Vuurwerk logo en woordbeeld

Privacy policy

Privacy policy

Last updated: 19 October 2026.

Who is responsible?

VUURWERK Branding, Storytelling en Marketing is responsible for personal data processed through vuur-werk.nl. Address: Boulevard Heuvelink 124, 6828 KW Arnhem, the Netherlands. For privacy questions and requests: info@vuur-werk.nl or +31 26 351 61 93.

Contact requests

When you use a contact form, we process your name, email address and any details you provide, such as a phone number, subject and message. Name and email address are required. Please do not submit sensitive information such as identification numbers or medical details.

We use these details to answer questions, arrange meetings or prepare a quotation or cooperation at your request. For steps towards a contract at your request, our legal basis is performance of a contract or pre-contractual steps. For other correspondence, it is our legitimate interest in responding properly to enquiries. Sending a contact request does not subscribe you to a newsletter.

Submissions are stored in WordPress and handled by email. New contact submissions from 19 October 2026 are kept in WordPress for six months. Older submissions are not included in this automatic deletion and are reviewed separately; you may also request their deletion. Mailbox correspondence is retained for handling and following up your enquiry. A different period may apply for a project, legal obligation or dispute. Relevant financial records are generally subject to a seven-year statutory retention period.

Website statistics

We currently run both Plausible and Umami on our own Hetzner server in Germany to compare statistics and improve the website. We no longer use Google Analytics, Google Tag Manager or WPMU/Matomo visitor tracking.

These tools use no cookies, browser storage, permanent visitor IDs or tracking across other websites. We do not send names, email addresses or form contents to them. They process visit data such as pages, referral sources, timestamps, approximate location, browser and device type. Technical details, including the IP address and browser information, are temporarily used to generate changing identifiers for counting visits. Raw IP addresses are not stored in the analytics databases. Umami respects Do Not Track and excludes URL query strings and fragments.

Where personal data is involved, our basis is our legitimate interest in understanding and improving the website with minimal data and without advertising profiles. Statistics remain available for comparison and trend analysis; no automatic deletion period is currently configured. Contact us if you object. Software information: Plausible and Umami.

Security, logs and backups

Hosting and security systems process technical data such as IP addresses, requested URLs, timestamps, browser information and error or security reports. This supports delivery, security and recovery of the website, based on our legitimate interest in preventing abuse and failures. Access is restricted to authorised administrators. We use HTTPS, access controls and backups. Technical logs and backups have their own rotation and storage limits; these are not necessarily the same as the contact submission retention period. Backups may temporarily retain previously stored information. WordPress email delivery logs are automatically retained for fourteen days.

External services and recipients

  • Hetzner: website, forms, self-hosted statistics and backups in Germany.
  • Resend and Microsoft 365: sending and receiving contact and system emails, including the details and message necessary to handle your request. Resend states a thirty-day retention period for email and log data on standard plans; this is separate from our mailbox and WordPress storage. See Resend and Microsoft.
  • hCaptcha by Intuition Machines: bot and spam protection on the Dutch contact form. It may process IP addresses, browser and device information and interactions such as mouse movements and time on the page, and may use security cookies. It loads on the page containing the protected form. Our basis is our legitimate interest in preventing abuse. Processing may take place in the United States. See hCaptcha. You can also email or telephone us directly.
  • Font Awesome: external delivery of icons and associated files, which involves technical connection data including IP address and browser information. Our basis is our legitimate interest in a functioning and recognisable website. See Font Awesome.
  • OpenStreetMap: maps on contact pages. Loading a map sends technical data, including IP address and requested tiles, to the map provider. Our basis is our legitimate interest in showing our location. See OpenStreetMap Foundation.
  • WPMU DEV: technical management, updates and security. Its separate WPMU/Matomo visitor analytics have been disabled.

We do not sell personal data. Data is shared for the services above, with authorised administrators or where legally required. Self-hosted statistics stay on our server; email, security and external file providers may process information outside the European Economic Area. Applicable transfer arrangements, such as adequacy decisions or standard contractual clauses, are relevant to those services; see the providers’ privacy information. This does not mean that all website-related data is processed exclusively in the EU.

Cookies and external links

Functional and security cookies may support language preferences, administrator logins or spam protection. Plausible and Umami do not use analytics cookies. See our cookie policy. Social icons in the footer are links; the destination service’s policy also applies after you follow a link.

Your rights

You may request access, correction, deletion or restriction of personal data. You may object to processing based on legitimate interests. Where applicable, you have a right to data portability and may withdraw previously given consent, without affecting earlier lawful processing. Email info@vuur-werk.nl. We normally respond within one month; we will explain any extension needed for a complex request. We may request proportionate information to verify your identity.

You may complain to the Dutch Data Protection Authority. This policy concerns this website and may change when our practices or services change.