Last updated: 23 October 2026
SecureHabits (KVK 78029260, VAT NL003278436B94, Willemspoort 102, Den Bosch, 5223WV Netherlands) is
the controller for personal data processed through this website. We sell training and advisory
services to companies; we do not sell personal data, build advertising profiles, or make automated
decisions about you. Questions and requests: [email protected].
What we process, and why
- Requests you send us. When you book a call, submit a quote request, use the chat, or email us,
we receive the details you provide (name, work email, phone, company, your message). We use them to
answer you and to prepare the engagement you asked about (legal basis: taking steps prior to a
contract, or our legitimate interest in responding). Booking, forms, chat, and our CRM (Zoho CRM)
run on Zoho, hosted in Zoho’s EU data centers, acting as our processor.
- EU CRA Self Assessment. Your answers and scores stay in your browser (session storage, cleared
when you close the tab), and the PDF report is created there too; we never receive them. When you
click “Download the PDF”, we receive only the contact details you enter (name, company, role, work
email) and store them in our CRM (Zoho CRM). We use them to follow up on your report, for example
to offer to go through the results with you (legal basis: our legitimate interest in responding to
a business inquiry). We do not add you to a newsletter or mailing list on this basis.
- Technical logs. The site is static and served from Scaleway (Amsterdam, EU). Serving requests
produces short-lived infrastructure logs (IP address, requested URL, user agent) used for security
and operations (legitimate interest).
- Analytics, only with consent. If you choose “Accept all” in the cookie banner, we load Zoho
PageSense to understand how the site is used (pages visited, interactions, heatmaps and anonymized
session recordings). Nothing loads if you pick “Essential only”, and you can change your mind at any
time via the cookie settings link in the footer (legal basis: consent). PageSense does not run on the
EU CRA Self Assessment page, so your answers and score are never recorded.
- Embedded videos. Videos are click-to-load through YouTube’s privacy-enhanced domain; YouTube
sets cookies only after you press play.
Recipients and transfers
We share personal data only with the processors named above (Zoho and Scaleway). Both process
your data in the EU.
Retention
Inquiries and chat transcripts are kept while we are in contact and deleted when no longer needed.
Contact details from the EU CRA Self Assessment are deleted 24 months after our last contact with
you, unless they become part of an engagement. Records that become part of a contract (quotes,
invoices) follow Dutch bookkeeping retention (seven years). Analytics data follows Zoho
PageSense’s retention settings.
Your rights
Under the GDPR you can request access, correction, deletion, restriction, portability, and object to
processing based on legitimate interest; where processing rests on consent you can withdraw it at any
time without affecting earlier processing. Write to
[email protected]; we respond within one month. You can also lodge a
complaint with the Dutch supervisory authority, the
Autoriteit Persoonsgegevens.
