What this site does with your data.

This is my personal website. It is not a commercial offering of any company I am involved with. It exists to publish my writing, my podcast and a record of my work. The data practices below reflect that.

§ 01Who is responsible

The data controller for this website is Adriaan Ian van den Berg, a private individual resident in Warsaw, Poland. Questions, requests and complaints relating to this site go to adriaan@adriaanvandenberg.com.

Companies I co-own or co-founded (Cloudly Studio sp. z o.o., Braystone Consulting (Pty) Ltd, unComplex) have their own separate privacy policies for their own websites and services. This notice covers adriaanvandenberg.com only.

§ 02What I actually collect

I have tried to keep the surface area very small. The only personal data this website processes is what you choose to send me:

• Contact form submissions. If you send me a message through the form on the contact section, I receive your name, email address, optional company name and your message. Submissions are handled by Netlify Forms (Netlify, Inc., USA, acting as a data processor) and forwarded to my personal mailbox at OVH (France).
• Newsletter sign-ups. The "Subscribe" form on the hero hands you off to Substack. Substack becomes the data controller for anything you submit on their platform. I see your email address as a subscriber to my publication.
• Direct email. If you email me at any of my addresses, I keep that correspondence as long as it is reasonable to do so under Polish bookkeeping and limitation periods.

I do not run a CRM here. I do not sell anything from this domain. I do not enrich, score or transfer your contact details to third parties for marketing.

§ 03Analytics: Umami, cookie-free

To understand whether anyone is actually reading the site, I use Umami, a privacy-focused analytics tool. Umami does not use cookies, does not store IP addresses in a re-identifiable way, and does not build cross-site profiles. It counts anonymous page views, referrer and approximate device class.

Umami loads on every page by default. There is nothing to consent to and nothing to opt out of in a meaningful sense, because there is no identifier tied to you. If you want to block it anyway, any standard content blocker (uBlock Origin, Privacy Badger, your browser's built-in tracker blocking) will stop the script from loading and the site will be unaffected.

I do not use Google Analytics, Meta Pixel, LinkedIn Insight Tag, Hotjar or any other third-party tracker on this domain.

§ 04Legal basis (GDPR, Article 6)

• Contact form, email, newsletter: your consent, given by submitting the form or writing to me. Article 6(1)(a) GDPR.
• Replying to you and keeping records of the correspondence: legitimate interest in running my own professional life and meeting Polish tax and bookkeeping obligations. Article 6(1)(f) and 6(1)(c) GDPR.
• Analytics: legitimate interest in understanding aggregate, anonymous traffic to my own site. Article 6(1)(f) GDPR. Umami stores no cookies and no identifiers tied to you, which is why no consent gate is required under the ePrivacy Directive either.

§ 05Your rights

Because I process your data in the European Union, you have the rights granted by the GDPR. Specifically, you can ask me to:

• show you what data I hold about you and give you a copy;
• correct anything that is wrong;
• erase your data (subject to legal retention obligations);
• restrict processing while a dispute is sorted out;
• receive your data in a portable format, where it is technically possible;
• withdraw consent at any time, with effect for the future.

Send any of those requests to adriaan@adriaanvandenberg.com and I will respond within one month. If you think I am mishandling your data, you have the right to complain to the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.

§ 06Where data goes

I try to keep data in the EU but the modern web routes around that. Specifically:

• Netlify (USA) hosts the static site and processes contact form submissions. They act as my data processor under standard contractual clauses.
• OVHcloud (France) hosts my mailbox.
• Substack (USA) runs the newsletter. They are the data controller for newsletter subscribers.
• Umami (EU-hosted) processes anonymous, cookie-free analytics.
• YouTube embeds (podcast episode pages) load video frames from youtube-nocookie.com. They drop no tracking cookies until you press play.

§ 07How long I keep things

Direct emails and contact-form messages: as long as it is reasonable to remember the conversation, and in any case for the period required by Polish tax and limitation rules (typically up to 6 years for anything that touches a commercial discussion). Analytics data in Umami: rolling 12 months, anonymous. Newsletter subscribers: as long as you remain subscribed, plus a short retention window after unsubscribing.

§ 08Changes to this notice

This notice is effective from 20 May 2026. If I add a tool to the site that does process personal data or set cookies, I will update this page and add a proper consent flow before turning it on. There is no "we may change this without notice" clause.