1. Who is responsible?
Frenk Kester is the controller for personal data processed through frenkkester.com. For questions or requests about your data, email frenkkester@gmail.com. This notice covers this portfolio, not the separate websites and services of the projects described here.
2. When you get in touch
The contact form collects the name, email address and message you provide. Formspree processes the submission for delivery to my email address. Google (Gmail) processes my email correspondence. Formspree may also process technical information, such as your IP address and browser details, for delivery and spam and fraud prevention.
I use this information to reply and handle related correspondence. The legal basis is my legitimate interest in being reachable and responding to messages. If you request steps towards a possible agreement, the basis is taking those steps at your request. Your message is not used for a newsletter or advertising profile.
Getting in touch is voluntary. A name, email address and message are required to use the form; you can also email me directly. Share only what is needed for your enquiry and do not send identity documents, medical data or other sensitive information through the form.
3. Website visits and statistics
Render hosts and delivers the website. Technical request information, such as IP address, requested page and browser details, is processed to keep the site available and secure. My legal basis is the legitimate interest in operating a working, secure website.
Umami Cloud measures pageviews and actions such as opening projects, clicking contact or evidence links, requesting a CV and a submission accepted by Formspree. The purpose is to understand which parts of the portfolio are used and improve them. The basis for this limited analysis is the legitimate interest in understanding use of the site.
The site sends fixed page paths, language, any project name and action type. Only a limited selection of public referring domains is shared. Form contents, names, email addresses, query parameters and URL fragments are excluded. Umami processes IP address and browser details to calculate a session identifier using a monthly rotating salt. The IP address is not stored as a field in standard analytics records, but it may appear in operational or security logs. Reports can therefore show sessions and visitor statistics; cookieless does not mean anonymous. This analysis uses no tracking cookies, advertising profiles or session recordings.
You can object by disabling statistics on the cookies page. Do Not Track and Global Privacy Control also prevent loading and sending analytics. This does not affect your ability to use the site.
4. Providers and international processing
For the purposes above, data is processed by Render (hosting), Formspree (forms), Google/Gmail (email) and Umami (statistics). I do not sell your contact details. Disclosure may also be necessary to meet a legal obligation or handle a legal dispute.
Formspree states that it hosts its services in the United States. This portfolio’s Umami account is set to EU/Frankfurt. Providers and their subprocessors may also process data outside the European Economic Area, for example for support and infrastructure. An EU storage region does not mean all processing takes place exclusively in the EU.
Render, Formspree and Umami documentation describes European Commission standard contractual clauses for relevant international transfers. The sources below explain their processing and safeguards. You may also contact me for information about safeguards applicable to your data.
5. How long is data kept?
Contact messages are kept for as long as needed to resolve your enquiry and related follow-up correspondence. They are then deleted unless an ongoing agreement, legal obligation or specific dispute makes further retention necessary. This applies to the mailbox and the copy in Formspree; those copies need to be managed separately.
The configured retention period for statistics in Umami Cloud is six months. Technical information held by the hosting and form providers is subject to their retention policies and applicable account settings; security information may remain necessary to investigate abuse. Browser preferences have no configured expiry and remain until you clear them or your browser removes them.
6. Your rights
You may request access, correction or deletion of your personal data, restriction of processing and, where applicable, a portable copy. You may object on grounds relating to your situation to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.
Send your request to frenkkester@gmail.com. You will normally receive a response within one month. If a legally permitted extension is needed, I will explain this within that month. To avoid disclosing data to the wrong person, I may ask for appropriate additional information; do not send a copy of your identity document unsolicited.
You may complain to the Dutch Data Protection Authority or the supervisory authority in the EU country where you live or work. This portfolio does not make solely automated decisions about you with legal or similarly significant effects.
7. Links and changes
External websites, such as LinkedIn, GitHub and project websites, have their own privacy policies. An ordinary link opens that service only when you follow it. Social media figures in the projects are previously retrieved report figures; Metricool is not loaded as a visitor tracker for this purpose.
This notice will be updated when processing changes. The date above shows when the text was last updated.