Privacy Policy

Last Updated: 14 February 2026

1. Introduction & Controller Identity

This Privacy Policy explains how Zeuven Heuvels B.V. ("we", "us", "our") collects, uses, and protects your personal data when you visit our website. We are the data controller within the meaning of the General Data Protection Regulation (EU) 2016/679 ("GDPR").

Data Controller: Zeuven Heuvels B.V., Zeuven Heuvels 22, 8091 AG Wezep, Netherlands.
Contact email: [email protected]
Phone: +31 38 376 2148

This policy is effective as of the "Last Updated" date shown above. We encourage you to review it periodically.

2. Personal Data We Collect

We may collect the following categories of personal data, depending on how you interact with our site:

• Identity & contact data: name, email address, phone number, province/territory or country of residence — collected when you submit our contact form.
• Form content: messages, subject selections, document links, and any other information you choose to include in your submission.
• Technical data: IP address, browser type and version, device type and operating system, language preference — collected automatically when you visit our site.
• Usage data: pages visited, time spent on pages, referring URL, click paths, and navigation patterns.
• Cookies & identifiers: session cookies, consent preference cookies, and — where you have given consent — analytics and marketing cookies. Full details are provided in Section 4 below and in our Cookie Policy.
• Conversion events: form submissions and interactions with call-to-action elements, used to measure the effectiveness of advertising campaigns (only with consent).

We do not collect special-category data (health status, religious beliefs, political opinions, biometric data), financial account details, or government-issued identification numbers.

3. Why We Process & Legal Basis

Under Article 6 of the GDPR, we process your personal data on the following legal bases:

• Contact form submissions: Article 6(1)(b) — processing necessary for the performance of a contract or to take steps at your request prior to entering into a contract; and Article 6(1)(a) — your consent, provided through the consent checkbox on the form.
• Analytics: Article 6(1)(a) — your explicit consent, given through our cookie consent banner.
• Marketing, remarketing, and lookalike audiences: Article 6(1)(a) — your explicit consent.
• Security and fraud prevention: Article 6(1)(f) — our legitimate interest in protecting the security and integrity of our website and systems.
• Legal and tax obligations: Article 6(1)(c) — processing necessary for compliance with a legal obligation to which we are subject under Dutch law.

Automated Decision-Making (Article 22): We do not engage in automated decision-making or profiling that produces legal or similarly significant effects on individuals.

4. Cookies & Tracking

Our website uses three categories of cookies. Full details, including a cookie-by-cookie table, are available in our Cookie Policy.

Essential cookies (no consent required, always active): These include _site_session (session continuity, expires at end of session) and cookie_consent (stores your consent choice, 12 months). These cookies are strictly necessary for the site to function and cannot be disabled.

Analytics cookies (consent required): When you consent, we may use Google Analytics 4 with IP anonymisation enabled. Cookies include _ga (2-year retention) and _ga_XXXXXXXXXX (2-year retention, where XXXXXXXXXX is our GA4 measurement ID). Data retention in Google Analytics is set to 14 months.

Marketing cookies (consent required): When you consent, we may use cookies for advertising attribution and remarketing. These include _gcl_au (Google Ads conversion linker, 90 days), _fbp (Meta Pixel browser identifier, 90 days), and _fbc (Meta Pixel click identifier, 90 days). These cookies are used for remarketing, custom and lookalike audience creation, and conversion attribution.

Beyond cookies, we may use pixel tags (such as gtag.js and Meta Pixel), server-side event transmission via Meta Conversion API or Google server-side GTM (using hashed identifiers), and device identifiers derived from IP address and User-Agent string — all subject to your consent for analytics and marketing categories.

5. Consent (EEA/UK)

Users in the European Economic Area and the United Kingdom receive a consent notice under the GDPR and UK GDPR respectively. Marketing and analytics cookies are activated only after explicit, informed, and freely given consent in accordance with Article 6(1)(a). Your consent preference is recorded in the cookie_consent browser cookie, which is retained for 12 months.

You may withdraw your consent at any time by clicking "Manage cookie preferences" in the footer of any page on our site, or by clearing your browser cookies. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

6. Sharing With Advertising & Service Partners

Where you have given consent, we may share data with the following third-party service providers:

• Google LLC (Google Analytics 4, Google Ads, Google Tag Manager, Remarketing): cookie identifiers, usage data, conversion events, and remarketing lists. Google's privacy policy: policies.google.com/privacy.
• Meta Platforms, Inc. (Meta Pixel, Custom Audiences, Lookalike Audiences, Conversion API): page views, conversion events, audience membership, and hashed identifiers. Meta's privacy policy: facebook.com/privacy/policy.
• Cloudflare, Inc. (CDN and security services): IP-based threat detection. Cloudflare's privacy policy: cloudflare.com/privacypolicy.

We do not sell personal data. These providers are contractually prohibited from using data collected through our site for their own independent commercial purposes.

