Legal
Privacy statement
Which data we keep, why, for how long, and who can access it.
This is an English convenience translation. The Dutch version is the legally binding text and prevails if there is any difference. Read the Dutch version.
Version 1.0. Last updated: 23 October 2026.
1. Who is responsible?
Klappe Hosting is a service of Klappe Development, located at Boersenserf 10, 3871 RK Hoevelaken. Dutch Chamber of Commerce (KvK) number: 71434577. VAT number: NL002415101B21. We are responsible for the processing of the personal data described in this statement. You can ask questions about privacy via [email protected] or via WhatsApp. We have not appointed a data protection officer (DPO), because the law does not require us to.
2. Controller or processor?
That depends on the data.
- We decide ourselves about your own data as a customer (order, contact, invoicing). For that data we are the controller. This is what this statement describes.
- On your hosting plan you yourself place data of other people, such as visitors to your website, customers in your web shop or people who email you. You decide about that data. You are then the controller and we are the processor. For that we have a data processing agreement.
3. Which data do we process, why and on what legal basis?
Every processing operation has a purpose and a legal basis under Article 6 of the General Data Protection Regulation (GDPR).
| Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|
| Order form: name, company name, email address, phone number, billing address (street and house number, postcode, city, country), optionally Dutch Chamber of Commerce (KvK) number and VAT number, domain name, type of website, for an existing site your current hosting provider and the number of months you are still tied to it (for the switch deal (Overstapdeal)), chosen plan and add-ons | Assessing, confirming and carrying out your order, preparing your invoice and applying the switch deal | Performance of the contract, or steps prior to entering into it at your request (paragraph 1 point b) |
| Order form: a hashed version of your IP address and your browser type (user agent), plus the result of Cloudflare Turnstile | Preventing spam and misuse of the form | Legitimate interest (paragraph 1 point f): protecting our form and our servers |
| Contact: what you send us via WhatsApp or email, with your name and phone number or email address | Answering your questions, resolving incidents, carrying out work you ask for | Performance of the contract (point b), or legitimate interest in answering a question from a future customer (point f) |
| My account: email address for the login link and the details of your subscription (plan, add-ons, period, status). We never show passwords | Letting you manage your subscription yourself, cancel it and change payment details | Performance of the contract (point b) |
| Invoicing: name, address, email address, IBAN and account holder name, SEPA direct debit mandate, invoice and payment data | Invoicing, collecting payment, bookkeeping | Performance of the contract (point b) and legal obligation (point c), such as the statutory tax retention obligation |
| Account and use: login details of your hosting panel, technical log files of servers and email (such as IP address, time, error messages) | Providing and securing the service, detecting incidents and misuse | Performance of the contract (point b) and legitimate interest in security (point f) |
| Messages about your service: emails about your order, invoices, maintenance or incidents | Informing you about the service you use | Performance of the contract (point b) |
| Administration: data we are required to keep for tax and bookkeeping | Complying with the law | Legal obligation (point c) |
We do not use your data for advertising, we do not sell it and we do not build profiles. There is no automated decision-making with legal consequences for you.
If you give us data of other people, such as a colleague we may call about your order, make sure that person knows.
4. How long do we keep data?
We do not keep data longer than needed for the purpose.
| Data | Retention period |
|---|---|
| Order that does not lead to a contract | At most 12 months after the request |
| Customer data (contact, account) | As long as the contract runs, and after that until the end of the 30-day export period |
| Hosting data (files, databases, email) | Up to 30 days after the end of the contract, then deleted. Backups then disappear according to their own cycle, at the latest 90 days later |
| Invoices and payment data | 7 years (statutory tax retention obligation) |
| Conversations via WhatsApp or email | As long as the contract runs, and after that at most 12 months, unless a dispute or legal obligation requires keeping them longer |
| Technical log files | At most 90 days, unless needed for the investigation of an incident |
| Hashed IP address and browser type from the order form | At most 12 months |
5. Who helps us (processors)?
For our service we engage parties who process data on our behalf. We have made data protection agreements with them.
- Contabo: servers for your hosting, in data centres in the EU.
- Cloudflare: DNS, email forwarding (Email Routing), CDN, protection of your website, our own website and the database with orders (Workers and D1), and Turnstile on the order form.
- MXroute: mailboxes.
- Moneybird: invoicing and administration.
- Emailit: sending email that our systems send, such as messages about your order.
- Meta (WhatsApp): the chat through which you reach us and through which we help you. Our helpdesk (Balie) is a system of Klappe Development itself in which we keep track of conversations.
- A provider of storage for encrypted backups outside the server.
The current list, with the data each of them processes, is in the data processing agreement. We may also share your data if a law or a court requires it.
6. Transfers outside the EU
We keep data within the European Economic Area as much as possible. A few parties are an exception because they are (also) established or operate outside the EU:
- Meta (WhatsApp) and Cloudflare are US companies. MXroute (mailboxes) and Emailit (email from our systems) may also operate in the US, depending on the server or sending route. As a result, data may end up in the United States or be accessible from the US.
- As safeguards, the EU-US Data Privacy Framework applies (to the extent the party is certified for it) and, in addition, the standard contractual clauses of the European Commission. Where necessary, the parties take extra measures, such as encryption in transit.
If you would like a copy of the safeguards, ask us.
7. A note on WhatsApp
Help via WhatsApp is a core part of our service. When you message us, WhatsApp (Meta) sees at least your phone number and metadata, such as time and device. The messages themselves are end-to-end encrypted. Meta's privacy policy applies to WhatsApp, and we have no influence over it. We keep the conversations we need to help you. Do not send us passwords, bank details or data of third parties that we do not need via WhatsApp. If you prefer not to use WhatsApp, you can email us.
8. Cookies
This website does not use tracking, analytics or advertising cookies. We do not track you and we do not use Google Analytics or similar services. On the homepage we ask Cloudflare for an estimate of your location based on your IP address, to adjust a heading on the page. We do not store that location. On the order page and when requesting a login link we load Cloudflare Turnstile (invisible, unless a check is needed) to prevent spam. For that purpose Turnstile may read technical data from your browser and place a cookie or similar storage in your browser. This is needed for the security of the form and falls under the exception for strictly necessary functionality. That is why we do not ask for consent for it. On other pages we do not load Turnstile.
9. Security
We protect your data with appropriate measures. Think of encrypted connections (TLS), restricted access to servers, two-step verification where possible, regular updates and backups at a separate location. If there is nevertheless a personal data breach that poses a risk to you, we report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and, if the risk is high, to you as well.
10. Your rights
You have the following rights:
- Access to the data we hold about you.
- Rectification: having incorrect data corrected.
- Erasure, if we no longer need the data or are no longer allowed to keep it.
- Restriction of processing, for example while we look at an objection.
- Data portability: receiving your data in a commonly used format or having it transferred.
- Objection to processing based on our legitimate interest.
- Withdrawing consent, if a processing operation is based on your consent. This does not affect what happened before.
Send us a message via [email protected] or via WhatsApp (Monday to Sunday, 9:00 to 21:00). We may ask you to confirm your identity. We respond within a month. If your request is complex, we may extend that period by up to two months and we will let you know. A request is free of charge, unless it is manifestly unfounded or excessive.
If your request concerns data on the website of one of our customers (for example a web shop), please contact that customer. We are happy to refer you and help our customer with their answer.
11. Lodging a complaint
If we cannot work it out together, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): autoriteitpersoonsgegevens.nl. We would prefer to hear from you first, so that we can resolve it.
12. Changes
We may amend this statement, for example when we engage a new processor. The date at the top shows when it was last updated. In the case of important changes we inform our customers directly.