Privacy notice

This notice explains what personal data FLUX25 handles when you visit flux25.com or contact us, why, and what rights you have. In short: we don’t use cookies, we don’t track you across other sites, we don’t sell data, and what you send us is used to answer you and, if we work together, to run the work.

Who is responsible

FLUX25, Rotterdam, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 42052223, is the controller for the processing described here. For any question about your data, or to use your rights, email jelle@flux25.com.

When you contact us

If you use the enquiry form or email us, we receive the details you give: your name, email address, company, the product and volume you are interested in, your message, and anything else you choose to include. Only your email address and message are required; without them we can’t reply.

We use this to answer your enquiry, to assess whether we can help, and, if we agree to work together, to prepare and carry out that work. The legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR) and, where you write on behalf of a company, our legitimate interest in responding to business enquiries (Article 6(1)(f) GDPR).

The form either delivers your enquiry to our mailbox directly or, if that service is unavailable, opens your own email program with the enquiry filled in. In that case nothing is sent until you send the email yourself. To limit spam, the form briefly holds your IP address in memory to count requests; it is not stored and is discarded within an hour.

We will not pass your details to manufacturers, buyers or other partners without your agreement, and we will not add you to a mailing list.

When you visit the site

Like any website, ours is delivered by a hosting provider whose servers process technical data for each request: your IP address, the page requested, the time, your browser and device type, and the referring page. This is needed to deliver the site and keep it secure, which is our legitimate interest (Article 6(1)(f) GDPR). These server logs are kept by the host for a short period and are not used to identify you.

We use Vercel Web Analytics to see, in aggregate, which pages are visited, from which countries, on which kinds of device, and where visitors came from. It sets no cookies and stores nothing on your device. Visits are grouped using a hash derived from the request that is discarded after 24 hours, so we cannot recognise you on a later visit or link the statistics to you. The legal basis is our legitimate interest in understanding how the site is used (Article 6(1)(f) GDPR).

The site does not use cookies, local storage or any similar technology, and it loads no fonts, scripts or embeds from third parties. That is why there is no cookie banner.

Who else handles your data

We use a small number of service providers that process data on our behalf, under data processing agreements, and only for the purposes above:

• Vercel Inc. hosts the website and provides the visitor statistics.
• Google (Google Workspace) runs our email.
• Resend delivers enquiries from the form to our mailbox.

Beyond these, we share personal data only with professional advisers bound by confidentiality, such as our accountant, or where the law requires it. We never sell personal data.

Transfers outside the EU

Some of these providers are based in the United States or use servers there. Where data leaves the European Economic Area, the transfer relies on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses. You can ask us for more information about these safeguards.

How long we keep it

• Enquiries that don’t lead to work together: up to two years after our last contact, so we have the context if you get in touch again. You can ask us to delete them sooner.
• Clients: for the duration of the relationship, and afterwards as long as Dutch law requires us to keep business records, which for administrative and tax records is seven years.
• Spam-protection IP counts: discarded within an hour.
• Analytics hashes: discarded after 24 hours.

Your rights

Under the GDPR you can ask us for access to your personal data, to correct or delete it, to restrict how we use it, or to receive it in a portable format. You can object at any time to processing based on our legitimate interest. We will respond within one month. If we can’t verify that a request comes from you, we may ask for confirmation first.

If you think we are handling your data incorrectly, please tell us first so we can put it right. You also have the right to complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or to the authority in the EU country where you live or work.

Security

The site is served over HTTPS only. Enquiries are accessible only to the people at FLUX25 who handle them, and our providers are selected for their security practices.

Automated decisions

We don’t make decisions about you by automated means or build profiles of visitors.

Changes

If we change how we handle personal data, we will update this notice and the date at the top.