7. International Transfers

Some of our service providers (Google, Meta, Cloudflare) are based in the United States. When personal data is transferred outside the EEA or UK, we rely on the following safeguards:

• EU-US Data Privacy Framework (primary mechanism, in effect since July 2023)
• UK Extension to the Data Privacy Framework
• Swiss-US Data Privacy Framework
• Standard Contractual Clauses (EU Commission Decision 2021/914) as a fallback mechanism
• UK International Data Transfer Agreement (IDTA) as an additional fallback for UK data subjects

8. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected:

• Contact form submissions: 2 years from the last correspondence related to your enquiry.
• Analytics data: 14 months (Google Analytics 4 data retention setting).
• Marketing cookies: per the cookie lifetime specified in Section 4 (typically 90 days).
• Email correspondence: duration of the relationship plus 1 year.
• Server logs: 90 days.
• Cookie consent records: 3 years, retained for audit and compliance purposes.
• Legal and tax records: as required by applicable Dutch law, typically 7 years for financial records.

Where data is retained for journalistic purposes (such as source verification files), the retention period may be longer, in accordance with the journalistic exemption under Article 85 of the GDPR and its implementation in Dutch law (Uitvoeringswet AVG).

9. Your Rights Under the GDPR & UK GDPR

You have the following rights in relation to your personal data:

• Right of Access (Article 15): You may request a copy of the personal data we hold about you.
• Right to Rectification (Article 16): You may request correction of inaccurate or incomplete data.
• Right to Erasure (Article 17): You may request deletion of your personal data, subject to legal exceptions.
• Right to Restriction of Processing (Article 18): You may request that we limit how we use your data in certain circumstances.
• Right to Data Portability (Article 20): You may request your data in a structured, commonly used, machine-readable format.
• Right to Object (Article 21): You may object to processing based on legitimate interests.
• Right to Withdraw Consent (Article 7(3)): Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint (Article 77): You have the right to file a complaint with a supervisory authority.

To exercise any of these rights, please email us at [email protected] with the subject line "Privacy Rights Request". We will respond within 30 days. In complex cases, this period may be extended by an additional 60 days, in which case we will inform you of the extension and the reasons for it within the initial 30-day period.

Lead Supervisory Authority: Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Bezuidenhoutseweg 30, 2594 AV Den Haag, Netherlands — autoriteitpersoonsgegevens.nl.

10. Children

This site is not directed at individuals under 16 years of age. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected data from a child under 16 without verifiable parental consent, we will delete that data promptly. If you believe a child has provided us with personal data, please contact us at the email address above.

11. Do Not Track

This website does not respond to "Do Not Track" (DNT) browser signals, as there is no universally accepted standard for how DNT signals should be interpreted. Third-party providers used on this site may have their own DNT handling policies, which are described in their respective privacy policies linked in Section 6.

12. Account & Data Deletion

To request deletion of all personal data we hold about you, send an email to [email protected] with the subject line "Data Deletion Request". We will complete the deletion within 30 days of verifying your identity. Limited retention beyond this period is only permitted where Dutch or EU law requires it (for example, tax records under the Algemene wet inzake rijksbelastingen).

13. Business Transfers

In the event of a merger, acquisition, asset sale, financing arrangement, or insolvency proceeding, personal data may be transferred to a successor entity as part of the transaction. In such cases, we will notify users via a prominent notice on our website if the transfer materially changes how personal data is used. The successor entity will be bound by the terms of this Privacy Policy until a revised policy is published.

14. California Residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

Categories of personal information disclosed in the past 12 months:

• Identifiers (name, email, IP address, device identifiers) — disclosed to service providers and advertising partners.
• Internet or other electronic network activity (browsing history, interactions with our site) — disclosed to analytics and advertising providers.
• Inferences (interests, preferences derived from activity) — disclosed to advertising partners.

We do not sell personal information as defined by the CCPA. We do share personal information for cross-context behavioural advertising; California residents may opt out of this sharing via our cookie preferences panel, accessible through the "Manage cookie preferences" link in the site footer.

Your California rights: Right to Know, Right to Delete, Right to Correct, Right to Opt-Out of sale or sharing, and Right to Non-Discrimination. To exercise these rights, email us with the subject line "California Privacy Request". We may require identity verification before processing your request. Authorised agents may submit requests on your behalf with written proof of authorisation.

15. Virginia Residents (VCDPA)

Virginia residents have the following rights under the Virginia Consumer Data Protection Act: Access, Correct, Delete, Data Portability, and Opt-Out of targeted advertising. To exercise these rights, email us with the subject line "Virginia Privacy Request".

We do not sell personal data or engage in profiling that produces legal or similarly significant effects. If we refuse a request, you may appeal by emailing us with the subject line "Appeal of Refusal — Privacy Request". We will respond to appeals within 60 days. If unresolved, you may contact the Virginia Attorney General.

16. Nevada Residents

Nevada residents may submit a verified opt-out request by emailing us with the subject line "Nevada Do Not Sell Request". We do not currently sell personal information as defined under Nevada Revised Statutes Chapter 603A.

17. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced via a prominent banner on our homepage at least 14 days before taking effect. The "Last Updated" date at the top of this page will be revised with every update. We encourage you to review this page periodically.

18. Contact

If you have any questions or concerns about this Privacy Policy or the way we handle your personal data, please contact us:

Zeuven Heuvels B.V.
Zeuven Heuvels 22
8091 AG Wezep, Netherlands
Email: [email protected]
Phone: +31 38 376 2148