Skip to content
DataDream

Privacy Policy

DataDream, based in Middelburg, is responsible for the processing of personal data as described in this privacy statement. Last updated: 5 August 2026.

Contact details

DataDream
Middelburg, Zeeland (no fixed visiting address, service-area model)
info@datadream.nl
+31 85 124 95 22
CoC: 76220540

Personal data we process

DataDream processes the following categories of personal data:

  • Contact form (/contact): name, email address, phone number, company name and the content of your message.
  • AI Scan (/ai-scan): website URL you submit, optional competitor URL, your email address. The submitted URL is fetched and analysed; we store the URL and the resulting analysis.
  • Cal.com bookings: name, email and any details you provide when scheduling a call. Cal.com is the controller for the data you enter on its booking page; we receive the booking details from Cal.com.
  • AI Act check (/ai-act-checker): your answers to the questionnaire and your email address, so we can send you the report.
  • Telephone AI assistant: if you call the number the AI assistant answers, we process your phone number, the conversation transcript and a summary. You are told at the start of the call that you are speaking to an AI assistant. If you would rather not, you can end the call and email us or use the contact form instead.
  • Server logs: IP address, user-agent and timing data are processed by our hosting provider to deliver the site, mitigate abuse and rate-limit the contact form.
  • AI crawler logging: request metadata from automated visitors, so we can see how AI search systems read the site.
  • Cookies and analytics: only after you grant consent in the cookie banner. See /cookies for the full list.

Data that does not come from you

Sometimes DataDream processes data about you that you did not submit yourself. This happens in one case, and Article 14 GDPR requires us to tell you about it actively. That is why it sits here in the open rather than buried in a list.

  • What data: company name, domain name, business email address, phone number, LinkedIn profile, business address and the name of a contact person.
  • Where it comes from: the company’s own website, public sources, and the data from an AI Scan run on that domain without an email address being left behind.
  • What for: to judge whether a targeted, relevant proposal makes sense, and to send that proposal. Nothing is resold and no profiles are shared with third parties.
  • Legal basis: legitimate interest (Article 6(1)(f) GDPR), namely approaching business contacts about a service that demonstrably fits their situation. The balancing test between that interest and your privacy is documented and available on request.
  • How long: up to 2 years after the last contact, then deleted automatically.
  • Objecting: you can object to this processing at any time, without giving a reason, via info@datadream.nl. We will then delete your data and stop contacting you. That is a right, not a favour (Article 21 GDPR).

Purposes and legal bases

  • Replying to enquiries, sending quotes and delivering services: performance of a contract or legitimate interest (Article 6(1)(b)/(f) GDPR).
  • Generating an AI Scan report: performance of a service you requested (Article 6(1)(b) GDPR).
  • Handling phone calls through the AI assistant: legitimate interest (Article 6(1)(f) GDPR), namely being reachable outside office hours.
  • Approaching business contacts with a targeted proposal: legitimate interest (Article 6(1)(f) GDPR). See “Data that does not come from you” above.
  • Operating the site, security and abuse prevention: legitimate interest (Article 6(1)(f) GDPR).
  • Analytics, advertising and conversion tracking: your consent (Article 6(1)(a) GDPR), withdrawable at any time via the cookie settings.
  • Legal obligations (e.g. invoicing, tax retention): Article 6(1)(c) GDPR.

Data processors and recipients

We use the following processors and infrastructure providers. Each is engaged under a Data Processing Agreement (DPA) where applicable:

  • Vercel Inc.: hosting and serverless functions for datadream.nl. Primary processing region: Frankfurt (fra1, EU). DPA: vercel.com/legal/dpa.
  • Upstash (Vercel Marketplace): short-term key-value storage for AI Scan session state.
  • Vercel BotID: invisible bot detection on the contact form (powered by Kasada). Processes request signals to classify automated traffic.
  • ProtonMail (Proton AG, Switzerland): inbound mail for info@datadream.nl. Switzerland is recognised as having an adequate level of protection by the European Commission.
  • Resend, Inc.: transactional email delivery for contact-form replies and AI Scan reports.
  • Anthropic PBC: generates portions of AI Scan reports. We send the URL and the analysis prompt; Anthropic does not train on data submitted via the API.
  • Google LLC (Gemini API): performs grounded web research for AI Scan reports.
  • Cal.com, Inc.: scheduling and booking flow when you click “Book a call”.
  • ElevenLabs, Inc.: speech recognition, speech synthesis and transcripts for the telephone AI assistant.
  • Telnyx LLC: telephony and SMS for the telephone AI assistant.
  • Google LLC: Google Tag Manager, Google Analytics 4 and Google Ads conversion tracking, only after consent.
  • Meta Platforms Ireland Ltd. and LinkedIn Ireland Unlimited Company: advertising pixels, only after consent.
  • Ahrefs Pte. Ltd.: privacy-friendly visitor analytics, only after consent.

Where processors are based outside the EEA (e.g. Anthropic, Google, Meta, LinkedIn, Resend, Cal.com, Ahrefs), data transfers are protected by EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework where applicable.

Retention

Contact-form messages: up to 2 years after our last contact, or longer if needed for project documentation. AI Scan submissions and reports: up to 2 years. AI Act check: up to 2 years. Data from the source described under “Data that does not come from you”: up to 2 years after the last contact. Phone calls with the AI assistant: no audio is recorded, and the transcript is deleted at the speech provider after 30 days. Server logs: typically 30 days. Invoicing data: 7 years (Dutch tax law).

For leads, AI Scan submissions, AI Act check answers and the data from the source above, these periods are enforced technically rather than merely promised: storage deletes expired data automatically. A transcript that reaches DataDream by email is additionally covered by the mail retention period above.

Cookies

DataDream uses Google Consent Mode v2: analytics and advertising cookies are denied by default and only activated after you give explicit consent in the cookie banner. Technically necessary cookies (language preference, session, security) are placed without tracking personal behaviour. You can change your choice at any time via the cookie settings at the bottom of the site. The full inventory is on /cookies.

Your rights

You have the right to access, correct, delete or restrict the processing of your personal data, the right to object, and the right to data portability. You may withdraw any consent at any time. Send your request to info@datadream.nl. We respond within 30 days.

If you believe we are not handling your personal data correctly, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

Security

DataDream takes the protection of your data seriously. The site is served exclusively over HTTPS with HSTS, a strict Content Security Policy, X-Frame-Options DENY and a Permissions-Policy that disables unused browser features. The contact form is protected by Vercel BotID (invisible bot detection), an origin allow-list, a honeypot field, IP-based rate limiting and length validation. Email authentication is enforced via SPF and DMARC (p=quarantine). We exclusively work with GDPR-compliant processors.

Changes

We may update this statement to reflect changes in our processing or in the law. The “last updated” date at the top reflects the latest revision.