Privacy Policy

1. Who we are (data controller) ¶

Dcraft B.V., trading as Dcraft Of Sales, is the data controller responsible for the personal data described in this policy.

If you have any question about how we handle your data, or you want to exercise any of your rights, contact us:

• Dcraft B.V. (trading as Dcraft Of Sales)
• Dutch Chamber of Commerce (KvK) number: 99950197 · Establishment number: 000064987671 · VAT number: NL869200975B01
• Email: info@dcraftofsales.com
• Phone: +31 6 25538050
• WhatsApp: +31 6 25538050

2. What data we collect ¶

We only collect personal data that you actively give us, that is strictly necessary to run and secure this website, or, if you are not yet a client of ours, the business contact details we use to send you a business email (see the chapter on that below). We do not buy personal data, and we do not build hidden profiles about you.

We do not ask for special categories of data (such as health, political, or biometric data), and we ask you not to send us any.

• When you contact us — by email, phone, or WhatsApp — we receive your name, the contact detail you use to reach us (email address and/or phone number), and whatever you choose to include in your message. How we read and answer your email is set out in the chapter on the email we read and send from our admin area below.
• When you submit the contact form on this site, we receive the fields you fill in. See the separate chapter on the contact form below.
• When you schedule a Sales Diagnose through our booking link, we process your name, email address, mobile number, and the intake details you enter — company name, headcount, current pipeline or revenue, and your biggest bottleneck — so we can prepare for and hold the call. The booking link runs on Google Calendar; Google processes those details as our service provider.
• When you message us on WhatsApp, we see your WhatsApp profile name, phone number, and the content of the messages you send us.
• When you use one of our free AI tools, we process your input to generate the result. We do not store that input — see the chapter on the AI tools below.
• When you use the feedback button in the bottom-right corner to report a fault, an idea or a question about this website, we receive your name, your email address, your description and any files you attach. Technical details needed to reproduce the problem travel with it: the page you were on and the page you came from, the language you were viewing the site in, your window and screen dimensions, your screen’s pixel ratio, your browser and browser language, the active theme, the timestamp and time zone of your device, whether the page came from the offline copy and what state the offline feature was in, whether your connection was working at that moment, the most recent errors your browser encountered, and the most recent requests that failed on this site. You are shown that list before sending, and nothing leaves without your consent; on our side the only addition is the browser line exactly as our server received it. We keep the report and any attached files for a maximum of twelve (12) months. These reports go to the web agency that builds and maintains the site — not to our sales inbox. See the chapter on sharing and processors below.
• With the feedback button you can also record a voice message yourself, record this tab (with or without your voice), take a screenshot of this tab, and draw and highlight on the page or on a screenshot. That only happens when you press the button for it, and we use the microphone and the sharing of the tab only with your permission in your browser. The microphone is on only while the recording runs. Sharing is limited to a browser tab: if you pick your entire screen or a window, sharing stops at once and nothing is recorded or kept. In browsers that can check this, the same applies if you pick a different tab. A recording of this tab contains everything visible in this tab while it runs, and with your voice added, whatever your microphone picks up; it does not record sound from the page or from your computer. A recording of this tab lasts at most 3 minutes, a voice message at most 5 minutes. A recording or screenshot, including any highlights you drew on it, is an attachment like any other file: you can review it, remove it or make it again before sending, and nothing leaves before you press send. What you draw on the page stays in your browser and only travels along if it appears in a recording or screenshot you send as an attachment. These features set no cookie and put nothing in your browser’s storage: until you send it, a recording exists only in the working memory of the page. Whether your browser remembers your choice for the microphone is a setting of your browser itself. Recordings and screenshots fall under the same retention period of a maximum of twelve (12) months as the report itself.
• If you have an account on our client portal, we process the details of that account. See the chapter on the client portal below.
• If we schedule an appointment with you, we process the details of that appointment. See the chapter on appointments we schedule with you below.
• If you are not yet a client and we send you a business email, we process your business contact details, which we did not receive from you yourself. See the chapter on business emails to people who are not yet clients below.
• Collected automatically: basic technical data needed to serve the website securely — such as your IP address and browser user-agent — is processed transiently by our server to deliver pages, limit abuse of the AI tools, and protect against attacks.

