Last updated 3 August 2026

Privacy statement

This statement explains what personal data I collect, why, and what rights you have. It is written to meet the requirements of the General Data Protection Regulation (EU) 2016/679 and the Dutch implementing act (Uitvoeringswet AVG).

1. Who is responsible

The controller for the processing described here is:

This is a one-person practice. There is no statutory obligation to appoint a data protection officer, and none has been appointed. Any question about personal data reaches me directly at the address above.

2. This website sets no cookies

This site is a set of static files. It sets no cookies, runs no analytics, embeds no tracking pixels, loads no third-party fonts or scripts, and has no contact form. There is nothing to consent to, which is why you were not asked to.

Fonts and stylesheets are served from this domain rather than from a content delivery network, so visiting a page does not disclose your visit to any third party beyond the hosting provider named below.

There is a small amount of JavaScript, served from this domain. It switches the page between the light and dark theme, copies a registration number to your clipboard when you press the button next to it, and highlights the section you are reading. It sends nothing anywhere and makes no network requests of its own.

If you use the theme switch, your choice is stored on your own device in browser local storage under the key kvoma-theme, holding the single word light or dark. It is not a cookie, it contains no identifier, it is never transmitted to me or to anyone else, and clearing your browser's site data removes it. Because it exists only to deliver a display setting you explicitly asked for, it falls within the exemption in Article 11.3 of the Dutch Telecommunications Act and needs no consent.

3. What is processed when you visit

This site is hosted by Vercel Inc. As is unavoidable for any website, the hosting infrastructure records technical request data in server logs: your IP address, the time of the request, the page requested, the referring page where one is sent, and your browser's user-agent string.

• Purpose: delivering the site, maintaining security, and diagnosing faults.
• Legal basis: legitimate interests under Article 6(1)(f) GDPR — operating a functioning and secure website. I do not use these logs to build a profile of you.
• Retention: log data is retained by the hosting provider under its own standard retention period and is not exported, enriched or combined with anything else by me.

Vercel Inc. is established in the United States. Transfers of this technical log data outside the European Economic Area take place under the safeguards Vercel maintains for that purpose, including the European Commission's Standard Contractual Clauses. Vercel's own privacy notice is published at vercel.com/legal/privacy-policy.

4. If you contact me

When you send an email or call, I process what you choose to send: your name, your email address or telephone number, and the content of your message.

• Purpose: answering you and, where it leads somewhere, preparing and performing an engagement.
• Legal basis: Article 6(1)(b) GDPR where the exchange concerns a contract or steps taken before entering one; otherwise Article 6(1)(f), my legitimate interest in responding to correspondence addressed to me.
• Retention: correspondence that does not lead to an engagement is deleted within two years. Correspondence forming part of an engagement is retained for the statutory administrative period of seven years under Dutch tax law, and longer only where another statutory obligation requires it.

Email for this domain is handled through Google Workspace, supplied by Google Ireland Limited as a processor under a data processing agreement.

5. Client data during an engagement

Where I build or operate a system that processes personal data on behalf of a client, the client is the controller and I act as a processor. That relationship is governed by a written processing agreement (verwerkersovereenkomst) concluded before any processing begins, which sets out the scope, the security measures, the use of any sub-processors, and what happens to the data when the engagement ends.

Where the engagement calls for it, systems are deployed on infrastructure inside the European Union under the client's own account and credentials, so that data does not pass through my hands at all. This statement does not govern that processing; the client's own privacy notice does.

6. Who else receives data

I do not sell personal data, and I do not share it for advertising. Beyond the hosting and email providers named above, personal data is disclosed only to:

• my accountant and, where relevant, the Dutch tax authority, for statutory administration;
• a public authority where I am legally obliged to disclose it.

7. Automated decision-making

I do not make decisions about you by automated means, and I do not carry out profiling within the meaning of Article 22 GDPR.

8. Security

Correspondence and business records are held on access-controlled accounts protected by strong authentication, including two-factor authentication where the provider supports it. Systems built for clients are deployed with credentials issued to the client rather than shared, and access is limited to what a task requires.

9. Your rights

Under the GDPR you may ask me to:

• confirm what personal data I hold about you, and give you a copy (Article 15);
• correct data that is inaccurate or incomplete (Article 16);
• erase data where there is no longer a valid ground to keep it (Article 17);
• restrict processing while a dispute about accuracy or grounds is resolved (Article 18);
• provide data you gave me in a portable, machine-readable form (Article 20);
• stop processing carried out on the basis of legitimate interests (Article 21).

Write to contact@kvoma.com. I will respond within one month. There is no charge, and I will not ask you to justify the request beyond establishing that it is you making it.

10. Complaints

If you are not satisfied with how I have handled your data, you may lodge a complaint with the Dutch supervisory authority:

I would rather hear from you first, but that right is yours regardless.

11. Changes

If this statement changes, the revised version is published here with a new date at the top. There is no mailing list, so please check this page if it matters to you.