Privacy at a glance
Art-Fixed processes personal data only for specific business purposes, such as responding to enquiries, carrying out IT and web development assignments, managing the Client Portal, invoicing, security and statutory administration. Art-Fixed does not sell or rent personal data.
For the website, Client Portal and email, Art-Fixed uses hosting provided by Fornex. The hosting of art-fixed.nl and clients.art-fixed.nl is located in the Netherlands. Certain functions also use external services such as WhatsApp, AnyDesk, TeamViewer, Google Cloud Translation and Google Search Console. This Privacy Policy explains what data may be involved, why we use it and how long we generally retain it.
For privacy questions or requests, contact info@art-fixed.nl.
1. Who is responsible for your personal data?
For processing activities for which Art-Fixed determines the purposes and means, Art-Fixed is the data controller.
- Trade name: Art-Fixed
- Legal form: sole proprietorship (eenmanszaak)
- Chamber of Commerce (KVK) number: 85150231
- VAT identification number: NL004056857B33
- Business address: De Run 1141, 5503 LB Veldhoven, the Netherlands
- Email for privacy requests: info@art-fixed.nl
- Telephone / WhatsApp: +31 6 45063484
2. When does this Privacy Policy apply?
This Privacy Policy applies to personal data processed by Art-Fixed in connection with, among other things:
- art-fixed.nl and contact forms;
- clients.art-fixed.nl and the Client Portal;
- email, telephone and WhatsApp;
- quotations, assignments, contract acceptance and invoicing;
- computer and laptop repair, diagnostics, data transfer and data recovery;
- IT support and remote support;
- web development, WordPress, website maintenance and technical SEO;
- security, logging, backups and incident handling.
Where Art-Fixed processes personal data solely on behalf of a client and under that client’s responsibility, for example personal data of visitors, employees or customers in WordPress, WooCommerce, a CRM or a database, Art-Fixed generally acts as a processor or, where the client itself acts as a processor, as a subprocessor. See also section 6.
3. Contact, email and enquiries
When you contact Art-Fixed through a contact form, email, telephone or another direct channel, Art-Fixed may process information such as your name, email address, telephone number, subject, message content, attachments and other information you provide yourself.
Art-Fixed uses this information to answer your question, prepare an appointment or diagnosis, prepare a quotation, perform an agreement or conduct business correspondence.
The legal basis is generally taking steps at your request before entering into a contract or performing a contract. For other business communications, Art-Fixed may, where appropriate, rely on a legitimate interest, for example to maintain an existing business relationship or handle a request properly.
A general privacy checkbox on a form does not mean that all processing is based solely on consent. Where processing is necessary for an enquiry, agreement, legal obligation or legitimate interest, the appropriate legal basis applies.
4. WhatsApp
If you contact Art-Fixed through WhatsApp, information such as your telephone number, profile name, messages, files sent and technical communication data may be processed by WhatsApp. Art-Fixed uses WhatsApp for communication about enquiries, appointments, assignments and support.
Art-Fixed currently uses the regular WhatsApp service. WhatsApp is an external communications service with its own privacy policy and responsibilities for processing personal data. According to WhatsApp, personal messages and calls are end-to-end encrypted, while WhatsApp also processes certain account, device and usage data under its own terms.
You are not required to use WhatsApp. You can also contact Art-Fixed by email at info@art-fixed.nl.
5. Client Portal, quotations and contract acceptance
For the Client Portal, Art-Fixed processes information needed to manage your account and assignments. This may include:
- name, email address, language preference and account information;
- projects, messages, support requests and files;
- quotations, invoices, payment status and project references;
- information about accepting a quotation or proposal;
- portal notifications about, for example, proposals sent to you and whether those notifications have been read;
- status information about contract-confirmation emails, such as sent, failed or retried, including technical error information where needed for delivery and support;
- security information such as IP address, login time, failed login attempts and browser or user-agent data.
When a quotation or proposal is accepted through the Client Portal, Art-Fixed stores an evidence record of the contract acceptance. This may include the document type and document number, client and user references, date and time of acceptance, IP address, user agent, language, the capacity selected by the client as consumer or business customer, the recorded quotation amounts and VAT, the applicable version of the General Terms and Conditions and, where relevant, separate choices concerning early performance during the withdrawal period and the right of withdrawal.
This information is processed to enter into and perform the agreement, to record which terms and quotation were accepted and to handle possible disputes or questions of evidence.
A withdrawal statement submitted through the Client Portal is stored as a separate record. A withdrawal does not delete the original acceptance evidence.
