, email gdpr@portera.nl and tell us what you would like us to do. There is no form to fill in. We respond within one month. In some circumstances we may not be able to comply, for example where the law requires us to keep the data; if so, we tell you why.
You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or with the regulator where you live.
9Keeping it safe
We apply access controls, encryption in transit, and the security practices we would expect of any engineering business handling client information. No system is perfect; if a breach ever affected your rights, we would tell you and the regulator as the law requires.
10Cookies
Which cookies we use, and how to change what you allow, is set out in our cookie policy.
11Children
This website is not directed at children. We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has sent us personal data through this website, email gdpr@portera.nl and we will delete it.
12Changes and contact
We update this policy when our practices or the law change, and the date at the top shows when it last changed. For anything about it, write to Portera B.V., Beethovenstraat 502, 1082 PR Amsterdam, the Netherlands, or email gdpr@portera.nl.