1. Who is responsible for your data
Waterblom Beheer B.V., trading as Waterbloom, based at Nieuwe Rijn 8A, 2312 JB Leiden, the Netherlands (KVK 28106188, VAT NL814689693B02), is the data controller for the personal data processed via waterbloom.nl, en.waterbloom.nl, the customer portal and the hosted service.
Questions about this statement or about your data can be sent to sales@waterbloom.nl.
2. Who this statement applies to
This statement applies to everyone whose personal data Waterbloom processes: website visitors, customers who purchase a hosting or domain package, users of the customer portal, and people who get in touch through support.
3. What data we collect and why
| Category | What data | What for | Legal basis |
|---|---|---|---|
| Order and customer data (hosting/domain) | Name, email address, phone number, address, (if applicable) company name and VAT number | Processing the order, delivering the service, registering the domain, invoicing | Performance of a contract |
| Payment data | Payment status and reference via Stripe; Waterbloom itself never sees full card or bank details | Processing and handling payment | Performance of a contract |
| Customer portal login | Email address, IP address and timestamp of login attempts (magic link, no passwords) | Secure sign-in to the customer portal, detecting abuse | Legitimate interest (security) |
| Support (tickets) | Name, email address, customer number, messages and any attachments | Handling support and service requests | Performance of a contract |
| Looking along when you ask for help | What is in your own environment and what you see there as the owner, such as pages, your cockpit and the data you keep in it; plus a record of when and on which address we looked along | Helping you when you ask for help or when something goes wrong with your environment | Performance of a contract |
| Signing up as a tester | First name, email address, (optionally) phone number, your idea and how far along you are | Contacting you about a tester place and helping you get started | Consent |
| AI feature on your own website | The text you enter as the owner into an AI feature on your site and the answer to it; in addition the number of calls and the usage. We do not store the text itself; it is only passed on to Claude (Anthropic) | Running the AI feature and keeping track of your usage and monthly limit | Performance of a contract |
| Content of your environment and backend | Everything you put in your environment yourself or have your backend store, such as pages, files in your library and the data in your cockpit. This may include personal data of others, for example of your own customers or staff | Hosting your environment, backing it up daily and making the service work | Performance of a contract |
| Website visits (waterbloom.nl) | IP address, page visited, timestamp, browser/operating system — from server logs, no cookies | Understanding website traffic and recognising automated/bot traffic | Legitimate interest |
| AI processing | Where a request or text contains personal data and is processed via Claude (Anthropic), e.g. for internal automation | Supporting service delivery and internal operations | Legitimate interest / performance of a contract |
4. How we obtain this data
You provide almost all of this data yourself: when ordering a package or domain, when logging in to the customer portal, or when sending a support request. Website visit data arises automatically because every web server logs which pages are requested — this happens without cookies or client-side tracking, purely based on server logs.
5. Who we share data with
We only share data with parties that help us deliver the service, never for those parties' own marketing purposes. These are the parties currently processing data on Waterbloom's behalf:
| Party | Role | For |
|---|---|---|
| Stripe | Processor | Processing payments |
| TransIP | Processor / registrar | Registering and managing domain names |
| Microsoft (Microsoft 365 / Graph) | Processor | Sending email from the customer portal |
| Anthropic (Claude) | Processor | AI-assisted features and internal automation |
| ipinfo.io | Processor | Recognising automated/bot traffic based on IP address |
| OVH | Processor (hosting) | Hosting the website, the customer portal and the service (VPS in the EU) |
Some of these parties may process data outside the EU/EEA. Where that happens, we ensure an appropriate legal safeguard is in place, such as the EU Standard Contractual Clauses.
6. How long we retain data
| Data | Retention period |
|---|---|
| Customer and order data, invoices | For as long as you are a customer, plus 7 years after the end of the financial year (statutory tax record-keeping obligation) |
| Support tickets | 2 years after the ticket is resolved |
| Tester sign-ups | At most 1 year after you sign up; if you become a customer, the periods for customer data apply |
| Usage of the AI feature | For as long as you are a customer, plus the tax retention period insofar as it appears on an invoice |
| Content of your environment and backend, and backups of it | For as long as you are a customer; after your subscription ends we delete your environment |
| Login attempts / IP-to-customer matching | 90 days, then automatically deleted |
| Website visit logs (server logs) | A few weeks |
| IP origin cache (bot detection) | 30 days |
| Record of looking along | For as long as you are a customer |
7. How we secure data
Access to servers and systems is restricted to authorised administration, changes to the website and systems are tested and backed up beforehand, and the customer portal uses login links (magic links) instead of passwords. For the rest, we refer to the security measures of the parties listed in article 5, who are responsible for their own service.
Data of others in your environment. If you put personal data of others in your environment or backend, such as guests, customers or staff, you are responsible for it and Waterbloom only processes it on your behalf, to host your environment and back it up. We do not use it for anything else.
Looking along in your environment. If you ask us for help, or if something goes wrong with your website or cockpit, Waterbloom can look along in your own environment with the same rights you have as the owner. We only do this to help you. Such access expires automatically after two hours, and we record each time when and on which address we looked along. We do not notify you separately; if you want to know when we looked along, you can ask us. We do not use what we see for any other purpose and do not share it with anyone.
8. Your rights
Under the GDPR you have the following rights regarding your personal data:
- Access — you can request which data we hold about you.
- Rectification — you can have inaccurate data corrected.
- Erasure — you can request that your data be deleted, unless we are legally required to keep it.
- Restriction and objection — you can have processing restricted or object to it.
- Data portability — you can request your data in a portable format.
You can exercise these rights by emailing sales@waterbloom.nl. If you disagree with how we handle your data, you can file a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens.
9. Cookies
The website waterbloom.nl does not place cookies and does not use client-side tracking scripts. Website visits are measured exclusively server-side via log files, as described in article 3. The customer portal uses a functional session cookie to keep you signed in after you log in — this is necessary for the service to work and does not require consent.
10. Changes
We may update this privacy statement, for example if we start using a new supplier or if regulations change. The date at the top of this statement shows when it was last updated.