Privacy policy

Digital Front is the data controller for the personal data collected through our websites and services, as defined under the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Dutch GDPR Implementation Act (Uitvoeringswet AVG, "UAVG").

We have not appointed a Data Protection Officer. For all privacy-related questions, you can contact us at info@digitalfront.nl.

We collect personal data only when there is a clear purpose and legal basis for doing so. Here is exactly what we collect, and through which channel:

We use the data we collect for the following specific purposes:

• •Contact form submissions — to respond to your inquiry, provide a quote, or follow up about the service you are interested in.
• •Chat messages — to provide real-time assistance and answer your questions through the AI assistant.
• •Booking data — to schedule and manage meetings with you.
• •Cookie consent — to remember and respect your cookie choices across visits.
• •Theme preference — to display the site in your preferred visual mode.
• •Pseudonymous analytics — to understand how our site is used and to improve its performance.
• •Error tracking — to identify, diagnose, and fix technical problems on the website.

We do not use your data for automated decision-making or profiling. We do not sell your personal data to anyone.

Under Article 6 of the GDPR, we process personal data only when we have a valid legal basis:

We use the following third-party services to operate our website. Where required, we have data processing agreements in place.

Where personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, primarily through EU Standard Contractual Clauses (SCCs).

We do not keep your data longer than necessary:

• •Contact form submissions — not stored server-side; data exists only in the resulting emails. These emails are retained for the duration of the sales cycle or project, and up to 2 years after the inquiry is closed, to handle follow-up questions and potential projects. After that period, emails are deleted or anonymised, unless statutory retention obligations (e.g. Dutch tax law) require longer storage.
• •Chat sessions and messages — 30 days (auto-deleted via Redis TTL).
• •Cookie consent preference — 1 year (cookie expiry).
• •Consent audit log — 5 years (per Article 7(1) GDPR and Dutch DPA guidance).
• •Chat feedback (individual) — 90 days.
• •Chat feedback (aggregates) — 1 year.
• •Error tracking data — 90 days (Sentry default).
• •Rate limiting data — seconds to minutes (sliding window, auto-expiry).

If you request erasure before a retention period ends, we will delete your data promptly.

Under the GDPR and the Dutch UAVG, you have the following rights:

• •Right of access — request a copy of all personal data we hold about you.
• •Right to rectification — ask us to correct inaccurate or incomplete data.
• •Right to erasure — ask us to delete your personal data.
• •Right to restriction — ask us to temporarily stop processing your data.
• •Right to data portability — receive your data in a machine-readable format.
• •Right to object — object to processing based on legitimate interest at any time.
• •Right to withdraw consent — withdraw consent at any time without affecting prior processing.

To exercise your rights, send a request to info@digitalfront.nl. We will respond within one month.

If you believe we are not handling your data correctly, you have the right to lodge a complaint with the Dutch Data Protection Authority:

Our website uses a limited number of cookies. The df_consent cookie, which stores your cookie preference, is strictly necessary for the site to function and is set without requiring consent, as permitted under the ePrivacy Directive (Article 5(3)). All other cookies are only placed after you grant consent via the cookie banner. For full details about the specific cookies we use, their purposes, and how to manage them, please refer to our Cookie Policy page.

We take appropriate technical and organizational measures to protect your personal data. No security measure is completely infallible, and we continuously review and improve our safeguards based on incidents, audits, and evolving best practices.

• •All data in transit is encrypted using HTTPS (TLS).
• •Content Security Policy headers prevent cross-site scripting and code injection.
• •All form inputs and API endpoints validate and sanitize data.
• •API routes are protected by rate limiting to prevent abuse.
• •We collect only the data necessary for each stated purpose.
• •Chat sessions and rate limiting data auto-expire via TTL settings.
• •Admin access is protected by OAuth and restricted to authorized team members.

Our website and services are not directed at children. In accordance with the Dutch implementation of the GDPR (UAVG), we do not knowingly collect personal data from children under the age of 16 without verifiable parental consent. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at info@digitalfront.nl.

Providing personal data is not a legal requirement. However, some data is necessary for us to deliver specific services:

• •If you do not provide your name and email via the contact form, we cannot respond to your inquiry.
• •If you do not provide your name and email via the booking calendar, we cannot schedule a meeting with you.
• •If you do not send messages in the chat widget, the AI assistant cannot help you. You can use the chat without providing any identifying information.
• •You can browse our website without providing any personal data. Analytics and error tracking are only active if you consent to cookies.

We may update this privacy policy from time to time. When we make changes, we will update the "Last updated" date at the top. For significant changes, we will place a prominent notice on our website.

If you have any questions or requests regarding this privacy policy, please contact us at info@digitalfront.nl. We aim to resolve any concerns directly. If you are not satisfied with our response, you have the right to lodge a complaint with the Autoriteit Persoonsgegevens.

This privacy policy is governed by the General Data Protection Regulation (EU) 2016/679 and the Dutch Uitvoeringswet Algemene verordening gegevensbescherming (UAVG).