Art-Fixed may also retain technical delivery information relating to confirmations of acceptance or withdrawal, for example the recipient email address, delivery status, number of delivery attempts and any technical error message. This is used to monitor delivery of contractual confirmations and to resolve delivery problems.
6. When Art-Fixed acts as a processor for a client
During web development, technical management and support, Art-Fixed may gain access to personal data for which the client is responsible. Examples include data in WordPress, WooCommerce, forms, databases, CRM systems, user accounts and hosting environments.
To the extent that Art-Fixed processes this data solely on the documented instructions of the client, the client is the controller and Art-Fixed is the processor. Where the client itself acts as a processor, Art-Fixed may act as a subprocessor.
Where Article 28 GDPR applies, the processing is governed by a data processing agreement or another binding arrangement that meets GDPR requirements. Art-Fixed does not use such client data for its own marketing purposes and does not independently assign another purpose to it.
7. Computer repair, diagnostics and data on devices
When carrying out repair or diagnostics, Art-Fixed may process information about the device, the technical problem, serial numbers or other device identifiers, checks performed, parts, repair work and communications with the client.
Depending on the assignment, technical access to files or accounts may be necessary. Art-Fixed limits such access to what is reasonably required to perform the agreed work.
If a password, PIN or other access code is required for the repair, it may temporarily be recorded in the order or project notes in the Client Portal. These access details are deleted when the repair is completed or as soon as they are no longer needed, unless otherwise agreed in writing.
Temporary copies, data transfer and data recovery
For backup, migration, data transfer or data recovery, it may be necessary to make a temporary copy of client data on an Art-Fixed computer or external storage medium. Such temporary copies are deleted after the agreed transfer or work has been successfully completed, unless longer retention has been expressly agreed or is necessary for ongoing support.
Data recovery does not guarantee that all data can be recovered. Personal data involved in data recovery is processed solely for the technical work requested by the client.
8. Access credentials for web development and support
For web development or technical management, Art-Fixed may receive access credentials for systems such as WordPress, hosting, FTP, SFTP, SSH, databases, domain management or other systems.
These access credentials are retained only for as long as Art-Fixed needs the relevant access for an ongoing project or agreed support. When that support ends and access is no longer required, Art-Fixed removes the stored access credentials from its own working records.
Where practical, Art-Fixed recommends that clients use separate user accounts for technical access and revoke access or change passwords after the collaboration ends.
9. Remote support with AnyDesk and TeamViewer
Art-Fixed may use AnyDesk and TeamViewer for remote support. A remote session is started only with the cooperation or authorisation of the client. Art-Fixed does not use permanent unattended access as its standard working method.
Remote sessions are not recorded as video by Art-Fixed. File transfer may be used where necessary for the requested support.
AnyDesk and TeamViewer are external service providers and may themselves process technical connection, account and security data under their own terms and privacy information.
10. Invoices, administration and payments
For quotations, invoices and financial administration, Art-Fixed may process information including name and company details, address details where necessary, Chamber of Commerce or VAT information, project and invoice information, amounts, VAT, due dates and payment status.
The Client Portal displays Art-Fixed’s payment details. Payments are checked and confirmed by Art-Fixed. Art-Fixed currently does not use an external online payment gateway as a required step in the ordinary invoice-payment process through the Client Portal and does not store a client’s bank account details as a separate payment profile in the ordinary client profile.
Invoices and the basic records forming part of the financial administration are retained to the extent and for as long as required by Dutch tax law.
11. Google Cloud Translation
The Client Portal may use Google Cloud Translation to translate descriptions of work on invoices. Art-Fixed is configured to send only the work-description text and not intentionally include unnecessary identifying, special-category or other sensitive personal data in that text.
According to Google’s documentation, text submitted to the Cloud Translation API is used to provide the translation and is held briefly in memory for the delivery of the service. Google states that the content is not used to train its translation models. Where applicable, processing is subject to the Google Cloud Data Processing Addendum.
Depending on the endpoint used, Cloud Translation may operate as a global service and processing may therefore take place outside the European Economic Area. See section 15.
12. Google Search Console
Art-Fixed uses Google Search Console to assess the technical visibility of the website and its performance in Google Search, for example search queries, impressions, clicks and indexing issues.
Using Google Search Console does not in itself mean that Art-Fixed places Google Analytics tracking code or a marketing pixel on the website. Google processes data within Search Console and its services under its own terms and privacy policy.
