Privacy Statement
This English version is provided for convenience. In case of inconsistency, the Dutch version prevails.
Company details
| Item | Information |
|---|---|
| Trade name | Hartwich Risk & Resilience |
| Controller / contractor | Erik Hartwich, trading as Hartwich Risk & Resilience |
| Address | Tacitusstraat 4, 6135 HR Sittard, Nederland |
| Chamber of Commerce number | 76948773 |
| VAT identification number | NL003133490B55 |
| Website | hartwichrisk.com |
| erik@hartwichrisk.com |
1. Scope of this privacy statement
This privacy statement applies to the processing of personal data by Hartwich Risk & Resilience in connection with the website hartwichrisk.com, contact requests, business communication, quotations, agreements, service delivery, administration and relationship management.
HRR provides business-to-business advisory services. The website and services are not primarily aimed at children or consumers.
2. Personal data processed by HRR
HRR processes personal data only where necessary for business communication, service delivery and legal obligations. Depending on the situation, this may include:
- name, business contact details, organisation, role and preferred form of address;
- content of messages, contact forms, e-mails, meeting notes and business communication;
- quotation, contract, assignment, project and invoice information;
- payment and administrative data required for invoicing and accounting;
- documents and information provided by a client for analysis or advisory work;
- audio recordings, transcripts and summaries of meetings, but only where recording has been announced or agreed in advance;
- technical website data such as IP address, browser data, device category, pages visited and cookie data through Google Analytics and necessary website functionality.
HRR does not request special categories of personal data. Clients are asked not to provide unnecessary personal or sensitive data unless this is necessary for the assignment and has been discussed in advance.
3. Sources of personal data
- directly from you, for example by e-mail, contact form, meeting, quotation request or assignment;
- from the organisation you work for or represent;
- from documents, systems or information provided by a client for the performance of an assignment;
- through the website and Google Analytics when you visit hartwichrisk.com;
- through business interaction on platforms such as LinkedIn, Instagram or Google Business Profile, where you contact or respond through those platforms.
4. Purposes and legal bases
| Purpose | Examples of data | Legal basis |
|---|---|---|
| Contact and response to enquiries | Name, e-mail, message content | Legitimate interest or pre-contractual steps |
| Quotations and commercial follow-up | Name, organisation, role, business contact details, quotation data | Pre-contractual steps and legitimate interest |
| Performance of assignments | Client data, project information, documents, communication, notes, transcripts | Contract and legitimate interest |
| Invoicing and administration | Invoice data, payment data, correspondence, CoC/VAT data | Legal obligation and contract |
| Relationship management | Business contact details, previous communication, relevant client context | Legitimate interest |
| Website management and security | IP address, technical logs, browser and device data | Legitimate interest |
| Website analytics | Aggregated and analytical website data through Google Analytics | Legitimate interest for privacy-friendly analytics; consent where legally required |
| AI-assisted analysis and reporting | Submitted information, text, documents, transcripts, drafts | Contract and legitimate interest |
5. AI, transcription and meeting recordings
HRR may use professional AI-assisted tools for analysis, structuring, transcription, summarisation, drafting, quality control and reporting. AI is used as support. Professional judgement and final responsibility remain with HRR.
Meetings are recorded or transcribed only where this has been announced or agreed in advance. Recordings and transcripts may be used for minutes, analysis and quality assurance of the services.
HRR does not use fully automated decision-making that produces legal effects concerning individuals or similarly significantly affects them.
6. Recipients of personal data
HRR does not sell personal data. HRR shares personal data only where necessary for business operations, service delivery or legal obligations. Recipients may include:
- IT, hosting, website and cloud providers, including the website and CRM environment;
- Microsoft 365 and other business office, storage and communication services;
- Google Analytics for website analytics;
- professional AI, transcription and analysis tools where necessary for the assignment;
- bookkeeper, accountant, tax adviser, legal adviser or insurer;
- public authorities or regulators where HRR is legally obliged to do so;
- platforms such as LinkedIn, Instagram and Google for communications taking place through those platforms.
Where parties process personal data on behalf of HRR, HRR enters into appropriate arrangements where required, such as data processing agreements.
7. Transfers outside the EEA
HRR seeks to process personal data within the European Economic Area as much as possible. Some suppliers may process personal data outside the EEA. In that case, HRR relies on appropriate safeguards, such as an adequacy decision, EU Standard Contractual Clauses or other legally permitted safeguards.
8. Retention periods
| Category | Retention period |
|---|---|
| Contact requests and loose correspondence | Up to 24 months after the last substantive contact, unless earlier deletion is appropriate or a client relationship is established. |
| Quotations and commercial communication | Up to 3 years after the last contact, unless an agreement is entered into. |
| Client and project files | During the assignment and thereafter as reasonably necessary. Guideline: up to 5 years after completion, unless otherwise agreed. |
| Invoice and accounting data | 7 years due to Dutch tax retention obligations. |
| Meeting recordings | Up to 90 days, unless longer retention is necessary for the assignment or a dispute. |
| Transcripts and summaries | During the assignment and up to 12 months after completion, unless part of the project file. |
| Website and analytics data | As short as possible and, where configurable, up to 14 months for basic statistics. |
9. Security
HRR takes appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration and disclosure. Examples include access restriction, strong authentication where available, secure cloud environments, careful supplier selection and limiting data processing to what is necessary for the assignment.
10. Data subject rights
You have, where permitted by the GDPR, the right of access, rectification, erasure, restriction, portability and objection. You may also withdraw consent where processing is based on consent.
Requests can be sent to erik@hartwichrisk.com. HRR generally responds within one month. For complex or multiple requests, this period may be extended by up to two months. HRR may ask for additional information to verify your identity.
11. Complaints
If you have a complaint about the processing of personal data, please contact HRR first. You may also file a complaint with the Dutch Data Protection Authority.
12. Changes
HRR may amend this privacy statement when the services, tools, website or applicable rules change. The most recent version is available on hartwichrisk.com.