Last updated: September 2026
Who we are
Skuridat is responsible (the “controller”) for the personal data described on this page.
Skuridat
Hekelsteeg 4
3511 AK Utrecht, the Netherlands
Chamber of Commerce (KVK) 95966099
Questions about privacy go to [email protected]. We haven’t appointed a data protection officer; the founders handle privacy requests themselves.
What we collect and why
When you request an exposure assessment
The form asks for your work email, your company domain, your name and role, and optionally what brought you here. We use these details to reply, set up the scoping call, and run the assessment you asked for.
Your request is stored as a private record on our website and emailed to the founders. We process it because you asked us to take steps before a possible agreement (GDPR Article 6(1)(b)).
When we run the assessment
We work from the outside in, starting from the domain you give us. We don’t install anything and we don’t ask for credentials. What we find is information that is already publicly reachable, and some of it can be personal data, such as names and work email addresses tied to your domain.
We use it only to produce your report. It’s processed on EU infrastructure and deleted 30 days after we deliver the report. Once you’re a client, the data processing terms in your contract govern this work and take precedence over this page.
When you ask for a paper
The form on Resources asks for your name and email address. We use them to email you the paper. We don’t add you to a mailing list. If we ever start one, we’ll ask you separately.
When you request a callback
The callback form asks for your name and phone number, and optionally a preferred day, time and a short note. We use these details only to call you back about your request. This is stored as a private record on our website and emailed to the founders. The basis is our legitimate interest in answering a request you initiated (Article 6(1)(f)), and your explicit consent, which the form asks for separately.
When you email us
We keep your message and contact details for as long as the conversation needs, and after that under the retention periods below. The basis is our legitimate interest in answering you (Article 6(1)(f)).
When you visit the site
Our hosting provider logs each request: IP address, time, page requested, and browser details. These logs are used to keep the site secure and to find faults, and nothing else. The basis is our legitimate interest in running a secure site (Article 6(1)(f)). Access logs, server logs and security logs are kept at mijn.host for a maximum of 12 months.
Analytics
We use Google Analytics to see which pages get read and how people find the site. It records things like the pages you visit, how long you stay, the site or search engine you arrived from, and general location and device information. We use it to understand and improve the site, not to identify you personally.
Because we use the standard configuration rather than the Autoriteit Persoonsgegevens’ privacy-friendly settings, Analytics only runs once you’ve given consent. A consent banner (Cookiebot) asks for that consent before any Analytics cookie is set, and blocks Analytics entirely if you decline. See “Cookies” below for what that means for your browser.
Cookies
If you consent, Google Analytics sets cookies in your browser to recognize repeat visits and tell them apart from each other; see “Analytics” above. If you decline or don’t respond to the consent banner, no Analytics cookies are set. Beyond that, this site sets no cookies for visitors: no advertising or social media pixels, and no embedded videos, maps or feeds. Our fonts are served from our own server, not from Google or any other provider.
Cookiebot, the consent tool itself, sets one small cookie to remember your choice so it doesn’t ask again on every page. That cookie is set whether you accept or decline Analytics.
The only other cookies on this site are WordPress login cookies for the people who edit it. Visitors never receive them.
The links to LinkedIn, X and Instagram in the footer are plain links. Nothing from those platforms loads until you click through, and after that their own privacy policies apply.
If we add a cookie beyond what is described here, we’ll update this page first and ask for your consent before setting it, where consent is required.
Who else sees your data
We don’t sell personal data, and we don’t share it with advertisers. We use these processors, each under a data processing agreement:
- mijn.host, the Netherlands: website hosting
- Google Ireland Limited: web analytics (Google Analytics)
- Brevo SAS, France: email delivery and hosting for the assessment platform
Beyond that, we share personal data only when the law requires it, or with our accountant and legal advisers where they need it to do their job.
Transfers outside the EU
Google Analytics is operated by Google Ireland Limited, an EU company, but Google is a US-headquartered group and analytics data can be processed on servers outside the EU. Google’s standard contractual terms, based on the European Commission’s Standard Contractual Clauses, cover that transfer.
We know this sits awkwardly next to our argument for a European stack. It’s a current choice, not a principle, and if we move to an EU-based or self-hosted analytics tool this page will say so.
How long we keep it
- Assessment findings: deleted 30 days after we deliver the report.
- Request, callback and paper-form details: 12 months after our last contact, unless you become a client.
- Client contracts and invoices: seven years, as Dutch tax law requires.
- Email: as long as the conversation needs, then under the periods above.
- Server logs: see the hosting note above.
- Analytics data: Analytics data: 14 months, Google Analytics’ default retention period, after which Google deletes it automatically.
Your rights
Under the GDPR you can ask us to:
- show you the personal data we hold about you
- correct it
- delete it
- restrict how we use it
- give it to you, or to someone else, in a common machine-readable format
- stop processing it where we rely on legitimate interest
Where we rely on your consent, you can withdraw it at any time. That doesn’t affect what we did before you withdrew.
Email [email protected]. We may ask you to confirm your identity, and we answer within one month. It costs nothing.
If you think we’ve handled your data wrongly, tell us first so we can put it right. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or the authority in the EU country where you live.
We make no decisions about you by automated means alone.
Security
We protect personal data with the same controls we recommend to our clients: encryption in transit, access limited to the people who need it, and deletion on the schedule above. If you find a weakness in our systems, our responsible disclosure policy explains how to report it.
Changes to this page
When we change how we handle personal data, we update this page and the date at the top. If a change affects data you’ve already given us, we’ll tell you directly.