13. Security logs and incident information
For security, prevention of misuse, troubleshooting and protection of accounts, Art-Fixed may process technical logs such as IP address, date and time, login attempts, error messages and browser or user-agent information.
The legal basis for this processing is the legitimate interest of Art-Fixed and its clients in maintaining a secure and reliable IT environment. Ordinary security logs are generally retained for no more than 90 days. Information required to investigate a specific security incident may be retained for longer for as long as reasonably necessary for investigation, recovery, evidence or legal obligations.
14. Legal bases
Art-Fixed processes personal data only where a valid legal basis exists. Depending on the situation, this may be:
- Performance of a contract or pre-contractual steps — for example for a quotation, repair, project, account, support request or contract acceptance.
- Legal obligation — for example tax administration, invoices, certain statutory information obligations and obligations relating to privacy requests or security incidents.
- Legitimate interests — for example account and system security, fraud prevention, technical logging, handling business communications and establishing, exercising or defending legal claims, insofar as your interests and rights do not override those interests.
- Consent — only where the processing is genuinely based on consent. You may withdraw that consent for the future. Withdrawal does not make prior processing based on valid consent unlawful.
15. Service providers, recipients and international transfers
Art-Fixed shares personal data only where necessary for a service, agreement, legal obligation or another legitimate purpose. Art-Fixed does not sell or rent personal data.
| Service / party | Purpose | Role / point of attention |
|---|---|---|
| Fornex | Hosting of art-fixed.nl and clients.art-fixed.nl, email and backups | Hosting location for these services: the Netherlands. For hosting-related processing, Fornex generally acts as processor under the applicable arrangements. |
| Google Cloud Translation | Translation of work descriptions in the Client Portal | External cloud processor for the service provided; depending on the endpoint used, global processing may be possible. |
| Google Search Console | Technical search performance and indexing | External Google service. This is not the same as placing Google Analytics on the website. |
| Communication with clients | External communications service with its own privacy responsibilities. For users in the European Region, the service is provided by WhatsApp Ireland Limited. | |
| AnyDesk | Remote support | External remote-support service; it may process technical connection and account data. |
| TeamViewer | Remote support | External remote-support service; it may process technical connection and account data. |
Art-Fixed currently does not use freelancers or subcontractors who independently receive access to client data for the performance of assignments.
Where a service provider processes personal data outside the European Economic Area, Art-Fixed applies a mechanism under Chapter V GDPR where required, for example an adequacy decision or appropriate contractual safeguards such as Standard Contractual Clauses. The actual processing locations and subprocessors used by external services may change.
16. Hosting and backups
art-fixed.nl, clients.art-fixed.nl and the mailbox info@art-fixed.nl are hosted by Fornex. The current hosting location for the website and Client Portal is the Netherlands.
Fornex backups are retained for 30 days. When data is deleted from the active system, copies may therefore remain temporarily in existing backups until the relevant backup-retention period expires. Backups are intended for recovery from technical problems and are not used as an active archive for day-to-day purposes.
17. Retention periods
Art-Fixed does not retain personal data for longer than reasonably necessary for the purpose for which it was obtained, unless a statutory retention obligation, an ongoing dispute or another valid reason requires longer retention.
| Category | Retention period / principle |
|---|---|
| Minimal Client Portal account data | For as long as the account remains reasonably necessary for access, an ongoing client relationship or recurring services. A deletion request is assessed under the GDPR and applicable legal retention obligations. |
| Projects, messages, support history, contract-acceptance and withdrawal evidence | Generally no more than 5 years after completion of the project or the last substantive interaction, unless a specific dispute, legal claim or statutory obligation justifies longer retention. |
| Uploaded project and support files | Generally no more than 6 months after completion of the project or closure of the request, unless the files are still needed for agreed support or another legitimate reason. |
| Invoices and basic tax records | Generally 7 years, in accordance with Dutch tax-retention requirements. A different statutory period may apply to certain records. |
| Passwords, PINs and similar repair access codes | Until the repair is completed or the access is no longer needed, unless otherwise agreed in writing. |
| Temporary copies for repair, data transfer, migration or data recovery | Until the agreed work has been successfully completed and the copy is no longer required, unless otherwise agreed in writing or still required for ongoing support. |
| WordPress, hosting, FTP, SSH and other access credentials | For as long as Art-Fixed requires the relevant access for the project or agreed support; stored access credentials are removed afterwards. |
| Ordinary security and server logs | Generally no more than 90 days. Relevant incident data may be retained for longer where necessary for investigation, recovery, evidence or a legal obligation. |
| Fornex backups | 30 days. |
18. Special-category and sensitive personal data
Art-Fixed does not ask clients to provide special-category personal data, such as health information, political opinions, religious information or other data subject to additional protection under the GDPR, unless a specific lawful situation genuinely requires it.
