Privacy Policy
What this site collects, why, who else sees it, and how long we keep it. Written simply, because understanding it is the whole point.
Last updated: 23 August 2026
The short version
- The only thing this site collects is what you type into the contact form.
- No cookies. No analytics. No tracking. Nothing is stored on or read from your device.
- We use your enquiry to reply to you, and for nothing else. We never sell it or use it for advertising.
- Enquiries are deleted after three years at the latest.
Who we are
This website is operated by Noxiom, a sole proprietorship (eenmanszaak) registered in the Netherlands. Noxiom is the data controller for the personal data described below.
- Trade name
- Noxiom
- Address
- Het Som 61, 3891 BE Zeewolde, Netherlands
- KvK number
- 96088192
- VAT number
- NL005186983B28
- contact@noxiom.com
- Privacy questions
- privacy@noxiom.com
What this policy covers
This policy is about this website: what happens when you browse it or send us an enquiry. It is not about what happens during an audit.
An audit involves more data than a contact form: an anonymous team survey, a guided screen-share, your subscription overview. How that data is handled, and how long it is kept, is set out in the agreement we sign before an audit starts, so you see it in writing before anything begins. We do not take copies of your client data.
What we collect
The contact form is the only place on this site where you give us personal data. These are the fields:
| Field | Required |
|---|---|
| Name | Yes |
| Email address | Yes |
| Company | No |
| Company size (a range you pick) | Yes |
| Your message | Yes |
Alongside those fields, our form provider records the time of submission, your IP address, your browser user agent, and the page you came from. This is the technical data the form service collects to log what it handled and to run the spam checks that keep the form usable.
Two things worth knowing. First, the message and company fields are free text, so they may end up containing personal data we never asked for: a phone number, a colleague's name, details about your business. Whatever you put there is what we receive. Second, we store what you enter as you enter it. We do not verify it, so if you give us incorrect details, we hold incorrect details.
What we use it for, and on what legal basis
| Data used | What for | Legal basis (GDPR / AVG) |
|---|---|---|
| All form fields | Replying to your enquiry and discussing a possible audit | Art. 6(1)(b): steps taken at your request before a possible contract |
| IP address, email address | Blocking spam and abuse of the form | Art. 6(1)(f): our legitimate interest in a working contact form |
| Correspondence and invoicing data | Keeping business records once you become a client | Art. 6(1)(c): legal obligation (art. 52 Algemene wet inzake rijksbelastingen) |
We do not use your data for advertising, we do not build profiles, and we never sell it to anyone.
Who else sees it
We use two service providers to run this site. They process data on our instructions only.
Web3Forms (Web3Creative): the contact form
Form submissions are handled by Web3Creative, which operates the Web3Forms service from India. It stores your submission and emails it to us. Web3Creative in turn uses:
- Amazon Web Services and Hetzner Online GmbH (Germany and Finland) for hosting, storage and email delivery
- Cloudflare for content delivery and blocking attacks
- CleanTalk Inc. (United States) and Automattic Inc. (Akismet, United States) for spam checks. To score a submission as spam or not, these two receive your IP address and your email address.
Web3Creative's own privacy policy is at web3forms.com/privacy and its data processing agreement, which lists its providers in full, is at web3forms.com/dpa.
site.eu: hosting and email
This website and our @noxiom.com mailboxes are hosted by site.eu in the Netherlands. Your enquiry sits in our mailbox there once it reaches us.
Data leaving Europe
Some of the above sits outside the European Economic Area: Web3Creative operates from India, and CleanTalk and Automattic are in the United States. Neither country has an EU adequacy decision, so these transfers rely on the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), as set out in Web3Forms' data processing agreement.
How long we keep it
Enquiries. We keep your enquiry for as long as we need it to reply and to follow up on a possible engagement, and in any event no longer than three years from the day you sent it. That limit covers every copy we hold, not just the first one: the submission stored by Web3Forms, the copy delivered to our mailbox, and any reply we sent you, since a reply quotes what you wrote.
Client records. If you become a client, the correspondence and invoicing that form part of our business administration are kept for seven years after the end of the financial year they relate to, because Dutch tax law (art. 52 AWR) requires it. Since the clock starts at the end of the financial year rather than on the date of the record, that works out to just under eight years in practice.
You can ask us to delete your enquiry sooner. See your rights below.
Cookies, analytics and tracking
This site sets no cookies, runs no analytics, and contains no tracking scripts, pixels or embedded third-party content. Nothing is stored on your device and nothing is read from it, which is why you are not being asked to click through a cookie banner. Under Telecommunicatiewet art. 11.7a there is nothing here to consent to.
That exemption covers the banner, not this page. We still have to tell you what we collect, which is what you are reading.
Automated decision-making
We do not make any automated decisions about you and we do not profile you. Every enquiry is read by a person.
Do you have to give us this data?
No. Using the contact form is entirely voluntary and there is no consequence to not using it. But without a name and an email address we have no way to answer you, so those two fields are required if you want a reply. You are welcome to email contact@noxiom.com directly instead, which skips the form provider altogether.
Your rights
Under the GDPR (AVG) you can ask us to:
- Access: give you a copy of the personal data we hold about you
- Rectify: correct it if it is wrong or incomplete
- Erase: delete it
- Restrict: stop using it while a dispute is sorted out
- Object: stop processing that relies on our legitimate interest
- Port: send it to you, or to someone else, in a machine-readable format
Email privacy@noxiom.com and we will respond within one month. If a request is genuinely complicated we may take up to two months longer, but we will tell you inside the first month if that happens. There is no charge.
If you are not happy with how we handle it, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens. You do not have to come to us first, though we would rather you did, because it is usually faster.
Changes to this policy
If we start using a new tool, or change how long we keep things, we will update this page and change the date at the top. We will not quietly start doing something this page says we do not do.
Noxiom provides advice and assessment, not legal advice. This page describes our own data handling and is not guidance for your organisation.