3. The contact form ¶

This website has a contact form you can use to reach us directly. It only asks for what we need in order to call or email you back properly:

• Which fields: your name, your company name, your business email address, your mobile number, your company’s headcount and your biggest bottleneck. All six of those are required; your message is the only optional field. On top of that we ask for your explicit consent before you can submit — without it the form sends nothing.
• Where your enquiry came from: with every submission we record which page of this site carried the form, which page your visit started on, and — if you arrived through a link carrying campaign tags — the utm_source, utm_medium and utm_campaign tags. Of the site you came from we keep only the category (direct, search engine, social media, AI assistant, or other site), never the address itself. We use this origin to see which pages and channels produce enquiries; it appears in the enquiry email we receive and nowhere else.
• Where it goes: the submission is emailed to info@dcraftofsales.com — the mailbox where we read our enquiries — and stored in our own server environment. We do not pass submissions on to advertising or data brokers.
• Legal basis: taking steps prior to a contract at your request (Article 6(1)(b) GDPR) and our legitimate interest in handling business correspondence (Article 6(1)(f) GDPR).
• Retention: a maximum of twelve (12) months from receipt of your submission if no working relationship follows; we delete the submission after that. If you become a client, the submission becomes part of your client file and that retention period applies.
• Attachments: you can attach files to your enquiry, such as a screenshot or a document. They travel with your submission, are kept in the same secured server environment and fall under the same retention period as above; after that they are deleted automatically. How many files and how many megabytes you can send is stated by the form itself when you choose them.
• You automatically receive an acknowledgement: right after you submit, this website sends one email to the address you entered, containing the booking link and our contact details. It is not a newsletter and you need do nothing with it; replying to it reaches us directly.
• A temporary draft in your own browser: as you type, the form briefly stores the fields you filled in in your browser’s own memory (session storage, per window), so your input survives a page reload or a language switch. This draft is never sent anywhere; it disappears once you submit your enquiry, close the window, or clear the saved input yourself. Your consent tick is never stored — you always give it again by ticking the box yourself.
• Nothing is mandatory: calling, emailing, or WhatsApp works just as well, and you can always ask us to delete your submission right away.

4. Our free AI tools ¶

This site offers four free AI tools: the outreach generator, the objection coach, the ROI calculator, and the website scan. You need no account for them, and you do not have to leave any details.

Whatever you type into a tool is used only to generate the result at that moment. Neither your input nor the output is kept in a database or on disk: both exist only temporarily in the working memory of our server. If an exactly identical request comes in a short time later, the server may briefly reuse the earlier answer; after that it disappears by itself, and a restart of the server wipes everything at once. We do not link them to you and we do not use them to train models.

The figures of the ROI calculator do not come from a language model: while you type, your own browser computes them live without sending anything, and on submission our server re-computes them with exactly the same arithmetic formula. A language model at most writes an optional commentary around those figures; the figures themselves are independent of the model.

For the outreach generator, the objection coach, and the website scan we send your input to our AI provider (currently Groq, which runs the language model); it is processed there to generate the answer, and we do not store it. For the ROI calculator, your input goes to that provider only when needed, and solely to write an optional commentary alongside the figures. So please do not enter confidential business information or other people’s personal data.

We use your IP address briefly to cap how many requests the tools accept, so they stay available to everyone. That is an abuse limit, not a profile.

Alongside a tool result you can voluntarily leave your email address and mobile number. That is explicitly optional and you can dismiss it. If you do leave those details:

• Purpose: follow-up — we contact you by email or phone about your result and about the free Sales Diagnose.
• Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw it at any time by emailing info@dcraftofsales.com .
• Retention: a maximum of twelve (12) months from receipt of your details, unless you ask us to delete them sooner or a working relationship follows. We delete your details after that.
• Here too we record the same origin as described under the contact form: the page, the page your visit started on, the source category and the campaign tags from the link, plus which of the four tools you used.
• What we do not do: we do not sell these details, we do not share them with advertising parties, and we do not use them to track you across the web.
• Tool output is automatically generated and indicative. It is not advice, and no decisions about you are made with it — see also our Terms of Service.

