Privacy and Cookie Notice
Version 1.1 | Effective date: 3 April 2026
Veralex Consultancy is established in the Netherlands and operates the website www.veralex.nl (the "Website"). For the purposes of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Dutch implementing legislation (Uitvoeringswet AVG), Veralex Consultancy is the data controller for the personal data described in this Notice.
Privacy contact: privacy@veralex.nl
Address: Reitseplein, Tilburg, 5037 AA, The Netherlands
This Notice covers two categories of people:
• Visitors to our Website, anyone who browses www.veralex.nl, regardless of whether they submit any information.
• People who contact us via our contact form; including the name, email address, and message content you submit.
If you are a client or counterparty in an active business relationship with Veralex Consultancy, a separate data processing notice will be provided to you directly.
When you visit our Website, we automatically collect a limited set of technical data through cookies and standard server logging:
• IP address (truncated where technically possible)
• Browser type and version
• Operating system
• Pages visited and time spent on them
• Referring URL
Purpose: to understand how the Website is used, to diagnose technical problems, and to improve usability.
Legal basis: Article 6(1)(f) GDPR (legitimate interests) for low-impact, privacy-friendly analytics. Article 6(1)(a) GDPR (your consent) for any analytics or advertising cookies that go beyond low-impact measurement. See section 5 for the full cookie breakdown.
When you use the contact form on our Website, we collect:
• Your name
• Your email address
• The content of your message
Purpose: to respond to your enquiry.
Legal basis: Article 6(1)(f) GDPR (legitimate interests) — it is in both your interest and ours to be able to handle and respond to inbound enquiries. Where your message relates to a potential contract with us, Article 6(1)(b) GDPR (pre-contractual steps) may also apply.
• Website visitor and analytics data: 13 months from the date of collection, after which it is deleted or fully anonymised.
• Contact form submissions: 12 months from the date of your last communication with us. If your enquiry leads to a contract, the applicable contractual retention period will apply from that point forward.
• Cookie data: retention periods vary by cookie type and are set out in section 5 below.
Once a retention period expires, data is securely deleted or anonymised so that it can no longer be linked to you.
Cookies are small text files placed on your device when you visit a website. They allow the website to recognise your browser and remember certain information across pages or visits. Cookies cannot access other files on your device.
Cookie use in the Netherlands is governed by two overlapping frameworks: the GDPR and Article 11.7a of the Dutch Telecommunications Act (Telecommunicatiewet), which implements the ePrivacy Directive. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) supervises the GDPR aspects. The Netherlands Authority for Consumers and Markets (Autoriteit Consument en Markt, ACM) supervises compliance with Article 11.7a of the Telecommunications Act in relation to the placement of cookies itself.
Strictly necessary cookies
These cookies are essential for the Website to function. For example, to remember your cookie preferences. They fall within the exemption in Article 11.7a Telecommunicatiewet for technically necessary cookies and are placed without requiring your consent. You may disable them via your browser settings, though this may affect Website functionality.
Analytics cookies (low-impact)
Where we use analytics solely to count visitors and measure page performance with no cross-site tracking and with IP addresses truncated Dutch law does not require consent for these cookies, provided they have little or no impact on privacy. We inform you of their use through this Notice. The legal basis for any personal data processed through such cookies is Article 6(1)(f) GDPR (legitimate interests in understanding Website usage).
Analytics cookies (beyond low-impact) and advertising cookies
If we deploy analytics tools that go beyond low-impact measurement, or any advertising or tracking cookies, these are placed only on the basis of your explicit consent under Article 6(1)(a) GDPR and Article 11.7a Telecommunicatiewet. You can give or withdraw consent at any time via the cookie management panel in the footer of every page. Withdrawal of consent does not affect the lawfulness of any processing that took place before withdrawal.
You can also control or delete cookies directly through your browser:
For general information on cookies, visit www.allaboutcookies.org.
We do not sell your personal data. We share it only where necessary:
• Hosting and infrastructure providers who store Website data on our behalf. These parties act as processors under Article 28 GDPR and are bound by data processing agreements.
• Public authorities, where we are required to disclose data by law.
We do not share contact form submissions with third-party marketing platforms or data brokers.
Where any service provider processes your data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place in accordance GDPR. You may request details of the specific safeguards by contacting us at privacy@veralex.nl
Under the GDPR you have the following rights in relation to your personal data:
• Access (Article 15): to obtain confirmation of whether we hold your data and, if so, a copy of it.
• Rectification (Article 16): to have inaccurate or incomplete data corrected.
• Erasure (Article 17): to have your data deleted where one of the grounds in Article 17(1) applies and no exception under Article 17(3) is relevant.
• Restriction (Article 18): to restrict processing in certain circumstances, for example while accuracy is disputed.
• Object (Article 21): to object to processing based on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Withdraw consent (Article 7(3)): where processing is based on consent, to withdraw it at any time without affecting prior processing.
To exercise any of these rights, contact us at privacy@veralex.nl. We will respond within one month. Where a request is complex, we may extend this by a further two months and will inform you within the first month.
You also have the right to lodge a complaint with the relevant supervisory authority:
For GDPR matters:
Autoriteit Persoonsgegevens (AP)
Website: www.autoriteitpersoonsgegevens.nl | Telephone: +31 88 1805 250
For cookie placement matters:
Autoriteit Consument en Markt (ACM)
Website: www.acm.nl
We apply appropriate technical and organisational measures under Article 32 GDPR to protect your personal data against unauthorised access, loss, or alteration. These include encryption in transit and access controls on our systems.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the AP within 72 hours and, where required, will notify you directly.
We may update this Notice from time to time. When we do, we will revise the version number and effective date at the top. For material changes, we will provide a clear notice on the Website.
For any questions about this Notice or to exercise your rights:
Veralex Consultancy
Email: privacy@veralex.nl
Address: Reitseplein, Tilburg, 5037 AA, Netherlands