1) Who we are (Data Controller)
Jacobs Development BV
The Hague, The Netherlands
KVK: 80855601
Email: contact@jacobs-development.com
Website: https://www.jacobs-development.com/
For the activities described here, Jacobs Development BV is the Data Controller.
2) Scope of this Policy
This Policy applies to personal data we process when you:
- visit our website and pages hosted in Webflow,
- accept/decline cookies via our consent banner,
- use our contact forms or request a quote,
- interact with our AI assistant/chat (if enabled),
- receive our communications or marketing (where permitted).
A separate privacy or data processing agreement may apply to our client projects, hosting, or custom AI solutions; if so, those documents prevail for those services.
3) What data we collect
3.1 Data you provide to us
- Contact/lead data: name, company, email, phone, message content, project details, budget, preferences.
- Support/communication data: emails, call notes, tickets, and your feedback.
- AI assistant inputs (if used): messages and files you submit to the chatbot (see Section 8).
- Contract/billing data (if you become a client): billing address, VAT number, contract metadata, payment confirmations (actual card data is handled by payment providers, not by us).
3.2 Data we obtain automatically (via cookies/SDKs)
- Usage & device data: IP address (truncated/anonymized where applicable), device type, OS, browser, timestamp, pages viewed, referring/exit pages, events (clicks, scrolls), approximate location (country/region).
- Cookie IDs/online identifiers used by Google Analytics (GA4) and Meta (Pixel/Meta tag) to understand site performance and (if consented) optimize campaigns.
3.3 Data from third parties
- Marketing/analytics platforms (e.g., Google, Meta) provide aggregated, pseudonymized performance and audience information.
- Public sources (e.g., your company’s website or LinkedIn) to pre-qualify or personalize responses when you ask for a quote.
4) Why we process your data (Purposes) & legal bases
We process personal data for the following purposes and legal bases under the GDPR:
- Website operation & security
- Ensuring the site loads, is secure, and functions correctly (via Webflow).
- Legal basis: Legitimate interests (Art. 6(1)(f)) in running a secure, functional website.
- Strictly necessary cookies
- Basic site functionality, session continuity, consent logging.
- Legal basis: Legitimate interests; consent not required for strictly necessary cookies under ePrivacy.
- Analytics & performance (e.g., Google Analytics GA4)
- Understanding site usage to improve UX, content, and funnels.
- Legal basis: Consent (Art. 6(1)(a)). Tools load only after consent.
- Marketing measurement/retargeting (e.g., Meta Pixel/Meta tag)
- Measuring campaign performance and (where applicable) retargeting.
- Legal basis: Consent (Art. 6(1)(a)). Loads only after consent. You can withdraw any time via the cookie banner or browser controls.
- Responding to inquiries / quotes / support
- Communicating with you when you fill out forms or contact us.
- Legal basis: Contract/steps prior to contract (Art. 6(1)(b)) or Legitimate interests (Art. 6(1)(f)) to answer your request.
- AI assistant/chat (if enabled on the site)
- Handling your prompts to generate responses; improving reliability/security of the assistant.
- Legal basis: Consent (for the chat feature where required) and/or Legitimate interests to provide the service you requested. See Section 8.
- Legal obligations
- Tax, accounting, compliance, and responding to lawful requests.
- Legal basis: Legal obligation (Art. 6(1)(c)).
- Defending our rights
- Managing disputes, preventing abuse/fraud, securing our systems.
- Legal basis: Legitimate interests (Art. 6(1)(f)).
5) Cookies & tracking technologies
We use a consent banner to help you accept, reject, or customize cookies. You can change or withdraw consent at any time.
Categories we use:
- Strictly Necessary (always on): session state, load balancing, security, consent storage.
- Analytics/Performance (consent-based): Google Analytics (GA4).
- Marketing/Advertising (consent-based): Meta Pixel/Meta tag.
Examples (may vary by region/version):
- Google Analytics (GA4):
_ga, _ga_* (used to distinguish users and sessions). - Meta Pixel:
_fbp (browser/app identifier to measure/optimize campaigns). - Webflow/Hosting essential cookies: session and preference cookies required for site operation.
Note: Specific cookie names and lifetimes can change. Your live Cookie Policy / CMP should list the current set dynamically.
6) Tools we use (vendors & roles)
Webflow (hosting & site builder)
Our site is built and hosted on Webflow. Webflow may process limited personal data (e.g., IP, device info) to serve the site securely and efficiently.
