What we do withyour data.

Who we are

Gumoji B.V. runs this website and the products it describes. For anything you send us through this site, we are the controller in the sense of the GDPR.

Our registered details, including the Chamber of Commerce number and our address, are on the company details page. Questions about this policy go to privacy@gumoji.com; a person reads that mailbox.

What we collect

introduction to what we collect, supplied separately

• What you type into the contact form. Your name, company, email address, the topic and timing you pick, and whatever you write in the free-text field.
• Server logs. The IP address, the page requested, the time, and the browser’s user agent string. Every web server writes these; we keep ours briefly.
• Email you send us. If you write to hello@ or security@, we keep the thread for as long as the conversation is useful.

Why, and on what basis

We use the contact form data to reply to you and, if you become a customer, to set up the engagement. That is our legitimate interest in answering people who write to us, and, once there is a contract, the performance of that contract. Server logs exist to keep the site running and to notice abuse; that is also a legitimate interest, and a narrow one.

Everything runs in data centres in the European Union. Nothing you send through this site leaves the EU, and we don’t use processors that would move it.

How long we keep it

Data	Kept for	Then
Contact form submissions	12 months after the last message	Deleted
Server logs	30 days	Deleted, rotation is automatic
Email threads	While the conversation is useful, at most 24 months	Deleted
Customer records	For the duration of the contract plus the statutory 7 years	Archived for tax law, then deleted

Who else sees it

Our hosting provider stores the data on our behalf; it is provider name, under a data-processing agreement. Our email runs on provider name. We don’t sell, share or hand over your data to anyone else, unless the law compels us, in which case we’ll tell you if we’re allowed to.

Your rights

You can ask what we hold about you, have it corrected or deleted, ask us to stop processing it, or take it with you. Write to privacy@gumoji.com and we’ll answer within a month, as the GDPR requires, and usually a lot faster. If you’re not happy with the answer, the Dutch supervisory authority is the Autoriteit Persoonsgegevens.

Changes and contact

When this policy changes, the version and date at the top change with it, and the previous version stays available on request. The policy is written in English and Dutch; if the two ever disagree, the Dutch text is the one that counts.