Privacy and cookie statement

1. Who processes your data

STS Strategy is the controller for personal data processed through this website.

• Dutch sole proprietorship, CoC 99794845
• VAT NL005411015B79
• Contact: kevin@stsstrategy.com

The registered address is available through the Dutch Chamber of Commerce register or on request by email. There is no legal obligation to appoint a Data Protection Officer.

2. What this site does not do

There is no login, no account and no client portal. There are no contact forms. There is no newsletter, and nothing is sold or paid for here. No advertising pixels from Meta, Google, LinkedIn or similar parties are running.

If you want to get in touch, you email me or book a call yourself. Both are covered below.

3. What I do process

If you email me

Your email address, your name and what you write. I use that to answer your question and, if it leads to an engagement, to carry out that work. Legal basis: performance of a contract or steps taken before entering into one, or legitimate interest in ordinary business correspondence.

If you book a call

The "Book a call" button opens a Microsoft scheduling page. What you enter there, your name, email address and chosen time slot, ends up in my calendar. Microsoft acts as processor.

Site usage statistics

I measure how the site is used with Vercel Web Analytics. That service sets no cookies and reads nothing from your device. No identifier is stored that would allow you to be followed across websites or over time.

The following is recorded per page view:

Vercel derives a hashed code from the incoming request to tell separate visits apart. That code is not stored on your device and is discarded automatically after 24 hours. I only see totals, never an individual visitor.

Legal basis: legitimate interest in knowing which topics get read (art. 6(1)(f) GDPR). Because nothing is placed on or read from your device, no consent is required.

4. Cookies

This website sets no cookies of its own. There is therefore no cookie banner.

One page carries third-party material: the Cases page contains an embedded Spotify player for a podcast episode. That player only loads once it comes into view. If you use it, Spotify may set cookies or local storage and process data under its own privacy policy. If you would rather avoid that, do not use the player and listen to the episode on Spotify directly.

5. Services I use

The typeface is loaded from Google's servers, which means Google sees your IP address. That follows from how the site is currently built, not from a decision to share data.

I never sell your data and never use it for advertising.

6. Transfers outside the European Economic Area

Several of the parties above are established in the United States or have entities there. Where transfers occur, they take place under the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

7. How long I keep data

8. Your rights

You have the right to access, rectification, erasure, restriction of processing, portability and objection. Where you gave consent, you can withdraw it.

Send a request to kevin@stsstrategy.com. I respond within one month. I may ask you to confirm your identity.

If you disagree with how I handle your data, you can lodge a complaint with the Dutch Data Protection Authority at autoriteitpersoonsgegevens.nl.

9. Security

The site runs entirely over an encrypted connection (TLS). Email and calendar run on business Microsoft accounts with two-factor authentication. In the event of a data breach posing a high risk to your rights and freedoms, I will inform you as soon as possible and report it to the Dutch Data Protection Authority within 72 hours.

10. Changes

I update this statement whenever the site or the services behind it change. The current version is always on this page, with the version number and date at the top.