Privacy policy

1. Who is responsible

TH WORKS is the data controller for the processing described in this document.

• Company name: [to be supplied]
• Legal form: [to be supplied]
• Registered address: [to be supplied]
• Chamber of Commerce number: 42147653
• VAT number: NL005534149B98
• General contact: info@thworkssystems.com
• Privacy requests: info@thworkssystems.com

Where a marker appears above instead of a detail, that detail has not been finalised yet. It will be filled in once registration is complete; we would rather leave a gap here than state something that later turns out to be wrong.

2. What personal data we process

Through the form on the project page we process only what you enter there yourself:

• your name
• your email address
• your phone number
• your company name, if you fill it in — that field is optional
• the content of your message
• the language of the page you sent the form from (nl or en)

If you would rather email us directly, we process whatever you put in that email. What goes in it is up to you; please do not send us data your question does not need.

In addition, the party hosting this website processes the technical data needed to serve a page: your IP address and ordinary server logs, such as the address requested, the time, the status code and the browser type. That is inherent to requesting a web page and happens on every website. The hosting party is Vercel Inc.

To see how the website is used, we keep our own visit statistics — how that works and what is and is not recorded is set out under "Cookies, statistics and trackers".

We do not buy data, we do not enrich it from other sources, and we do not build profiles.

3. Why we process it

We use your data for these purposes and no others:

• to reply to your enquiry or your email
• to contact you about a possible project
• to prepare and carry out a quote or an agreement
• to meet administrative and legal obligations once you become a client
• to serve and secure the website technically
• to understand how the website as a whole is used, so we can improve it

4. The legal basis

The GDPR requires a legal basis for every processing operation. For us there are four.

• Replying to your enquiry and preparing a quote: taking steps at your request before entering into a contract (Article 6(1)(b) GDPR).
• Carrying out work once you are a client: performance of the contract (Article 6(1)(b) GDPR).
• Keeping your email if you write to us directly, serving and securing the website, and keeping anonymous visit statistics: our legitimate interest in being reachable, keeping the site working and knowing whether it does what it is meant to (Article 6(1)(f) GDPR).
• Keeping invoices and accounts: compliance with a legal obligation (Article 6(1)(c) GDPR).

We never ask you to consent to cookies, for the simple reason that we do not set any.

5. Cookies, statistics and trackers

This website sets no cookies for visitors. Not functional, not analytical, not advertising — and therefore no cookie banner either. Only the website's administrator receives one strictly necessary sign-in cookie, after signing in to the protected admin area.

There is no Google Analytics or any third-party statistics package. There are no advertising or tracking pixels, no social media buttons or widgets, and no embedded third-party content — such as videos or maps — that could observe you.

The website does keep its own anonymous visit statistics: which pages are viewed, for how long and how far down, what kind of source a visit comes from (for example a search engine or a link on another site), the type of device, the browser and operating system, the country, and which buttons and links are clicked — such as "Start a project" or the email address. This happens without cookies and without storing anything in your browser.

Your IP address is not stored. To count visits from the same day together, an irreversible code is calculated from your IP address, your browser details and a random key. That key is replaced every day and the old one destroyed, so after that day a code can no longer be linked to you or to an earlier visit. Of your location, only the country is recorded — no city or address.

If your browser sends the Global Privacy Control signal, your visit is not counted at all. Known search engine robots and other automated visitors are not counted either.

One exception to that anonymity: if you send the enquiry form, your request is linked to the visit you sent it from, so we can see which pages you looked at before getting in touch. That link exists only because you send a request yourself, and disappears as soon as the request or the visit is deleted — at the latest after the retention periods below.

Fonts are served from this website itself rather than fetched from an external font service. Opening a page therefore tells nobody else that you were here.

Nothing is written to your browser's storage, with one exception: if you ask the assistant to take you to the contact form, what you told her travels along via sessionStorage so you don't have to type it twice. That disappears the moment you close the tab, and it does not go through the web address — a visitor's own words do not belong there.

This was verified on the website itself rather than assumed. Across a full page visit, zero cookies are set, and every request goes to this website — the statistics included — the single exception being the question you yourself put to the assistant, see below.

6. The assistant (NOVA)

This website carries NOVA, a digital assistant that answers questions about TH WORKS. The conversation is not kept: it lives in your browser's memory and disappears the moment you close the page. No conversation history is built up, and there is no database that conversations end up in.