5. The client portal ¶

We can create an account for you on our client portal. There you see the enquiries we have linked to your account, and nothing else: no data of other clients and no internal follow-up marker of ours. Only we create accounts; you cannot create one yourself. The portal is available in Dutch and in English. For an account, the following applies:

• Which data: a randomly generated account code, your name, your email address (which is also your login name), your company name, your role (client), the status of your account, when it was created and activated, when you last logged in, which enquiries we have linked to it, and the language in which you want the portal and our emails (Dutch or English). We never store your password itself: only a non-reversible derivative of it (a hash with a random addition per account), from which the password cannot be recovered. For two-step verification we keep the secret key of your authenticator app, encrypted, along with the moment you linked it and the time step of the last code you used, so that a code works only once. Of your recovery codes we keep only an irreversible derivative, and whether they have been used.
• Sessions and links: when you log in, we keep only an irreversible derivative of the session code, when the session started, when you last used it, when it expires, and when you completed the second step and whether that was with a code or with a recovery code. For an invitation or reset link we likewise keep only an irreversible derivative, with the type of link and the times that determine whether it is still valid. Neither contains your IP address or details about your device. Expired sessions and used or expired links are cleared at the next change to the register. Our Cookie Policy explains which cookie your browser holds for this.
• Two-step verification: you log in with your password and a code from an authenticator app on your phone, such as Google Authenticator or Microsoft Authenticator. You link that app yourself: when you choose your password through the link in our email, or later in the portal. While you link it, the new key exists only in the working memory of our server, for 30 minutes at most; if you request a new QR code, the previous one expires at once. After linking you receive 10 recovery codes, once, for when you lose your phone; each recovery code works once. If we reset your two-step verification, for example because you lost your phone, we delete the key and your recovery codes and you are logged out everywhere; you then set everything up again through "Forgot your password?" on the portal.
• Emails: when your account is created, you receive an invitation email with your login name and a link to choose a password yourself and link your authenticator app; that link is valid for 48 hours and works once. If you already have an active account and request a new password on the portal, you receive a link that is valid for 1 hour and also works once. After you choose or change your password, we normally send you a confirmation; if it does not arrive, your new password still applies. We also send you a short security notice when a new authenticator app has been linked to your account, when someone logged in with a recovery code, when we have reset your two-step verification, or when someone entered your password correctly but a wrong code five times. You receive all these emails in the language of your account. An email from us never contains a password, a recovery code or a key. These emails travel over the same mail server as all our other email; see the chapter on sharing and processors below.
• Login attempts: to slow down guessing of passwords and codes, our server temporarily counts login attempts, wrong codes and requests for a new password in its working memory. Those counts are never written to disk and disappear on a restart.
• Log lines: for actions on your account, such as logging in, logging out, setting a password, linking an authenticator app, viewing your enquiries, or when we create, block or delete your account, our server writes a short technical log line with your account code, the action and when it took place, and whether an email was sent. If you open an enquiry, the code of that enquiry is included too. They contain no IP address, no email address and no password. They are part of the technical server logs in the chapter on retention below.
• Purpose and legal basis: giving you, and only you, secure access to the enquiries that belong to you. If you have an agreement with us yourself, we do this to perform the agreement with you (Article 6(1)(b) GDPR). If you have access on behalf of an organization, we do this out of our legitimate interest in serving that organization through your account (Article 6(1)(f) GDPR). In both cases we secure that access out of our legitimate interest (Article 6(1)(f) GDPR).
• Storage: the account register sits in the storage of our own server environment at our hosting provider, next to the enquiries themselves; see the chapter on sharing and processors below.
• Retention and deletion: your account remains until we delete it; if you ask us to, we do so. Deleting it also removes your sessions, any open invitation or reset links, the connections to your enquiries, the key of your authenticator app and your recovery codes. If a technical fault makes the register unreadable, a backup copy of it may be created that also contains your account details, and that copy is deleted automatically after 30 days at the latest, even if your account has already been deleted by then. If we block your account, your sessions and any open links stop working at once. The enquiries themselves follow their own retention period from the chapter on retention below; if an enquiry disappears, it also disappears from your portal.