- Role: Processor (hosting) / sometimes independent controller for necessary platform telemetry.
- Location & transfers: Global infrastructure; see “International transfers” below and Webflow’s privacy documentation.
Google Analytics (GA4)
We use GA4 to understand site performance. GA4 uses pseudonymous IDs; IP addresses are not stored and IP anonymization is applied for EU traffic by default.
- Loads only after consent.
- Role: Processor (on our behalf) per Google’s terms/settings for GA4.
- Opt-out: Use our cookie banner or browser add-ons.
Meta Pixel / “Meta tag”
Used for campaign measurement and (if consented) retargeting.
- Loads only after consent.
- Role: Generally independent controllers (we and Meta each determine purposes).
- You can manage preferences via our banner or your Meta advertising settings.
7) Data sharing & recipients
We share personal data only as necessary for the purposes above:
- Service providers (processors): hosting (Webflow), analytics (Google), email/SMS/communication tools, security/monitoring, and cloud services.
- Professional advisors: accountants, legal counsel (as needed).
- Authorities: where required by law or court order.
We do not sell your personal data.
8) AI assistant & custom AI (if enabled)
If you use our on-site AI assistant:
- We process your prompts and conversation content to provide responses.
- For reliability and security, we may retain chat logs for a limited period, then delete or anonymize.
- Where we rely on third-party model providers (e.g., OpenAI API), they act as sub-processors to generate outputs.
- Your chat content is not used to train public models and is not shared with third parties for their own purposes.
- Do not submit sensitive personal data unless it’s necessary and lawful to do so.
- For custom AI solutions we build for clients, data processing is governed by a DPA/SOW with the client. We configure data access to the client’s instructions, keep data private, and align retention with the contract.
Legal bases: Consent and/or Legitimate interests to provide the requested chat service; Contract for client AI projects. GDPR rights (Section 11) apply.
9) International data transfers
Some providers (Webflow, Google, Meta) may process data outside the EEA (e.g., the US). Where this occurs, we rely on:
- EU Standard Contractual Clauses (SCCs) and supplementary measures implemented by the provider, and/or
- Adequacy decisions by the European Commission.
We assess vendor documentation and strive to use providers with robust GDPR programs.
10) Data retention
We retain personal data only as long as necessary for the purposes described above:
- Contact/lead form submissions: typically 24 months from last interaction (unless a client relationship is formed).
- Client/project data: for the duration of the contract and the limitation period required by law (e.g., 7 years for tax/accounting in NL).
- Analytics data (GA4): typical lookback window/retention 14 months (or your configured period).
- AI chat logs: minimal period necessary for reliability/security, then deletion or anonymization.
- Cookies: per tool-specific lifetime; see the cookie banner/policy for details.
We may retain data longer if required to establish, exercise, or defend legal claims.
11) Your rights (GDPR)
You have the following rights, subject to conditions and legal limitations:
- Access – learn whether we process your data and obtain a copy.
- Rectification – correct inaccurate or incomplete data.
- Erasure – request deletion (“right to be forgotten”).
- Restriction – request we limit processing in certain cases.
- Portability – receive your data in a structured, commonly used format.
- Object – object to processing based on legitimate interests or direct marketing.
- Withdraw consent – where processing is based on consent (e.g., analytics/marketing cookies).
To exercise your rights, contact contact@jacobs-development.com. We may need to confirm your identity.
You also have the right to lodge a complaint with your local supervisory authority. In the Netherlands: Autoriteit Persoonsgegevens (https://autoriteitpersoonsgegevens.nl/).
12) Security
We implement appropriate technical and organizational measures to protect personal data, including encryption in transit (HTTPS), access controls, least-privilege access, and vendor assessments. No method of transmission or storage is 100% secure; we continuously improve our security posture.
13) Children’s data
Our website and services are not directed at children under 16. If you believe a child provided personal data to us, please contact us so we can delete it.
14) Links to other websites
Our site may contain links to third-party websites. We are not responsible for their privacy practices. Please review their privacy policies.
15) Changes to this Policy
We may update this Privacy Policy from time to time. The “Effective date” will change accordingly. Material changes will be highlighted on the website where appropriate.
16) Contact us
For questions about this Policy or your rights, contact:
Jacobs Development BV
Email: contact@jacobs-development.com
The Hague, The Netherlands
