Privacy Statement.

This page explains which personal data DesignCheck processes, why, for how long, who else sees it and what your rights are. Did you receive an email from us about your website? Be sure to read section 4.

1. Who we are

DesignCheck (general partnership, Dutch v.o.f.)
Rietgans 63
3641 TX Mijdrecht, Netherlands
Chamber of Commerce (KvK) 42175517
Email: info@designcheck.nl

DesignCheck is the controller for everything on this page. We have not appointed a data protection officer, because we are not required to. Questions about your data can be sent to info@designcheck.nl.

2. When you visit our website

We count visits with our own counter. For each visit we store the page, the time, your browser language, the type of device (computer, tablet or phone), the website you came from (domain name only) and your country, region and city as our hosting provider derives them from your IP address. We also record which links and buttons are clicked.

We do not store your IP address or browser details. We do turn them into a code using a secret key, so that we count a visitor only once per day. That code is stored with each visit, so we can see which pages someone viewed on that day. The code changes every day, so we cannot follow you across days.

We want to know when someone is on our site. That is why what the counter sees also goes to our own workspace, which sends Twan and Lorenzo a notification on their phone or computer: which town a visitor comes from, on what kind of device, via which website, which pages they view and which buttons they click (such as booking a call, calling or the chat). To keep visits by software out of the notifications, such as the virus scanners of email services and search engines, one signal per page also goes along at the moment you move the mouse, scroll, tap or type. What you type and where the mouse is do not go along. Your browser language and the same daily code go along too, never your IP address or which browser you use. What you type in the chat is not included, only that a question was asked, or which fixed question you picked. We do not link this to your name. Our workspace keeps these visits for 30 days.

Twan and Lorenzo also look at the site themselves. To leave those visits out of the notifications, there is a cookie in their own browsers, never on your device. In addition, the counter uses a secret key to turn your network address into a code, which our workspace compares with the networks Twan and Lorenzo used shortly before. The address itself is not passed on, and the code is not stored.

We also use Vercel Web Analytics. It works without cookies. Vercel recognises a visitor by a code that is discarded after 24 hours, and keeps the figures for us for 12 months or longer.

On every visit our hosting provider Vercel processes your IP address and browser details to deliver the page and protect the site. Vercel keeps server logs of this; on our plan they are kept for at most one day.

We do this to run and protect the site, to see which pages are read so we can improve the site, and to know when someone is on the site. The legal basis is our legitimate interest (Article 6(1)(f) GDPR). We keep what our counter stores for 13 months; after that the counter deletes it itself.

We do not place cookies when you visit. Only when you log in to your account does the site set login cookies. Your browser does remember which language you chose on a blog page. More about this in our cookie policy (in Dutch).

3. When you request an audit or contact us

If you request a free audit or fill in the contact form, we receive your email address, the address of your website and, if you fill them in, your name and your message. We also store the language of the form, your country, what your browser sends along (browser, operating system and device) and the page with the form, plus a code derived from your IP address with a secret key, to detect misuse.

For the audit, the legal basis is that we take steps at your request before any contract exists (Article 6(1)(b) GDPR). For other questions, the browser details and the anti-abuse code, it is our legitimate interest (Article 6(1)(f) GDPR). You are not required to provide this data, but without an email address we cannot send you a report. We keep requests made through the form for at most 24 months.

If you email us directly, your message is stored in our mailbox at Mijndomein. We keep your message for as long as needed for our contact or our records.

The chat on our website

At the bottom right of our website there is a chat. If you pick one of the fixed questions, the answer comes from the site itself; we only see which fixed question you picked (see section 2). If you type a question yourself, we send it, together with at most the five messages before it in that conversation, to the AI of Anthropic (Claude), which writes the answer. We do not store your messages; we only record how much text went back and forth. Anthropic processes the messages on our instructions, under its commercial terms, and does not use them to train its AI. Your browser remembers the conversation until you close the tab. To curb misuse, we briefly count how many questions come from one IP address; we do not store that address. The legal basis is our legitimate interest in answering questions about our services quickly (Article 6(1)(f) GDPR). Please do not put sensitive information in the chat. If you book a call through the chat, section 4 explains what happens to your data.

When you call us

If you call our phone number 085 666 27 86, Julia answers. Julia is an AI assistant, not a person; she says so in her first sentence. The call runs through our phone provider OpVoIP to ElevenLabs. ElevenLabs turns your voice into text, has Anthropic's AI (Claude) write the answer and speaks that answer.

We process your phone number, the call as a recording and as a written transcript, a short summary, and what you ask us to note down, such as your name, your business, your email address, your website and when we may call you back. If you ask to speak to Twan or Lorenzo, Julia connects you to their phone. Twan and Lorenzo get a notification of the call and can read it back, so that we can call you back or do what you asked.

If you say during the call that you no longer want to be called, we put your phone number on our opt-out list and we will not call you again. The legal basis is that we act at your request before a contract exists (Article 6(1)(b) GDPR), and our legitimate interest in answering questions about our services quickly (Article 6(1)(f) GDPR). ElevenLabs deletes the recording and the transcript automatically after 30 days. Please do not mention sensitive data during the call.

4. When we approach your business

We look for businesses whose website we think could be better, and email them about it. This is how that works.

Which data

The name of your business, its address, its website, and the email addresses and phone numbers shown on your website or in OpenStreetMap. If your website lists names and roles of the owner or management, we keep at most three of them. From the KVK Trade Register we take, among other things, the KvK number, the registered name and trade names, the legal form, the number of people employed, the business address, the business activity (SBI code), the registration date and whether you have a non-mailing indicator. We also look at your website: we take screenshots, keep its text and assess design, speed and findability.

For a sole proprietorship or partnership the business name is often your own name, and a name on your team page or an address such as firstname@company.nl is personal data. That is why we cover it in this statement.

The example design

Based on your public website, we use AI to make an example of a new site, with an image of your current and the new site side by side. The example may contain text, photos, contact details and the logo from your own site. The example comes with a demo of a client dashboard in your house style, with your business name and logo and sometimes your phone number, email address and photos from your site. The example and the demo sit behind a secret link that we only email to you, and search engines do not index them.

If you open the example, the demo or the scheduling page through the link in our email, we record which page was opened and when. This also applies if someone else opens the link, for example because you forwarded the email. This tells us whether our proposal interests you and when it is a good moment to call. Twan and Lorenzo get a notification on their phone or computer and a short summary by email. For this, we do not store your IP address or details about your device, and we do not place cookies on your device. Once you unsubscribe, we stop recording this.

The example also contains a small measuring script. It counts how long each part of the page is in view (such as the opening, the menu or the contact details), what kind of button or link is clicked and in which part (such as calling, booking or a photo), and how far the page is scrolled. The script places no cookie and stores nothing in your browser. It does not read what you fill in, for example in a test booking. We receive the counts and the sector of the example (such as hospitality or construction), but not the link and not your business name. We add it up per sector and per week and do not keep it with your business. Our workspace only shows these figures for completed weeks in which at least three businesses in the same sector opened their example. This shows us which parts of an example interest visitors most, so we can improve our examples, emails and calls. What you do in the demo stays in your own browser; we do not see it.

Twan and Lorenzo also open the links themselves. To leave those visits out, our workspace places a cookie in their own browsers, never on your device. In addition, for every visit and every measurement we use a secret key to turn your IP address (for IPv6, its first half) into a code, and compare it with the networks on which Twan or Lorenzo used our workspace in the two hours before. We do not store that code, nor your IP address.

Our hosting provider Vercel and our own server at Hetzner do see your IP address, as with any website. Vercel keeps its logs for us for at most one day. The demo loads fonts from Google, so Google also sees your IP address. Our emails contain no pixel that tracks whether you open them.

Booking a call

At the bottom of our email there is a button to book a call yourself. If you do, we ask for your name, your phone number and, if you like, what you want to discuss. We use this only to call you at the time you chose. Twan and Lorenzo see it in a notification on their phone or computer and in our workspace. The legal basis is that we take steps at your request before any contract exists (Article 6(1)(b) GDPR). If the contract would not be with you personally but with a private limited company or your employer, the legal basis is our legitimate interest (Article 6(1)(f) GDPR). We keep this data with your other data from this section and delete it at the same time.

The same calendar also opens from the button to book a call on our website and from the chat at the bottom right of our website, even if you never received an email from us. In that case we also ask for your email address and, if you like, the name or website of your business. The same purpose, legal basis and retention periods as above apply. To stop anyone from filling up the calendar, we count for one day how often bookings are made from a single network. We do not store an IP address for this, only a code calculated from the address with a secret key. That code disappears after a day.

Why, and on what legal basis

We send you an email with the example, the demo and what we noticed about your site. If you do not respond, you will receive at most two follow-up emails: a reminder and a final email with an offer. Then we stop. If you do respond, we handle your reply. Sometimes we call instead of emailing. An AI assistant writes the emails; Twan or Lorenzo reads and approves them before they are sent.

The legal basis is our legitimate interest (Article 6(1)(f) GDPR): we want to find new clients. We have weighed that interest against yours and recorded that assessment. You can ask us for a copy of it.

Where the data comes from

From your own website, from OpenStreetMap (a public map listing businesses with their address and phone number), from the KVK Trade Register, and sometimes from another public page that shows your email address. These sources are public. Our first email states where we found your email address.

How long

If you do not become a client, we delete your data no later than 12 months after the last message between us, or 12 months after we collected it if we never emailed you. The example, the demo and the KVK data are then deleted as well. If you become a client, section 5 applies.

We clear a few copies by hand: the emails in our mailboxes at Mijndomein, the four example sites hosted separately on Vercel, and a list of businesses from OpenStreetMap (with address, phone number and email address), with screenshots, before-and-after images, text of their websites and names of the owner or management, in the storage of our program code at GitHub and in our workspace at Vercel. After you unsubscribe, we remove you from the current files within one month. Otherwise we clear these copies within 12 months after we made them; this also applies to old versions in the history at GitHub and old deployments at Vercel.

5. When you become a client

For quotes, engagements and invoices we process your name, contact details, business details and the agreements we make. This is necessary to perform the contract (Article 6(1)(b) GDPR); for a contact person at a client, the legal basis is our legitimate interest. We keep invoices and the related records for 7 years, because Dutch tax law requires it (Article 6(1)(c) GDPR and Article 52(4) of the General State Taxes Act).

Your account

If you create an account on our website, we store your email address, your password (only in encrypted form) and the secret key of the two-step verification. If you pay for a package, we ask for the name of your business, the KvK number, the VAT number if you enter it, the sector, your name and the address. We use this to create your account, the order and the invoice. After payment we send you a confirmation with the invoice; the invoice is also in your account. To prevent misuse, we count attempts to log in, create an account or pay, using an unreadable code of your IP address, email address or account. The legal basis is the contract (Article 6(1)(b) GDPR); for the counts against misuse, it is our legitimate interest. Your account stays until you ask us to delete it; we keep orders and invoices for 7 years, as above.

Ordering and signing

If you order a package, we also ask for your phone number, your job title if you enter it, and the domain name of your current site. If you enter your KvK number, we use only that number to look up the name, legal form and business address in the Trade Register of the Dutch Chamber of Commerce (KvK); we keep that result for 30 days so we do not have to look up the same number again. If you enter your postcode and house number, we look up the street and town at PDOK, the service of the Dutch Land Registry (Kadaster); only the postcode and house number are sent. Before you pay, you read and sign the agreement. We store the text you signed, your signature, your name, the time, your IP address and which browser you used, in encrypted form, as proof of what was signed. You receive the signed agreement as a PDF with the invoice. We keep it for 7 years, like orders and invoices. The legal basis is the contract (Article 6(1)(b) GDPR).