6. Email we read and send from our admin area ¶

We read, answer and send our business email in the admin area of this website, from our mailboxes on dcraftofsales.com. If you email with us, the following applies:

• Your email in our mailboxes is kept at mijn.host, the party that runs our email. The admin area fetches it from there live to show it, and our server does not keep it. Our server does remember, per mailbox, up to which message it has looked, without addresses or subjects, and for every new message it checks whether it is a reply to an invitation for an appointment, or a reply, an unsubscribe request or an undeliverable email relating to one of our business emails (see the chapters on those below); of such a message we keep only that outcome.
• What we write ourselves, our server does keep, until it is sent or its period expires: a draft, including when it quotes your email, for at most 90 days after the last change; an email that is scheduled, until it goes out; and an email that was not sent, or not sent for certain, with its content and attachments, for at most 30 days after the last change. If we forward your email, its attachments also sit on our server until it is sent. A file that no longer belongs to any email is deleted after 24 hours.
• After sending, our server deletes the content and the attachments of the email. If we keep a copy in our Sent folder at mijn.host, that happens as soon as the copy is there; if that fails, at most 30 days after the last change. Who the email went to, its subject, when it went out and whether that worked, we keep for at most 30 days after that. In addition we keep a log line per sending with only the time, the number of recipients and the outcome, without any address or subject; we keep that for twelve (12) months.
• Our admin area does not show images in an email to us by itself. Only when we click "Afbeeldingen tonen" (show images) on a message does our server fetch the images from that one message to show them; they are not kept. The sender can tell from that, however, that the email was opened.
• The email we send from our admin area, including invitations and the emails in our sequences, contains no external images and no redirect links. So we cannot see whether you open such an email or click a link in it.
• The passwords our admin area uses to log in to our mailboxes are stored encrypted on our server.
• What sits on our server as described above may also end up in a backup copy of that storage at our hosting provider.
• Legal basis: our legitimate interest in handling our business correspondence (Article 6(1)(f) GDPR).

7. Draft replies with Gemini ¶

For an email in our admin area we can ask Gemini (from Google) for a draft reply. The following applies:

• Only when we ourselves ask for a draft on that email does our server send the text of that email conversation to Gemini: at most the last 10 messages, without attachments, with the name or email address of the sender, the date and the subject of each message.
• We use the paid Gemini API for this. According to Google’s terms, Google then does not use that text to improve its products, and keeps it for a limited period to detect abuse. Google may process the text outside the European Economic Area; the transfer rule from the chapter on sharing and processors below then applies.
• Our server does not keep the answer from Gemini. The draft appears as editable text in our composer and from then on follows the same rules as any other draft (see the chapter above). A person reviews every draft and edits it where needed, and no reply ever goes out automatically: sending remains a separate click of ours.
• Per day we count how many drafts we had written and how much text was involved, without any content; we keep those counts for 60 days.
• Legal basis: our legitimate interest in handling our business correspondence efficiently (Article 6(1)(f) GDPR).

8. Appointments we schedule with you ¶

If we schedule an appointment with you from our admin area, for example a Sales Diagnose, the following applies:

• Which data: your name and email address, the title and description of the appointment, the date and the time, the video link, the mailbox we invited you from and, if the appointment belongs to an enquiry of yours, the link to it. If you reply to the invitation with accept, maybe or decline, we read that answer and keep it with the appointment; of your reply email we keep nothing else.
• The invitation comes from our own mailbox, with the appointment attached in two formats (an .ics and a .vcs file), so you can add it to your own calendar. If we cancel an appointment you received an invitation for, you also receive an email about that.
• If we choose a video call via Google Meet, Google creates the link and the appointment is placed in our own Google Calendar: with the title, the time and the description, and in that description your name and email address. Google does not invite you itself and sends you nothing. That copy in our Google Calendar is subject to Google’s policy and to the retention policy of our own calendar; if we cancel the appointment, we remove it there as well.
• The video call itself runs through the service behind the link, such as Google Meet; that service’s terms apply to it.
• Retention: twelve (12) months after the end of the appointment we delete it from our server. Our server does not then remove a copy in our Google Calendar.
• Legal basis: taking steps prior to a contract at your request or performing our agreement with you (Article 6(1)(b) GDPR), and otherwise our legitimate interest in scheduling business appointments (Article 6(1)(f) GDPR).

9. Business emails to people who are not yet clients ¶

We also send business emails about our services to people who are not yet clients of ours: a sequence of one or more emails, from one of our mailboxes on dcraftofsales.com, to a business email address. If you received such an email from us, the following applies:

• Which data: your name, your first name if it is in our list or follows from your name, your company, your business email address, the emails we send you in that sequence and when, and whether you replied, whether an email could not be delivered and whether you unsubscribed. Other columns from our list are kept only if we use them in the text of an email.
• Where your details come from: that differs per list. That is why we name the source at the bottom of every email in the sequence, together with who we are.
• Legal basis: our legitimate interest in approaching companies that may benefit from our services (Article 6(1)(f) GDPR), and your consent where the Dutch Telecommunications Act requires it (Article 6(1)(a) GDPR).
• No open or click tracking: these emails contain no external images, no tracking pixel and no redirect links. So we cannot see whether you open an email or click a link in it.
• Unsubscribe right away: at the bottom of every email there is an unsubscribe link, many email programs also show an unsubscribe button with the email, and you can reply with "unsubscribe" in the subject line. Unsubscribing works without logging in, and the unsubscribe page sets no cookie. Your unsubscribe applies at once to all our email sequences; if an email to you was already on its way at that moment, it may still arrive. If you reply to an email, the sequence stops for you. An address to which an email could not be delivered is also put on the unsubscribe list.
• The unsubscribe list: it does not hold your email address, but a code calculated from your address with a secret key (pseudonymized). We keep that key separately and encrypted. Anyone who holds both the list and the key can check a list of addresses against it; without the key that is not possible. This lets us check every new list against unsubscribes without keeping your address. We keep an encrypted second copy of the unsubscribe list, so that an unsubscribe is not lost in a technical fault.
• Retention: we delete the data of a sequence twelve (12) months after the last event in that sequence, such as the last sending, a reply, an undeliverable email or an unsubscribe, or sooner if we delete the sequence itself. A technical log of the sendings, without any name, address or subject, is kept for twelve (12) months. We do not delete the unsubscribe list and its copy automatically: we keep them for as long as we send such emails, because otherwise we could not keep respecting your objection.
• Daily overview: on every sending day we receive in our own mailbox an overview of what was sent that day, to whom and which step. That overview is subject to the retention policy of that mailbox.
• Your rights: you can always ask us which data we hold about you, or ask us to delete it; the code on the unsubscribe list then stays, so that we do not email you again. See the chapter on your rights below.

10. Measurement without cookies and without profiling ¶

We want to know whether this website works: which pages are read, whether people call, message, try a tool, or open the calendar to book a Sales Diagnose. We run that measurement entirely in-house, on our own server environment. No external analytics vendor is involved — no Google Analytics, no Plausible, no third party looking over your shoulder.

The measurement is cookieless. We set no analytics cookie, we store nothing in your browser to recognize you for this measurement, and we build no profile. We count events, not people. What we do keep is the short code described below.

For each event we record which event it was, on which page it happened, and at what time. We do not store your IP address. We do store a short, irreversible code with every event, derived from your IP address and your browser together with a secret number that exists only in the working memory of our server and changes on every restart. That code also changes every day. It cannot be traced back to you and exists solely to avoid counting visits twice within a single day; across days, and after every restart of our server, it recognises nothing and no one.

