Who is responsible?
I am Max van den Bulk, the owner of this portfolio and the person responsible for the personal data described here. You can contact me about privacy at mg.vandenbulk@hotmail.com.
Contact enquiries
The contact form prepares a draft in your own email app. The form itself does not send your message to a website server or save it in a website database. I receive your information only when you send the email.
If you email me, I receive your name, email address, message and any other information or attachments you choose to include. I use these to read and respond to your enquiry and handle relevant follow-up correspondence.
The legal basis is my legitimate interest in responding to people who contact me about my portfolio and professional work. Where an enquiry concerns entering into a contract with you, the legal basis may instead be taking steps at your request before entering into that contract. I do not use contact enquiries for mailing lists or advertising.
Contacting me is voluntary. The form asks for a name, email address and message to prepare your draft; you can also email me directly. Without a way to contact you, I cannot reply. Please only include information needed for your enquiry.
Website visits
Cloudflare hosts and protects this website. When you visit, it processes technical information such as your IP address, requested pages, request times and browser information to deliver the site, maintain its performance and protect it against abuse. My legal basis for this is my legitimate interest in operating a reliable and secure portfolio.
The website code does not set advertising cookies or include advertising trackers. Cloudflare may use necessary security cookies when its protection features require them. There is no profiling or automated decision-making by me that produces legal or similarly significant effects.
Service providers and international transfers
Microsoft Outlook.com/Hotmail handles the email sent to my inbox. Cloudflare handles website delivery and security; the form does not submit your message to Cloudflare. Your own email provider also handles messages you send. These providers may use supporting service providers to deliver their services.
Microsoft and Cloudflare operate internationally, so relevant data may be processed outside the European Economic Area, including in the United States. Their published policies describe the applicable safeguards, including adequacy arrangements such as the EU–US Data Privacy Framework and, where applicable, European Commission standard contractual clauses. Information about those safeguards and how to obtain further details is available in the Cloudflare privacy policy and Microsoft privacy statement. You can also contact me with questions.
Links to LinkedIn and externally hosted documents take you to other providers, whose own privacy policies apply when you open those links.
How long I keep data
I delete ordinary contact enquiries within 12 months after the conversation ends, and sooner when they are no longer needed. If correspondence becomes part of an ongoing professional relationship, or is needed to meet a legal obligation or establish, exercise or defend a legal claim, I retain the relevant information for that purpose and period.
Technical records and provider backups follow the providers’ applicable retention periods, which depend on the service, security needs and legal requirements. Their privacy policies explain their retention criteria. Deleting an email from my inbox does not necessarily immediately remove all provider recovery or backup copies.
Your rights
Depending on the circumstances, you may ask to access, correct or erase your personal data, restrict its use, or receive a portable copy where that right applies. You may object to processing based on legitimate interests. These rights are subject to the conditions and exceptions in the GDPR/AVG.
Send your request to mg.vandenbulk@hotmail.com. I will normally respond within one month. If a lawful extension is needed, I will explain why within that month. You can also lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens.