Privacy statement

I am Tonco. Through Vena Digital I give people who run a service business honest marketing advice: free in the learning centre, and in person if you want. On this site you can also have your own website checked for free. For those things I sometimes need data from you. I am careful with it: I collect only what is needed, I never sell anything on, and you can always see or delete whatever I hold about you.

Vena Digital is responsible for processing your personal data (the law calls this the “controller”). My details:

• Name: Vena Digital (sole trader)
• Address: Levantkade 182, 1019 BG Amsterdam, the Netherlands
• Dutch Chamber of Commerce number: 76076032
• VAT ID: NL003037147B59
• Email: hello@vena.digital
• Phone: +31 6 10 71 42 05

I do not have a data protection officer (a business this size is not required to have one). You can simply put privacy questions to me at hello@vena.digital.

The heart of it in a few lines; the rest of the page works it out.

• If you get in touch, I keep what you enter (your name, your phone number or email address, and your website if you give it) so I can answer you.
• If you run the free check, the website you enter goes to a handful of external services that measure it. I store your IP address only in encrypted (hashed) form, to prevent abuse.
• I measure how the site is used with Google Analytics and Microsoft Clarity, but only after you have clicked “accept” in the cookie notice. If you decline or make no choice, I do not load that measuring code and no analytics cookies are placed.
• I never sell your data and I do not use it for advertising.
• You can always view, correct or delete whatever I hold about you.

For each situation I explain what data I process, what for, and on what legal basis (the GDPR requires a valid reason for every processing activity).

1. The contact forms (“Let’s talk” and the form under the report)

If you fill in a contact form, I process your first name, your phone number and/or email address, your website address if you enter it, and which form you used. If you leave an email address, I send you a confirmation that your message has arrived. I use that only to respond to your enquiry and, if you want, to look at your website together. Legal basis: the steps needed to possibly enter into an agreement, and my legitimate interest in handling an incoming enquiry properly. I do not use this data for newsletters or advertising, unless you separately ask me to.

2. The free website check

For the check you enter a website address (URL). I pass that address on to external services that fetch, measure and analyse the page (see who I share data with). Usually it is your own company’s website, but because the outcome is tied to you as a visitor, I treat it carefully.

As soon as you have typed a full website address, before you press the button, my server fetches that site’s icon to show it next to the field: from the site itself, or through DuckDuckGo or Google. Only the website address goes along, not your IP address.

To keep the free check from being abused, I count per day how often a scan is run from the same device. For that I read your IP address, but I do not store it as it is: I keep only an encrypted (hashed) version of it, with a secret addition. Your raw IP address is therefore not kept. According to the regulator such a hashed version still counts as personal data (not as anonymous), which is why I mention it here honestly. Legal basis: my legitimate interest in preventing abuse and overloading of the free service.

3. Receiving the report by email

If you want the report in your inbox, you enter your email address, and if you like your first name, so I can address you by name in that email. I use the address to send you the report. With that sending request I also keep the hashed version of your IP address, so nobody else can have the report sent to a different address. Legal basis: performing the service you asked for yourself. I do not add your email address to a mailing list and I send you no advertising.

If you also send the report to someone else, I use that address only to send the report. That person does not end up in my overview of people who ran the check.

What you enter I also keep alongside the check you ran, so that in my own overview I can see who used the free check and recognise you if you ask me something later. Legal basis: my legitimate interest in knowing who uses my free service and being able to respond properly. How long I keep it is under retention periods. If you want it gone sooner, email me and it is gone.

4. The feedback button (“Say it straight”)

On the check and the report there is a button to tell me what you think of it. I then keep what you write, and if you fill it in your email address, plus which page you were on and which website address you had entered. The email address is optional: leave it blank and I do not know who the message came from. I only use it to reply to you, never for advertising or a mailing list. Legal basis: my legitimate interest in improving my own service and being able to respond to a complaint. To stop the button being abused, the same daily counter with a hashed IP address applies as for the check above.

5. Visitor statistics and session insight

I would like to know what works on the site and what does not, so I can make it better. For that I use two tools, both loaded through Google Tag Manager. Tag Manager itself also loads only after you accept:

• Google Analytics 4: general visitor figures, such as which pages are visited, with what kind of device, and roughly from which region.
• Microsoft Clarity: insight into how visitors use the site, with heatmaps (where people click and how far they scroll) and recordings of mouse movement and clicks during a visit. Text you type is masked by default.

Legal basis: your consent. Both start only after you click “accept” in the cookie notice; if you decline or make no choice, they do not run. I never use this data for advertising. How Microsoft and Google handle data themselves is in the Microsoft privacy statement and the Google privacy statement. More about the cookies is under cookies and statistics.

