Privacy notice
This notice describes how personal data is processed for QUICKSCAN as the service is currently operated. This is a draft version: it is not effective until it has been approved and published by the controller.
1. Controller
The controller of your personal data is Cees Visser Consulting, Kloosplantsoen 317, 2985 SJ Ridderkerk, Nederland (KvK 90590147). QUICKSCAN is a service of Cees Visser Consulting, so the same organisation is the contracting party and the controller. Contact: ceesvisserconsulting@gmail.com.
2. Data we process
- Organisation name and the e-mail address you enter when starting an assessment.
- Your answers to the questionnaire, including any optional free-text fields.
- The generated result: score, category scores, findings and the report (HTML and PDF).
- The selected plan, the assessment reference and the assessment status.
- Payment status and Stripe identifiers (checkout session, payment status, amount and currency). Card details are handled by Stripe and never reach this application.
- Limited technical information needed to operate and secure the service, such as error events, timestamps and the network address used for a request.
Do not enter special-category personal data (for example health, religion or biometric data), confidential client information or personal data about other people that is not necessary for the assessment.
3. Purposes and legal bases
- Providing the assessment and report — performance of the contract with you (art. 6(1)(b) GDPR).
- Payments, bookkeeping and financial administration — performance of the contract and compliance with statutory retention obligations (art. 6(1)(b) and 6(1)(c) GDPR).
- Security, abuse prevention and service continuity — legitimate interests of the controller (art. 6(1)(f) GDPR), limited to what is necessary for that purpose.
- Handling questions, complaints and rights requests — performance of the contract or a legal obligation, depending on the request.
No personal data is used for automated decision-making with legal effect, profiling, analytics or marketing.
4. Recipients and providers
Personal data is processed by the following service providers, each for its own part of the service:
- Hostinger — hosting of the application.
- Supabase — PostgreSQL database in which assessments and payment status are stored.
- Stripe — payment processing; only active once checkout is configured. Stripe is an independent controller for its own payment services.
- Google Fonts and cdnjs (Cloudflare) — web fonts and the PDF library are loaded from these public content networks, so your network address is transmitted to them when a page loads.
Financial and administrative records are included in the business administration of Cees Visser Consulting. No separate bookkeeping, CRM or customer portal is used, and personal data is not sold or shared for advertising.
5. Retention
We retain personal data only as long as necessary for the purposes above. Automated deletion is not yet implemented: records are reviewed against the periods below and deleted when a deletion request is received or when the period has passed.
- Organisation name and contact details: 7 years after the last activity, as part of the financial administration.
- Assessment answers and generated reports: 5 years after the last submission or report generation.
- Payment and financial records: 7 years after the payment, for the statutory retention of financial records.
- Technical logs: 6 months; security logs: 24 months.
6. International transfers and safeguards
Processor agreements and transfer safeguards must be confirmed for each provider; this section is updated when that verification is complete. For Google Fonts and cdnjs, the transfer consists of the network address that is technically required to load the resource. If a provider processes data outside the European Economic Area, a transfer mechanism under Chapter V GDPR applies.
7. Your rights
Subject to applicable law, you may have the right to access, rectify, erase, restrict or object to processing, and to data portability where applicable. To exercise these rights, contact ceesvisserconsulting@gmail.com and quote the assessment reference from your report link. Requests are handled manually; there is no self-service export or deletion function in the service. You may also lodge a complaint with the competent supervisory authority (Autoriteit Persoonsgegevens).
8. Security and cookies
Technical and organisational safeguards are implemented to protect your data, including transport encryption, access restrictions on the database and separation between payment data and assessment content. The website sets no cookies; browser session storage is used only to remember the selected currency. No analytics, marketing or tracking tools are used. The current inventory is documented in the cookie statement.
9. Changes and version
Notice version: draft dated 5 November 2026. Not effective until approved and published by the controller. Material changes are published on this page with a new version date.