Privacy Statement

Last updated: 9 October 2026

Who is responsible. Found Order Co. (Flavia Grattery), KvK 42062120, Leiden, the Netherlands, is responsible for the personal data described here. Contact: [email protected].

What I collect and why.

• Through the contact form: your name, email address, the service you're interested in, and the message you write (including any phone number you choose to add). I use it to reply to your inquiry and to arrange a consultation or session. The legal basis is taking steps at your request before entering into an agreement.
• When you visit this website or use the form: technical data such as your IP address, which my hosting provider and Cloudflare (which runs the bot check on the contact form) process to deliver the site, keep it secure, and protect the form from spam. The legal basis is my legitimate interest in running a secure website.
• When we work together: your address and the access details I need to work in your home, session and payment details, and the correspondence between us. I use it to carry out the agreement, to invoice you, and to meet tax and bookkeeping obligations. The legal bases are the agreement and a legal obligation.
• Photos: I take before-and-after photos only with your written permission, and I publish them only if you've agreed to that specifically.

What I don't do. I don't use analytics, advertising cookies, or tracking tools on this website, and I host the website's fonts myself instead of loading them from another company. I don't sell your data or use it for marketing without your consent.

Cookies. This site itself does not set any cookies, and I don't use cookies for analytics, advertising, or tracking. The contact form uses Cloudflare Turnstile to block bots. This check loads only when you start using the form, and it may then set the Cloudflare Turnstile cookie from challenges.cloudflare.com. That cookie is needed for the bot check to work, which the contact form requires before a message can be sent, and it protects the form from spam. I don't use it for anything else. You can delete it in your browser settings at any time, but the contact form may then not work.

Who receives your data. Only providers that help me run the business: Microsoft Azure (website hosting and the small function that forwards contact-form messages to me), Zoho Mail (my email), and Cloudflare (the bot check on the contact form, and management of the domain name), under agreements that protect your data. I share data with the tax authorities or others when the law requires it. Some of these providers are based in the United States or may process data outside the EU/EEA. As the controller of your data, I rely on the EU-US Data Privacy Framework where a provider is certified under it, and otherwise on standard contractual clauses.

How long I keep it. Inquiries that don't lead to an agreement are deleted after 12 months. Client and invoice records are kept for 7 years, the Dutch tax retention period.

Your rights. You can ask me to access, correct, or delete your data, to restrict or object to its use, or to receive a copy in portable form. Email [email protected] and I'll respond within one month. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

Security. I use reasonable measures to protect your data. Please note that the contact form and regular email are not secure channels, so keep early messages brief and share sensitive documents only once we've agreed how to exchange them.

Changes. I'll post updates here with a new date.