What I collect, and what I don’t.

Last updated: 11 October 2026.

Who is responsible

Perqli is a one-person business, and that person is me. I am the controller of any personal data described here, which means the decisions about it are mine and so is the responsibility for them.

• Robin van Golen, trading as Perqli
• Beresteinseweg 58D, 1217 TK Hilversum, Noord-Holland, Nederland
• KVK 89677722
• BTW NL004758944B24
• contact@perqli.com

I have no data protection officer, and I am not required to have one. Write to the address above and you reach the person who makes the decisions.

What I collect

There are two ways to send me something: the send box at the end of Worth it?, and the contact form on About. Both ask for your name and an email address and will not send without them, because without them I cannot reply properly. What else goes with it depends on the form.

• Both forms: your name and your email address, and your company if you fill it in.
• The contact form: your message, which it needs, and your website, which it doesn’t.
• Worth it?: the answers you gave and the result worked out from them, including anything you typed under “Something else”. Also what you write under “What do you sell?” and “What’s still missing from your result?”, both optional.
• Automatic: the language of the page, so I know which one to answer in, and the web address your browser says you came from, if it says. That is usually the site or search engine that led you here, and for another site often just its domain. It tells me how you found me, and nothing breaks if your browser leaves it out.

I also count how the site is used: how many visits each page gets, which pages people move between, and how far they get in Worth it? and the demo, such as which screen they reached. That counting runs on PostHog, on servers in Frankfurt, so I can see how the site works and where it loses people. It sets no cookie and stores nothing on your device, builds no profile of you, and ties nothing to a name.

• What PostHog receives: the page, how long it was open, the page you came from, and the step you took; the kind of browser and device, its screen size and its language; and, if the link you followed carried one, a tag saying where it was shared, such as LinkedIn. Never what you type, never the numbers you enter in Worth it?, and never anything from a form.
• Your IP address: PostHog uses it, with your browser, to tell one visitor from another for one day, and then drops it. So the same person on two days counts as two visitors, and nothing links the two.

Older enquiries can also hold a phone number, a timeline, a budget, and the answers to three questions the form no longer asks, with the price range they showed. Nothing new is written there, and all of it goes when the rest of the enquiry goes.

My hosting provider also keeps ordinary server logs, which include IP addresses and request details. I do not use those logs to build any picture of a visitor. They exist so the site can be operated and kept secure.

Both forms are protected from bots by a hidden field and a timing check, which run on my own server, and by a limit on how often they can be sent from one IP address, which my hosting provider’s firewall counts. There is no captcha, so no third party is watching you fill a form in.

Why, and on what legal basis

If you send me a message or a Worth it? result, I use it to answer you and, if it goes further, to scope the job. The legal basis is Article 6(1)(b) of the GDPR: steps taken at your request before entering into a contract. If what you sent turns out not to be about hiring me, the basis is Article 6(1)(f), my legitimate interest in replying to people who write to me.

Server logs rest on Article 6(1)(f) as well: running a website securely is a legitimate interest, and reading logs does not meaningfully intrude on anyone.

So does counting visits: knowing how the site is used, without knowing who uses it, is a legitimate interest, and counts that hold no name, no profile and, after a day, no IP address do not meaningfully intrude on anyone either.

I do not send marketing email. I will not add you to a list. If I reply to you, it is because you wrote to me first.

Automated processing

Worth it? works out a result from your answers. That is arithmetic you asked for, on your own numbers, not a decision about you.

The only other automated step is the bot check on the two forms, and I would rather say so than not. It is not a decision about you either, and it has no legal or similarly significant effect. If it ever took you for a bot, what you sent would not reach me and no copy would reach you, so if you hear nothing within one working day, email me directly.

Who else touches it

I run this site on services that process data on my instructions and nobody else’s. Each is bound by a data processing agreement, and none of them may use what you send for their own purposes.

• Vercel hosts the site and runs the code that receives both forms, in Frankfurt.
• Databricks provides the database your enquiry is stored in, also in Frankfurt. The database service is called Neon; Neon is part of Databricks, and my agreement for it is with Databricks, Inc.
• Cloud86 hosts my mailbox and sends the two emails each enquiry makes, from the Netherlands. One tells me you wrote, and carries everything you sent in full, not just a note that something arrived. The other is the copy that goes back to you. So what you sent rests in my mailbox as well, the same way anything you email anybody rests on a mail server.
• PostHog counts the visits, in Frankfurt, as described under what I collect. It never receives an enquiry. My agreement for it is with PostHog, Inc.

