Controller and contact
The controller is Stichting Everglades Consultants, operating under the trade name ROOTSbyNaeo. Chamber of Commerce number: 34186524. Statutory seat: Amsterdam. Contact: info@rootsbynaeo.eu. Business address: Weidestraat 21, 1097 XG Amsterdam, the Netherlands.
Data we process
If you contact us by email or through the contact form, we process the name, company, email address and message you provide. The web server necessarily processes technical connection data, such as IP address, request time, requested page and browser information, to deliver and secure the website.
This website uses no analytics and no tracking cookies.
Purposes and legal basis
We use contact data to read and answer your request and, where relevant, to prepare or perform an engagement. The basis for responding to a business inquiry is our legitimate interest in handling requests directed to us (Article 6(1)(f) GDPR). Where processing is necessary to take steps at your request before entering into a contract or to perform a contract, Article 6(1)(b) GDPR also applies. Technical connection data is processed for the legitimate interests of operating and securing the website.
Processors and location
The website infrastructure and email service providers process data only insofar as necessary to host the website and deliver or store email. Hosting, VPN, VPS and email services are procured exclusively from companies established in the European Union. The intended production chain uses Contabo for website infrastructure in the European Union and bHosted for the mailbox in the Netherlands. No external form or analytics service receives a submission.
Client-file storage and processing for engagements take place in the ROOTS environment, not in the cloud.
The contact endpoint forwards a submission to the mailbox and does not write the submitted content to a database or file. Operational logs record technical delivery status, not the submitted name, email address or message.
Retention
A contact message that does not lead to an engagement is deleted no later than three months after the last substantive contact. If a request leads to an engagement, relevant correspondence may become part of the client file and is then retained for the period required for that engagement and applicable legal obligations. The contact endpoint itself retains no message content. Security logs are retained only for the operational period configured by the hosting provider and server administrator.
Your rights
You may ask for access to, correction of or deletion of your personal data. You may also object to processing based on legitimate interests and ask for restriction of processing. Contact us at the address above. You may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
No automated decisions
Contact data is not used for automated decision-making that produces legal or similarly significant effects. Messages are read and answered by a person.
Changes
If the processing changes, this notice and its update date will be revised.