Privacy
Privacy statement
This statement explains which personal data Icatac B.V. ("ICATAC", "we") processes through the website icatac.com, why, on which legal basis, how long we keep it and which rights you have. It is written to meet the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).
Controller: Icatac B.V., the Netherlands (Dutch Chamber of Commerce (KVK) number 80942253).
You can reach us about privacy through the contact form on the homepage.
1. What this website does
icatac.com is an information website about our services. It has no user accounts, no comments, no newsletter, no online shop and no advertising or analytics tracking. The only place where you give us personal data is the contact form.
2. Contact form
Data: your name, e-mail address, the subject (optional) and the text of your message.
Purpose: answering your question, preparing a consultation or a quotation, and keeping a record of our correspondence.
Legal basis: taking steps at your request before entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Article 6(1)(f) GDPR).
What happens with it: the message is sent by e-mail to our business mailbox and handled by the person who answers you. Nothing from the form is stored in a database on the website.
Retention: we keep the correspondence for as long as it takes to handle your request and for a maximum of two years afterwards, unless a longer statutory retention period applies (for example for invoices and contracts) or you ask us to delete it earlier.
Providing this data is voluntary, but without a name, an e-mail address and a message we cannot answer you.
3. Protection against spam
To keep automated spam out of the form we use several measures:
- Cloudflare Turnstile, a service of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Turnstile checks in your browser that the sender is a human. For this, Cloudflare processes technical data such as your IP address, browser characteristics and interaction with the widget. Cloudflare acts as our processor; it is certified under the EU-US Data Privacy Framework and offers the EU standard contractual clauses for transfers. See the Cloudflare privacy policy. Legal basis: our legitimate interest in protecting the form against abuse (Article 6(1)(f) GDPR).
- Rate limiting: to limit the number of messages per hour, the website stores a one-way hash (HMAC) of your IP address for at most one hour. The hash cannot be reversed to your IP address and is deleted automatically.
- Counters: we count how many messages were accepted or refused. These counters contain no personal data.
4. Cookies
This website sets no cookies of its own and uses no analytics, advertising or social-media tracking. Cloudflare Turnstile may set a strictly necessary technical cookie that is needed only to perform the spam check. Because no non-essential cookies are used, no cookie consent banner is required.
5. Hosting and server logs
The website is hosted by Hostinger (Hostinger International Ltd., with servers in the European Union). As is usual, the web server keeps access logs containing your IP address, the time of the request, the page requested, your browser type and the referring page. These logs are used for security, troubleshooting and abuse prevention (Article 6(1)(f) GDPR) and are deleted automatically after a limited period. Connections to the website are encrypted (HTTPS).
6. Recipients
We share personal data only with the service providers named above (hosting and spam protection), who process it on our instructions under a data processing agreement, and with authorities where the law obliges us to. We do not sell personal data and we do not use it for profiling or automated decision-making.
7. Transfers outside the EU
Hosting takes place within the European Union. The spam check by Cloudflare may involve processing in the United States; this transfer is covered by Cloudflare's certification under the EU-US Data Privacy Framework and by the EU standard contractual clauses.
8. Your rights
Under the GDPR you have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on your consent, you may withdraw that consent at any time. To exercise a right, contact us through the contact form; we respond within one month. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work. In our country that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
9. Security
We protect personal data with appropriate technical and organisational measures: encrypted connections, access to the mailbox restricted to authorised persons, server-side validation of the form, and no storage of form data on the website itself.
10. Children
This website is not directed at children under 16. We do not knowingly collect data from them.
11. Changes
We may update this statement when the website or the law changes. The current version is always published on this page, with the date of the last update below.
Last updated: October 2026.