Privacy statement

Invoker B.V. (Chamber of Commerce 76647595, Bornholmstraat 76, 9723 AZ Groningen, the Netherlands, info@invoker.nl) is the controller for the personal data collected via www.invoker.nl. This statement describes what data that is, what we use it for and what rights you have.

1. What data we process

Contact and callback forms. Name, email address, phone number, company name, the topic and your message. With each submission we also record your IP address, browser type, the page on which you submitted the form, the website you came from and any campaign parameters in the link. We use that last group of data solely to keep out spam and to understand through which channels requests come in.

Email. If you email us, we keep your address and the content of the correspondence for as long as needed to handle your question.

Client data. If you become a client, we also process the data needed for the agreement and invoicing: company details, contact person, billing address, payment details and the technical details of the services we manage for you (domains, servers, accounts).

Orders through the website. If you order through the order page, we process your name, address, email address, phone number and, for a business order, your company name, Chamber of Commerce and VAT numbers, plus your plan choice, domain name, IP address and browser. Payment details (bank account, card) are entered at Mollie; we only see the payment status and a mandate reference for the direct debit.

Visitor statistics. We use Vercel Web Analytics (no cookies: page views, country, device type and referring website, without personal identification) and Google Analytics 4 in a privacy-friendly configuration: only an analytical first-party cookie, no advertising features, no Google signals and no link to a Google account. Google does not store your IP address. We use the numbers only to see which pages work.

2. Why, and on what legal basis

• Responding to your question or callback request: legitimate interest and, if it leads to an assignment, performance of the contract.
• Fighting spam and abuse (IP address, browser, time token): legitimate interest.
• Performing the contract and invoicing: contract and legal obligation (tax retention requirements).
• Visitor statistics without personal data: legitimate interest.

3. How long we keep data

• Form submissions and email without follow-up: up to 12 months.
• Client and invoice data: 7 years after the last financial year, in line with tax retention requirements.
• Unfinished orders (no payment received): up to 6 months.
• Technical form logs (IP, browser): up to 30 days, unless needed to investigate abuse.

4. Who we share data with

We don't sell data and only share it with parties needed to deliver the service, under a data processing agreement:

• Vercel (hosting of this website and visitor statistics). Vercel Inc. is based in the US; transfers rely on the EU-US Data Privacy Framework.
• Mailgun (delivery of form messages to us, EU region).
• Google (Google Analytics 4, privacy-friendly configuration). Google Ireland Ltd. is the contracting party; transfers to the US rely on the EU-US Data Privacy Framework.
• Mollie B.V. (payments and direct debits for orders placed on this site; we never see or store bank or card details ourselves). For the payment itself Mollie is an independent controller with its own privacy statement.
• Our registrar bNamed and the registry of the extension (for example SIDN for .nl) when registering or transferring a domain name; registrant details are recorded there and are partly available through whois.
• Supabase (storage of orders, EU region).
• Google Workspace (our business email).
• For clients: the hosting and domain parties needed for the service purchased, and our accounting software for invoicing.

Where processing takes place outside the EEA, it is based on the EU-US Data Privacy Framework or standard contractual clauses.

5. Cookies

www.invoker.nl sets no third-party advertising or tracking cookies. Google Analytics sets two analytical first-party cookies (_ga and _ga_*, at most 13 months) to recognise returning visits; their privacy impact is minimal, which is why they fall outside the consent requirement. If you'd rather not have them, block cookies for invoker.nl in your browser; the site works just the same. The forms use a temporary, technical value in the browser to keep out spam; it contains no personal data.

During an order we temporarily keep your choices and the details you entered in your own browser's session storage, so you can step back. That data disappears as soon as you close the tab or click "start over" and is not used for statistics or advertising.

6. Security

Connections are encrypted (HTTPS with HSTS), access to client data is limited to those who need it, and systems are actively updated and monitored. That is exactly what we do for our clients too.

7. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection. Email your request to info@invoker.nl; we respond within one month. If you disagree with how we handle your data, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

8. Changes

We update this statement when our services or the law require it. The date at the top shows the latest change. See also our terms and conditions.