Most answers come from a fixed set of texts held on this website itself; for those, your question never leaves your own device. When NOVA does not know an answer, that question — together with the last few messages of the conversation, so the answer makes sense — is sent to Anthropic PBC to have an answer drafted. We do not keep that question, and no name, email address or other detail about you is sent along; only what you type into the window yourself.

So do not type anything into the chat window that you would rather not share. If you have something confidential to raise, use the contact form or email us directly.

7. Who we share data with

We do not sell your data, and we do not share it for advertising or marketing.

There are, however, parties that necessarily process data because they provide a service this website or our work depends on. We put a data processing agreement in place with such parties.

• Hosting: Vercel Inc. — processes your IP address and server logs in order to serve pages.
• Email: Resend (Plus Five Five, Inc.) — processes the messages you send us and we send you.
• Database: Neon (Postgres, EU region Frankfurt) — stores the anonymous visit statistics and a copy of submitted enquiry forms.
• Assistant: Anthropic PBC — processes the question you put to NOVA, and only at the moment you ask it.
• Accounts: our bookkeeper or accountant may see data that forms part of our administration, such as invoices. The Dutch tax authority may also request access where it is entitled to.

No external form service is in use. A submitted form is handled by the website itself on the hosting party's server and does not pass through a form platform. Besides our mailbox, a copy goes to our own database so we can find and follow up enquiries. Only the TH WORKS administrator can see it.

8. Transfers outside the EEA

In principle we process personal data within the European Economic Area.

Whether that holds in full depends on the hosting and email providers: some store data in the EU but have components or support outside it. The current position is: [to be supplied]

Where a transfer outside the EEA does take place, it happens only on the basis of an adequacy decision of the European Commission or the European Commission's standard contractual clauses (SCCs).

9. How long we keep data

We do not keep data longer than necessary, and not everything for the same length of time.

• Enquiries and contact requests that do not lead to work: no longer than two years after the last contact.
• Correspondence around a project: until the project is finished, and after that for as long as needed to answer questions about it — as a rule no more than two years.
• Data forming part of our administration, such as invoices and order confirmations: seven years, because Dutch tax law requires it.
• Server logs at the hosting party: according to that party's retention period, typically weeks to months.
• Anonymous visit statistics: thirteen months, after which they are deleted automatically.
• The copy of an enquiry in our database: deleted automatically after two years at the latest.

The seven-year period therefore applies to the administration, not to all correspondence. An email exchange that leads nowhere is not kept for seven years.

10. Security

We take appropriate technical and organisational measures to protect personal data against loss, misuse and unlawful processing.

These include encrypted connections to the website and to our email, access limited to those who need it for the work, and the principle of collecting as little as possible: data we do not hold cannot leak.

We deliberately do not describe our measures here in detail — doing so would not serve security.

11. Your rights

Under the GDPR you have the following rights.

• Access: to ask which personal data we process about you.
• Rectification: to have incorrect or incomplete data corrected.
• Erasure: to have your data deleted, insofar as we are not legally required to keep it.
• Restriction: to have processing paused, for example while we handle a rectification request.
• Objection: to object to processing based on our legitimate interest.
• Portability: to receive the data you supplied yourself in a common file format. This right applies to data we process on the basis of consent or a contract.

Send a request to info@thworkssystems.com. We reply within one month as a rule. If a request is complex we may extend that by two months — we will tell you within the first month if we do.

We may ask you to make it plausible that you are who you say you are, so that we do not hand data to the wrong person.

If you disagree with how we handle your data, you can lodge a complaint with the Autoriteit Persoonsgegevens, the Dutch supervisory authority, at autoriteitpersoonsgegevens.nl.

12. Automated decision-making

TH WORKS does not take decisions based on automated processing that produce legal effects concerning you or similarly significantly affect you. No profiling takes place.

The form checks whether the fields you filled in are complete and valid, and automatically turns away messages with the hallmarks of spam — a form filled in faster than a person could read it, for instance, or a message full of links. That is a technical check on the message, not an assessment of you. Should a message be turned away in error, you can always reach us directly by email or phone.

13. Changes

We update this privacy policy when the website or the way we work changes. The date at the top of this document says when that last happened.

There is no mailing list to notify you, because we do not have one. When in doubt, check this page.