For a page view we additionally record, in coarse steps, whether at least three quarters of the page came into view and how long the page stayed open — no detailed scroll profile — and what kind of page it was (for example a service area or a service page). To see roughly where visitors come from, we classify every event into a fixed list: direct, search engine, social media, AI assistant, other site, or own campaign tag. We do not store the site you came from (the referrer), and for these events we do not store the value of a campaign tag either — only the category.

Our server also keeps its own count of whether requests to the AI tools succeed: with every use it writes one technical record containing whether the request succeeded, how long it took, and the general reason for any failure (such as a limit that was reached or a tool that was fully occupied). What you type into a tool never goes into it, and for the website scan we do not keep the web address you entered. The same daily-changing, irreversible code is attached to this record as to the events above, and it falls under the same retention period of twelve (12) months.

Whether you then actually make an appointment in the calendar is not counted by this measurement: that calendar runs at Google, and a booked appointment shows up only in our own calendar, not in these counts. The events we count are:

• a page view, with the two coarse measures above;
• a click on a phone number (call click);
• a click on a WhatsApp button;
• use of one of the AI tools — only that a tool was used, never what you typed into it;
• a click on an email link (mail click);
• a click on the button that loads the calendar inside our booking box;
• opening the feedback widget;
• a click on a link that opens our calendar at Google;
• contact details left behind.
• Retention: individual events are kept for a maximum of twelve (12) months; after that we delete them and only an aggregated daily count (totals without visitor data) remains.
• No retargeting: this site carries no advertising or retargeting pixel whatsoever. No LinkedIn Insight Tag, no Meta Pixel, no Google Ads tag, and no call-tracking numbers.

11. Why we use your data (purposes) ¶

We do not use your personal data for automated decision-making that produces legal or similarly significant effects, and we do not sell your data.

• To answer your questions and respond to your enquiry.
• To schedule, prepare for, and hold a free Sales Diagnose you have requested. We use the mobile number you give for that to reach you personally where needed — by hand, by phone or WhatsApp. No automated reminder service runs. If you book through our booking link, the confirmation of the appointment reaches you by email from Google Calendar; if we schedule the appointment with you, the invitation comes from our own mailbox.
• To keep track of which company has already had a free Sales Diagnose: it is free once per company, so we record the company name and the date of the call.
• To follow up on a genuine business conversation you have started with us, and to provide our services if you become a client.
• To keep the website available, secure, and free from abuse, and to share the free AI tools fairly among visitors.
• To give everyone with an account on our client portal secure access to the enquiries that belong to that account.
• To read, answer and send our business email, and to schedule appointments with you.
• To approach companies that are not yet clients of ours with a business email about our services, and to respect unsubscribes.
• To measure — in aggregate and without profiling — whether the website is doing its job, and to report on that internally.
• To comply with our legal and accounting obligations.

12. Our legal basis (Article 6 GDPR) ¶

We process your personal data on the following legal bases:

• Consent — when you voluntarily leave your details alongside a tool result, you consent to us using them for follow-up. You can withdraw consent at any time.
• Steps prior to a contract — where you contact us or book a Sales Diagnose with a view to working together, we process your data to take those pre-contractual steps at your request.
• Legitimate interests — to run, secure, and improve our website, to limit abuse of the free tools, to measure cookielessly and without profiling whether the site works, to give people who use the client portal on behalf of a client access to it, and to manage day-to-day business correspondence, including with a draft reply that we review ourselves, and to schedule appointments. We have weighed that interest against your rights and freedoms in each case.
• Business emails to people who are not yet clients: our legitimate interest, or your consent where the Dutch Telecommunications Act requires it; see the chapter on that above.
• Performance of a contract — when you are a client, to deliver the agreed services and to give you access to the client portal.
• Legal obligation — where the law requires us to retain certain records (for example, for tax or accounting).

13. Sharing and processors ¶

We keep your data confidential and only share it with service providers ("processors") that help us operate — and only to the extent needed for them to perform their task.