6. How you arrived on the site

If you run the check, ask for the report by email or send a contact form, I also keep how you arrived on the site: the campaign code in the link you clicked (the “utm” values), the domain of the site that referred you, and the page you landed on. Never the full address of that other page. That way I can see which posts and links bring something in. It stays in my own overview and goes to nobody else. Legal basis: my legitimate interest in knowing what my work brings in. It is kept as long as the check, the sending request or the contact message it belongs to.

A cookie is a small file a website can put on your device. This site uses as few as possible:

• Analytics cookies (Google Analytics 4 and Microsoft Clarity, through Google Tag Manager): only if you accept in the cookie notice. They help me see how the site is used. If you say no, or make no choice, they are not placed. I do not use the measurements for advertising.
• Functional storage for your cookie choice: I remember in your own browser whether you accepted or declined, so the notice does not keep coming back. No consent is needed for that, because it is purely functional.
• Two technically necessary cookies from the hosting: __cf_bm from Cloudflare, to recognise bot traffic and protect the site (expires after half an hour of inactivity), and __dpl from my hosting provider, so you get the right version of the site (expires after a day). They say nothing about who you are and are needed for the site to work, so no consent is needed for them.
• What your browser remembers itself: what you enter in a form (name, email address, phone number) your own browser remembers for a week, so you do not have to type it again. It also remembers the last website address you entered, which report you had sent to which address, whether you want the site light or dark, whether you closed the “Liever Nederlands?” note that points to the Dutch version, and how you arrived on the site. That stays on your own device; I only see something once you send a form.

I use no advertising cookies and no trackers that follow you across other sites. You can always change your choice through the “Cookies” link at the bottom of every page.

I use a number of external services that process data on my behalf (in the law: “processors”). With each of them I have or am putting in place the legally required agreement (a data processing agreement). I never sell your data. These are they:

During the check, a screenshot of the page you entered may occasionally show data that happens to be on that page. I keep that screenshot only as long as the report is useful (see retention periods).

Some of the services above are American companies, so your data may be processed outside the European Economic Area. That is allowed only with extra safeguards. I rely on the EU-US Data Privacy Framework (a European Commission decision that gives certified American companies an adequate level of protection) and, where that does not apply, on the European Commission’s standard contractual clauses. Where I can, I choose storage inside the EU.

I keep nothing longer than necessary. Concretely:

• The abuse counter with your hashed IP address: expires automatically after 2 days.
• The result of a check (measurements and report): 30 days, then deleted automatically. Data I fetch along the way about a checked site I keep for at most 14 days as a temporary cache.
• Screenshots of the checked page: 30 days, then deleted automatically.
• Screenshots of competitors’ home pages in the report: 44 days, then deleted automatically. These are public pages of other businesses. I reuse such a screenshot for at most two weeks in a later check, and a report that shows it stays available for 30 days.
• The address I send a report to, with the hashed version of your IP address: at most 7 days, then deleted automatically. That is only the note that arranges the sending.
• Your first name and email address with a check: up to 24 months, then deleted automatically. The same period as data from the contact form, because it is the same kind of contact.
• Contact details from the form: up to 24 months after your last contact, then deleted automatically.
• What you send through the feedback button: up to 24 months, then deleted automatically. Want it gone sooner? Just email me.
• The list of checked websites: only the website address, the time, the language and how the visitor arrived, without a name or email address. Up to 24 months, then deleted automatically.
• The sending log: which site a report email went to and whether it arrived, without an email address. 30 days, then deleted automatically.

I take appropriate measures to protect your data: connections are encrypted (https), access is restricted, and I share data only with the services listed above. Notice something that does not look right? Let me know at hello@vena.digital.

Under the GDPR you have a number of rights. You may ask me for:

• Access: a copy of the data I hold about you.
• Rectification: correcting something that is wrong.
• Erasure: having your data deleted.
• Restriction: temporarily stopping the use of your data.
• Portability: receiving your data in a common file format.
• Objection: objecting to processing based on legitimate interest.
• Withdrawing consent: where I rely on consent (such as the statistics), you may withdraw it at any time, without what happened before becoming unlawful.

Send your request to hello@vena.digital. I respond within a month. It is free, and sometimes I will ask you to confirm who you are, so I do not accidentally hand data to the wrong person.

If you disagree with something, tell me first; I would much rather sort it out with you. You also always have the right to file a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl. If you live in another EU country, you may also complain to your own national authority. And you can go to court.

The check uses AI to write a report about a website. That is a tool, not a decision about you as a person with legal or similar consequences. So I make no automated decisions within the meaning of article 22 of the GDPR.

If something changes about the site or about how I handle data, I update this statement and put a new date on it. The current version is always here. This version is from 19 October 2026.

See also my terms and conditions.