During computer repair, data transfer or technical management, such information may incidentally be visible or technically form part of a storage copy without Art-Fixed requiring that information for its own purpose. Art-Fixed limits access to the data technically necessary and does not use incidentally encountered content for other purposes.
Please do not submit special-category or other highly sensitive information through a free-text field where that information is not required for the requested service.
19. Security
Art-Fixed takes appropriate technical and organisational measures tailored to the nature of the processing and the risks involved. Where appropriate, these measures include limiting access to data, account and access management, security logging, backups, system maintenance and limiting processing to what is necessary for the work.
No IT system can guarantee absolute security. Where Art-Fixed identifies a security incident, Art-Fixed investigates the incident, limits its effects where possible and acts in accordance with applicable legal obligations.
20. Personal data breaches
Art-Fixed records security incidents and personal data breaches where required by the GDPR. Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals, Art-Fixed assesses whether notification to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) is required. Where the statutory notification obligation applies, notification is generally made without undue delay and, where feasible, within 72 hours after becoming aware of the breach.
Where a personal data breach is likely to result in a high risk to individuals, affected individuals are informed where required by the GDPR.
21. Children and minors
Art-Fixed’s services are not specifically directed at young children. Services may in certain situations be provided to minors where legally permitted.
Where Dutch contract law or privacy law requires the permission or involvement of a parent or legal representative, Art-Fixed may therefore request such permission or confirmation. The GDPR age rule for consent in relation to certain online services is separate from the question whether a minor may independently enter into a particular agreement.
22. Automated decision-making and profiling
Art-Fixed does not make decisions about clients based solely on automated processing where those decisions produce legal effects or similarly significantly affect them, as referred to in Article 22 GDPR.
Art-Fixed does not use profiling for such decision-making.
23. Your privacy rights
Depending on the circumstances, under the GDPR you may have the right to:
- ask which personal data Art-Fixed processes about you and obtain access to that data;
- have inaccurate or incomplete personal data corrected;
- have personal data erased where the legal conditions are met;
- restrict processing where the GDPR provides a basis for doing so;
- object to certain processing, including processing based on legitimate interests;
- receive your data or have it transferred where the right to data portability applies;
- withdraw previously given consent for the future;
- lodge a complaint with a supervisory authority.
These rights are not absolute. A request may, for example, be wholly or partly restricted where a statutory retention requirement applies, the rights of others must be protected or another legal exception applies.
24. How can you exercise your rights?
Send your request to info@art-fixed.nl. Clearly state which right you wish to exercise and which data your request concerns.
Art-Fixed must verify that a request actually comes from the correct person. Where there are reasonable doubts about your identity, Art-Fixed may request additional information necessary to confirm it. Art-Fixed does not routinely request a full copy of an identity document where a less intrusive verification method is sufficient.
Art-Fixed generally responds within one month after receiving a valid request. For a complex request or a large number of requests, this period may be extended by up to two additional months in accordance with the GDPR. In that case, you will be informed of the extension and the reasons for it within the first month.
A privacy request is generally free of charge. Different rules apply only in the exceptional circumstances permitted by the GDPR, for example where requests are manifestly unfounded or excessive.
25. Complaints to the Dutch Data Protection Authority
If you have a privacy question or complaint, you are encouraged to contact Art-Fixed first at info@art-fixed.nl so that we can investigate the matter.
You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). More information is available on the website of the Dutch Data Protection Authority.
26. Cookies and similar technologies
Cookies and similar technologies are addressed separately. This Privacy Policy does not replace the Cookie Policy or any cookie settings or consent required by law.
The separate Cookie Policy and cookie settings are aligned with the cookies and other technologies actually used on art-fixed.nl.
27. Changes to this Privacy Policy
Art-Fixed may amend this Privacy Policy when its services, systems, legal requirements or actual processing activities change. The date at the top of this page shows when the policy was last updated.
A new version of this Privacy Policy does not retroactively change the legal basis of earlier processing.
28. Languages
The Dutch version is the source text maintained by Art-Fixed. English and Russian versions are provided to make the information more accessible. In the event of differences in wording, the Dutch version reflects the interpretation intended by Art-Fixed, without affecting any mandatory rights applicable to you.
29. Related information and contact
For any questions about this Privacy Policy or the processing of your personal data, contact info@art-fixed.nl.