Each processor is bound to handle your data securely and only on our instructions. Some providers may process data outside the European Economic Area; where that happens, we rely on appropriate safeguards (such as the European Commission's Standard Contractual Clauses). We will never sell your personal data to third parties.

Those processors are:

• Railway — our hosting and infrastructure provider. This website runs there, and so does the storage that holds form submissions, fault reports, event measurements and the accounts of the client portal, and what we store in our admin area: drafts and scheduled email, appointments and the data of our business email sequences.
• Cloudflare — the network that sits in front of our server. All traffic to this website passes through it; Cloudflare provides the encrypted connection and blocks automated abuse, processing your IP address and the characteristics of your request in doing so.
• mijn.host — the party that runs the email environment of dcraftofsales.com. Every message sent or received through this website travels over that mail server, including the email we read and send in our admin area. Our mailboxes are there. We also read and write part of our business email in Gmail, and the text of an email conversation for which we ourselves request a draft reply goes to Gemini (see Google below).
• Google — for the calendar, Meet, Gemini and Gmail (from Google): the Sales Diagnose calendar, through the booking link or in our booking box once you have opened the calendar there yourself; in our admin area Google Calendar and Google Meet, when we schedule an appointment with a video call via Google Meet; Gemini, which writes a draft reply only after our click; and Gmail, in which we read and write part of our business email, so Google may process those messages too. For nothing else.
• Our AI provider for the free AI tools (currently Groq), which runs the language model behind those tools. It receives your input to generate the result, and nothing else.
• The web agency that builds and maintains this website. It receives the fault reports you send with the feedback button — your name, your email address, your description, your attachments (including any voice message, recording of this tab or screenshot you send) and the technical details you are shown before sending — and nothing else from this site. Such a report arrives by email. For every file we keep, that email carries a personal link the web agency can use to view or download the file; that link appears only in that email. If your attachments are too large together to send along, they do not go as attachments and the web agency opens the files we keep through that link. After the retention period we delete the file, and the link then stops working.
• WhatsApp (Meta), if you choose to reach us through that channel.
• If you process personal data yourself and we do so on your behalf — for example, prospect and contact data in AI-driven lead generation — then we are the processor and you are the controller. Our Data Processing Agreement, published on this website, governs that relationship.

14. How long we keep your data ¶

We keep personal data only for as long as we need it for the purpose it was collected, and then delete or anonymize it:

• Enquiries, form submissions, and details left behind that do not lead to a working relationship — a maximum of twelve (12) months from receipt; we delete them after that.
• Client records — for the duration of our engagement. Invoices, contracts, and payment records are kept for seven (7) years afterward, because Dutch tax law requires it. An account on the client portal remains until we delete it; see the chapter on the client portal above.
• Booked and completed Sales Diagnose sessions are held as appointments in our business calendar (company name and date, so the session stays free once per company) — a maximum of twelve (12) months after the call, unless a working relationship follows.
• Newsletter — we do not send one. If we ever start, we delete your email address the moment you unsubscribe.
• Business emails to people who are not yet clients: the data of a sequence for twelve (12) months after the last event in that sequence, and the unsubscribe list for as long as we send such emails. See the chapter on that above.
• Email we write and send from our admin area: a draft for at most 90 days after the last change, the data of a sent or unsent email for at most 30 days after the last change, and a log line without any address or subject for twelve (12) months. The email in our mailboxes at mijn.host is subject to the retention policy of those mailboxes.
• Appointments we schedule with you: twelve (12) months after the end of the appointment.
• Input and output of the free AI tools — not stored.
• Cookieless event measurements — a maximum of twelve (12) months; after that we delete them and only an aggregated daily count (totals without visitor data) remains.
• Fault reports sent with the feedback button, including any files you attach (such as a voice message, a recording of this tab or a screenshot) — a maximum of twelve (12) months; we delete them from the server after that, and the personal link to such a file stops working too.
• Technical server logs — our hosting provider retains these under its own retention period; we consult them only for security and troubleshooting.