Delivery and your domain

In your account you review the new site. What you write there is stored with the delivery and also sent to our own email address. For your domain we look up public data: where the domain is registered (at the registry of the extension, such as SIDN for .nl) and the settings for your email, so it keeps working after a transfer. If you give us the transfer code of your domain, we store it in encrypted form and delete it as soon as the domain has been transferred; it never appears in our emails.

Paying

Payments go through Mollie. You give your bank or card details to Mollie, not to us; we only see whether you paid, when and with which payment method. For this we give Mollie the amount, what you buy, your name, the name and address of your business and your email address. As a payment institution, Mollie is itself responsible for the data it processes for the payment; see Mollie's privacy statement. If you give a mandate for the monthly payment, Mollie stores that mandate; we only store a reference to it.

6. When you connect an account in the DC Kit

DesignCheck clients work in the DC Kit, our dashboard at app.designcheck.nl. In it you can connect accounts at other services yourself, such as your Google account (Google Business Profile and Google Calendar), Microsoft (Outlook mail and calendar), Meta (WhatsApp Business, Facebook and Instagram), Mollie and your accounting software. You always connect them yourself: you sign in at that service and grant permission there. You can disconnect at any time, in the DC Kit under Koppelingen or in your account settings at the service itself.

How we use your Google data

When you connect Google, we only request the access needed for the features you use:

• Google Business Profile (business.manage): we read the details of the business profiles you manage (name, address, phone, website, opening hours, description and reviews) and show them in the DC Kit. We only change your profile when you do so in the DC Kit yourself, for example when you change your opening hours, reply to a review or publish a post.
• Google Calendar (calendar.events): we only read when your own events are, not what they are about, so customers cannot double-book you, and we add appointments booked through the DC Kit or your website to your calendar, and update or remove them when the appointment changes.

We only use this data to make these features work for you. We do not sell it, do not use it for advertising, do not transfer it to others (except where needed for the feature, where the law requires it, or in a merger or acquisition, and then only under these same terms) and do not use it to train AI models. People at DesignCheck do not read your Google data unless you ask us to (for example to fix a problem), it is needed for security, or the law requires it.

DesignCheck's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Storage and retention

The access tokens for your connections are stored encrypted in our database at Supabase in Frankfurt, and only our server can decrypt them. Data we fetch from a service is kept only while you are connected and only as long as needed to show it in the DC Kit. When you disconnect, we delete the access tokens immediately and also revoke our access at Google ourselves. Data we kept from that service is deleted within 30 days. Data you create in the DC Kit yourself, such as appointments and invoices, falls under section 5.

Why, and on what legal basis

We do this to make the DC Kit work as agreed with you (Article 6(1)(b) GDPR). Where it concerns data about your own customers, such as an appointment or a review, we process it on your behalf, under a data processing agreement with you.

7. Who else sees your data

We do not sell your data. We do work with these parties. Most of them work on our instructions and only receive what they need for their task; where that is different, it says so.

• Vercel Inc. (United States): hosting of this website, of our workspace and of the example links, storage of forms and of the visitor counter, and Vercel Web Analytics.
• Supabase Pte. Ltd. (Singapore): the database of our workspace and of the client accounts, on servers in Frankfurt (Germany).
• Mollie B.V. (Netherlands): the payments in your account. As a payment institution, Mollie is itself responsible for the payment data.
• Dutch Chamber of Commerce (KvK, Netherlands): for the KvK number you enter with an order, we look up the data in the Trade Register; only the number is sent.
• PDOK, of the Dutch Land Registry (Kadaster, Netherlands): the street and town for the postcode and house number you enter; only those two are sent.
• Hetzner Online GmbH (Germany): our server, which runs our software and hosts the example and the demo.
• Mijndomein Hosting B.V. (Netherlands): our email.
• Anthropic Ireland, Limited (Ireland), with parent company Anthropic PBC (United States): the AI that assesses websites, builds example designs, drafts emails and answers questions in the chat on our website and on the phone. For part of the work Anthropic processes the data on our instructions, under its commercial terms. For another part (Claude subscriptions) Anthropic decides for itself how it uses the data, under its consumer terms and privacy policy.
• GitHub, Inc. (United States): stores the program code of our workspace, which also contains data from section 4; GitHub does so under its own terms.
• Google LLC (United States): supplies the fonts of the demo, and sees the IP address of whoever opens it; Google uses this under its own privacy policy.
• The Netherlands Chamber of Commerce (KVK): to look up your details in the Trade Register, we pass on the name and town of your business (sometimes also postcode and house number), and then the KvK number. The KVK is responsible for its own processing.
• ElevenLabs (United States): answers phone calls with Julia, turns them into text and speaks the answers, on our instructions. The calls are stored at ElevenLabs in the United States.
• OpVoIP (Netherlands): our phone provider; processes your phone number while the call takes place, on our instructions.
• Our bank and our accounting software: for payments and client records; the bank is responsible for its own processing.

Sometimes we have to provide data to a government authority because the law requires it.

8. Data outside the European Economic Area

Vercel, GitHub and Google participate in the EU-US Data Privacy Framework. Data sent to them is covered by the European Commission's adequacy decision of 10 July 2023. Supabase is based in Singapore; with Supabase, the European Commission's standard contractual clauses apply. Anthropic also processes data in the United States. Under Anthropic's commercial terms, the standard contractual clauses apply to this as well; for Claude subscriptions Anthropic arranges the transfer itself. You can ask us for a copy of the standard contractual clauses with Supabase and with Anthropic (under the commercial terms). ElevenLabs processes the calls with Julia in the United States. The data processing addendum that ElevenLabs publishes applies to this; for transfers it names the European Commission's standard contractual clauses and the EU-US Data Privacy Framework.

9. Retention periods at a glance

• Visitor counter: 13 months.
• Visits with their pages and clicks in our workspace, for the notifications: 30 days.
• Vercel Web Analytics: 12 months or longer, at Vercel.
• Server logs at Vercel: at most one day.
• Audit and contact requests through the form: 24 months.
• Questions in the chat: not stored by us; in your browser until you close the tab.
• Counts from the measuring script in the example, per sector and per week: 13 months.
• Phone calls with Julia (recording, transcript and summary): 30 days, at ElevenLabs.
• Outreach, including the example, demo, KVK data, what was opened of the example, the demo and the scheduling page and when, and a booked call: up to 12 months after the last message, or within one month after you object.
• Suppression list: email address, phone number or website domain, with date, reason and how you unsubscribed, for as long as we approach businesses.
• Client records, orders and invoices: 7 years.
• Connections in the DC Kit: access tokens until you disconnect; fetched data deleted within 30 days after that.
• Signed agreements, with signature, IP address and browser: 7 years.
• KvK data of a looked-up KvK number: 30 days.
• Transfer code of your domain: until the domain has been transferred.
• Client account: until you ask us to delete it.
• Counts against misuse when logging in and paying: about one day.

10. Your rights

You may ask us which data we hold about you, have it corrected or deleted, have its use restricted and, if you provided it to us yourself, receive a copy in a common file format. You may also object to processing based on our legitimate interest. If it concerns direct marketing, as in section 4, we always stop.

To do so, email info@designcheck.nl. We respond as soon as possible, and no later than one month. We may ask you to verify your identity, so that we do not give data to the wrong person.

If you disagree with how we handle your data, you can lodge a complaint with the Autoriteit Persoonsgegevens.

11. Decisions by software

Software helps us choose which businesses to approach and writes a first draft of the email. A person decides whether an email is sent. We do not make decisions about you based solely on automated processing that produce legal effects for you or similarly significantly affect you.

12. Changes

If we change this statement, we will publish the new version on this page. Last updated: 22 October 2026.

Image credits

The laptop and the phone in the images on our homepage are 3D models by others, used under the CC BY 4.0 licence: "MacBook Pro M3 16-inch 2024" by jackbaeten and "iPhone 17 Pro" by Ranguel, both via Sketchfab. We lit them in Blender and put our own screens on them. The studio lighting comes from Poly Haven (CC0).