Privacy Policy

Pre-launch draft, updated 19 October 2026. The controller’s contact address and the hosting, logging, backup and international-transfer arrangements still need to be confirmed before this policy is final.

Who handles your data?

Andrew Wullaert is the person behind Wulcon Digital, based in the Netherlands. For questions about this website or your personal data, email info@wulcon.com.

Contact enquiries

The contact form collects your name, email address, optional company name, subject, message and the time of submission. Your enquiry is stored in a private WordPress inbox and an email notification is sent to the configured recipient. Please do not include passwords, health information or other sensitive data.

Purposes and legal bases

These details are used to respond to your enquiry. Where you request steps towards an agreement, the basis is taking those steps at your request. For other enquiries, the basis is a legitimate interest in responding to correspondence. Technical security processing serves the legitimate interest of protecting the website and preventing abuse.

Hosting, email and spam protection

The website and its business mailbox use mijn.host. FluentSMTP connects WordPress to the mailbox for email delivery. Authorised administrators can access the contact inbox.

The contact form uses Cloudflare Turnstile to distinguish genuine visitors from automated abuse. Loading the widget connects your browser to Cloudflare, which processes technical information such as your IP address and browser or device signals. The website verifies the resulting token with Cloudflare before accepting an enquiry. The custom integration does not send your name, email address or message to the verification endpoint. See the Cloudflare Turnstile Privacy Addendum for Cloudflare’s processing details.

The form also uses a session cookie, a hidden spam field and a rate limit. For the rate limit, a keyed hash based on the connection IP address and hourly time window is stored temporarily for up to one hour. This is separate from any hosting security logs.

Retention

Contact enquiries are kept while they are being handled, then deleted six months after closure. In WordPress, an administrator marks an enquiry as handled; this starts its six-month deletion period. A daily scheduled check permanently deletes expired records. The check runs through WordPress scheduling and can be delayed if the website receives no traffic.

Copies in the mailbox, SMTP logs and exports must be reviewed and removed separately under the same enquiry retention schedule. Backups and hosting logs follow the provider’s separately confirmed retention arrangements. If information becomes part of a contract, accounting record or legal claim, only the information needed for that purpose is retained under the applicable separate requirement.

International processing

Cloudflare operates internationally, and processing may take place outside the European Economic Area. The applicable provider agreements, transfer mechanisms and retention settings must be confirmed before this draft is final. We do not claim that all website data remains within the Netherlands.

Analytics and external links

Google Analytics and marketing trackers have not been added to the website. The LinkedIn button is an ordinary link: LinkedIn is visited only when you follow it. Your visit there is governed by LinkedIn’s policies.

Your rights

You may request access, correction, deletion or restriction, and, where applicable, portability. You may object to processing based on legitimate interests. Send requests to info@wulcon.com. We normally respond within one month; if a lawful extension is needed, we will explain why. Only proportionate information will be requested to verify your identity.

You can also submit a complaint to the Autoriteit Persoonsgegevens.

Updates

This policy is reviewed when the website, its services or data handling changes.