Want out sooner than these periods? Email info@dcraftofsales.com and we will delete your details.

15. Your rights ¶

To exercise any of the rights below, email us at info@dcraftofsales.com, or compose your request yourself on the Trust and privacy page.

We will respond within the timeframe required by law (normally within one month). You also have the right to lodge a complaint with your local supervisory authority — in the Netherlands, this is the Autoriteit Persoonsgegevens (

autoriteitpersoonsgegevens.nl

).

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected (rectification).
• Have your data erased ("right to be forgotten"), where applicable.
• Restrict or object to our processing of your data. The quickest way to object to our business emails is the unsubscribe link at the bottom of every email.
• Data portability — receive your data in a structured, common format.
• Withdraw consent at any time, without affecting prior lawful processing.

16. Cookies and local storage ¶

Regular visitors get no cookies from this website itself. Only people who log in get strictly necessary cookies: on the client portal the session cookie __Host-dc_portaal, and on the admin area, where only we log in, the session cookie __Host-dc_beheer and the device token __Host-dc_beheer_apparaat. The Cookie Policy lists them with their lifetimes. We use no tracking or advertising cookies, and our measurement is cookieless (see the chapter above).

What we do use is your own browser’s storage. It remembers a few of your choices: your cookie preference, whether you want the site in light or dark mode, which service areas you selected on our service areas overview page, and, if you choose so, that our calendar from Google may load straight away. During your visit, session storage also keeps a few small values, such as the fact that you dismissed a notice, and what you are filling in on a form. Those stored values stay in your browser, are not sent to us, and you can clear them at any time through your browser settings. One value does travel: session storage temporarily keeps which page of this site your visit started on (the path only, never a full URL), and that value is sent to our own server with a form submission, as part of the origin described in the contact form chapter. It disappears when you close your session. Every item is listed by name in the Cookie Policy.

On top of that, since August 2026 your browser keeps an offline copy of this site — pages, stylesheets, scripts, fonts and images — so the site keeps working when your connection drops. That copy too lives only on your device, contains no identifier, and disappears the moment you clear your site data. Our

Cookie Policy

covers it in more detail.

Third-party tools you choose to open from this site — such as our booking link, the calendar in our booking box, or WhatsApp — may set their own cookies under their own privacy policies. Until you choose to open the calendar yourself, your browser makes no contact with Google. If you choose to load the calendar in our booking box, your browser remembers that and loads the calendar straight away on a later visit, until you click "Forget my choice" next to the calendar. Our

Cookie Policy

covers this in detail.

17. How we protect your data ¶

We serve this website exclusively over encrypted HTTPS connections and apply appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or misuse. Concretely: every page ships a strict security policy telling your browser which resources it may load, we restrict access to the stored data to those who need it for their work, and we keep the amount of data small — we do not store your IP address with the measurement. Our admin area and the client portal ask for a code from an authenticator app in addition to the password when you log in, and we store secrets such as the keys of those apps and the passwords of our mailboxes encrypted.

For the free AI tools, our server also stores the running counters of the usage limits in our own server environment, so a technical restart does not wipe them. It contains no IP address at all: every counter carries only an irreversibly transformed code instead of an address. The website scan’s limit is tied to nothing more than the hostname of the scanned site — no paths and no full web addresses.

No method of transmission or storage is ever completely secure, but we work to keep the amount of data we hold small and well-protected. If you suspect a vulnerability or a data breach, email us immediately at info@dcraftofsales.com.

18. Language of this policy ¶

This privacy policy was drafted in Dutch and translated into English. In the event of any difference in interpretation between the two versions, the Dutch text is the only binding one.

19. Changes to this policy ¶

We may update this policy from time to time to reflect changes in our practices or in the law. When we do, we will revise the "last updated" date at the top of this page and record what changed in the change log at the bottom. We encourage you to review it periodically.

20. Contact us ¶

If you have any questions about this Privacy Policy or how we handle your personal data, please reach out:

• Email: info@dcraftofsales.com
• Phone: +31 6 25538050
• WhatsApp: +31 6 25538050