That is the list. No advertising, no profiles, no CRM, no lead scoring service, nobody buying or enriching what you sent.

Where it goes

The code that receives the forms runs in Frankfurt, your enquiry is stored in Frankfurt, the counts of visits are kept in Frankfurt, and the two emails go out from the Netherlands, where my mailbox sits. On its way to me, nothing you send leaves the EU.

Vercel, Databricks and PostHog are United States companies all the same, wherever their servers stand. My agreement with each of them includes the European Commission’s standard contractual clauses, and all three are certified under the EU-US Data Privacy Framework. Those are the mechanisms the GDPR provides for exactly this situation.

I would rather write that plainly than bury it. If it matters to you, say so when you write, or email contact@perqli.com instead of using a form.

How it is kept safe

Everything between your browser and this site travels over HTTPS, and the database is encrypted where it sits. The two forms are the only route from the public site into that database, and they can only write to it, never read back out. The administration area is behind a login that only I hold. Database and mail credentials live as environment variables on the host, never in the code and never in the repository.

No arrangement is perfect and I would rather not pretend otherwise. If personal data of yours is exposed, I will report it to the Autoriteit Persoonsgegevens within 72 hours of finding out, and I will tell you directly if the breach is likely to leave you at real risk. That is what the law asks, and I would rather commit to it here than leave you guessing.

How long I keep it

Enquiries are kept for 24 months from the day they arrive, and then deleted, from the database and from my mailbox. Two years is roughly how long it takes for a conversation that went nowhere to come back around, and after that the record is of no use to either of us. Every night a job on the server deletes any in the database that have passed that date. The mailbox I clear by hand once a year, so a mail can stay up to a year past its date. Ask me to delete yours sooner and I will, without asking why.

If an enquiry turns into a quote or a job, the mails and the quote move into that customer’s file in my administration. Dutch tax law has me keep that file for seven years after the work ends. The database copy still goes after 24 months.

The counts of visits are kept for one year, and then deleted. The IP address behind them is gone after a day, as said above.

Server logs are kept by my hosting provider for a day at most, and are rotated away after that. The length of that window is Vercel’s to set rather than mine, and I keep no copies of my own.

Your rights

The GDPR gives you a set of rights over your own data, and you do not need a reason to use them. You can ask me to:

• show you what I hold about you
• correct it, if it is wrong
• delete it
• restrict what I do with it, or object to my processing it
• send you a copy in a portable format, or send it on to someone else

Email contact@perqli.com and I will deal with it, and it costs you nothing. The law gives me a month, and lets me take two more if a request turns out to be genuinely complicated; in practice this is a one-person business with a small database, so it will not take that long. If I cannot tell that a request is coming from the person whose data it concerns, I will ask you something that settles it first. The alternative is handing your data to whoever asks for it.

Cookies and tracking

There are no cookies. This site sets none, and loads no tag manager, heatmap, session recorder, advertising pixel or social widget. Fonts are served from this domain rather than fetched from Google.

It does count its visits, with PostHog, as described under what I collect, and stores nothing on your device to do it. The law lets a site count without asking first when the counting only shows how the site itself works and hardly touches your privacy. That is why there is no consent banner.

Two small things are kept in your own browser. Your answers in Worth it? stay for as long as the tab is open, so a reload doesn’t throw them away; your name and email address are never kept there. And once you pick a language, or close the line that suggests the other one, the site remembers that and stops suggesting it. Both stay on your device: what reaches me is only what you send through a form.

The administration area behind this site uses a session cookie, but only for me, after logging in. It is never set for a visitor.

If you are unhappy

Tell me first, and I will try to put it right. You also have the right to complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl. You do not have to raise it with me before you go to them.

Changes

If what this site does with data changes, this page changes first, and the date at the top moves with it.

If I stop trading, enquiries get deleted rather than passed on to anybody. If the business is ever sold or transferred, whatever is still held would go with it, and this page would say so before that happened.

Questions about any of this go to contact@perqli.com, or through the contact form.