Privacy Statement

Who is responsible

CQX Field Operations & Intelligence is a one person business. I am the controller for all personal data described here. No data protection officer has been appointed, as CQX does not currently carry out processing that requires one under Article 37 GDPR.

This website

This website sets no cookies. It uses no analytics, no tracking and no advertising. There is no contact form, and the fonts are served from this domain rather than from a third party.

The site is hosted on GitHub Pages and delivered through Cloudflare. To serve a page and to protect the site against attacks, Cloudflare processes the visitor's IP address and technical request data. The legal basis is my legitimate interest in a working and secure website, Article 6(1)(f) GDPR. I do not receive or consult data about individual visitors.

If you contact me

When you contact me by email, telephone, Signal or WhatsApp, I keep what you send me and my reply. If you use WhatsApp, Meta processes metadata about that contact under its own terms. Signal and email are the more private routes.

If your message concerns a possible assignment, the legal basis is the steps taken at your request before entering into a contract, Article 6(1)(b) GDPR. Otherwise it is my legitimate interest in answering the people who write to me.

Clients

For an assignment I process your name and contact details, the details of the engagement, my correspondence with you, the findings I report, and the invoice. The legal basis is the performance of our contract, Article 6(1)(b) GDPR, and for the invoice my legal obligation to keep records, Article 6(1)(c).

Assignments are covered by a written engagement and by my confidentiality obligations. I do not use client information for anything other than the assignment, and I do not name my clients.

Business contacts

I keep a record of organisations and professionals I approach or who approach me, containing business contact details and notes on our correspondence. The legal basis is my legitimate interest in building a business, Article 6(1)(f) GDPR. You can object to this at any time and I will remove your details.

Client assignments are never recorded in that system.

People I encounter during an assignment

My work takes place in the physical world, so I sometimes record information about people who are not my client. That may be the seller of a property, an agent, a member of staff, or someone else involved in the situation I was asked to look at.

I do not investigate individuals as an end in itself. Where a matter calls for that, it belongs with a licensed agency and I say so.

Where information about an identifiable person is relevant to the question I was given, I process only what is necessary for that question, and only in the report to my client. That may include information that is already publicly available or that comes from documents and records relevant to the assignment.

I do not set out to collect special categories of personal data, such as health, religion, political opinions or trade union membership, or data relating to criminal offences. If I come across such information, I assess whether it is necessary to record or report it at all, and I limit its use accordingly.

The legal basis is the legitimate interest of my client and of myself in establishing the facts before a decision is made, Article 6(1)(f) GDPR.

Where personal data are obtained from a source other than the person concerned, I may in some cases be unable to inform that person at the time of collection. This can be because doing so would seriously impair the purpose of the assignment, or because another exception under Article 14(5) GDPR applies. Whether an exception applies is assessed for each assignment separately.

Where information comes from

Information may come from you, from my client, from publicly available sources, from documents and professional or commercial records, or from what I observe myself during an assignment.

Who processes data on my behalf

• Zoho for my business email and for my record of business contacts
• Proton for encrypted storage of documents, notes and files
• Cloudflare for delivery and security of this website
• GitHub for hosting this website

Where these providers process personal data on my behalf, I have the contractual arrangements in place that the GDPR requires. Some of them also process certain data as independent controllers under their own privacy terms.

Where personal data are transferred outside the European Economic Area, I use an appropriate transfer mechanism under Chapter V GDPR, such as an adequacy decision or the European Commission's standard contractual clauses. You can ask me which mechanism applies to a specific provider.

How long I keep things

• Assignment records, including reports and relevant correspondence: normally five years after the assignment ends, unless a longer or shorter period is required or justified by a legal obligation, a dispute, a claim, or the nature of the assignment
• Invoices and financial records: seven years, as required by Dutch tax law
• Business contacts: until you object, or until the contact is no longer relevant
• Other correspondence: no longer than necessary

Security

I use encrypted communication channels where available. Devices and accounts are protected by strong authentication. Documents and files are held in end to end encrypted cloud storage, which means the storage provider cannot read their contents. Assignment material is not shared with anyone other than the client and, where the assignment requires it, a specialist bound by confidentiality.

In the event of a personal data breach I will assess whether notification is required under the GDPR and, where it is, notify the Dutch Data Protection Authority and, where applicable, the people affected, without undue delay.

General points

This website and my services are not directed at children.

I do not use automated decision making or profiling. Every report is the result of my own observation and analysis.

Your rights

You have the right to ask what I hold about you, to have it corrected, to have it erased, to restrict its use, and to object to its use. Where the conditions for it are met, you also have the right to receive your data in a portable form.

Write to [email protected]. I will respond without undue delay and in any event within one month of receiving your request. Where the law allows it, that period may be extended by up to two further months, depending on the complexity and the number of requests.

Where I hold information about you because of an assignment for a client, these rights are limited by my duty of confidentiality and, in some cases, by the rights of others. I will always tell you when that is the reason.

If you are not satisfied, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

Changes

If this statement changes, the new version is published on this page with a new version number and date.