Privacy statement
Petricore Labs is a one-person software business run by Fergal McCollam. This page explains what personal data I collect, why, and what you can do about it. It is written to comply with the GDPR (AVG in the Netherlands). Short version: I collect what I need to reply to you, do the work, and issue invoices. Nothing is sold, and there is no advertising tracking on this site.
1. Who is responsible
Petricore Labs (sole proprietorship), Amsterdam, the Netherlands. KvK 99386852. Contact: hello@petricorelabs.com. I am the data controller for the data described here.
2. What I collect and why
| When | Data | Purpose · legal basis |
|---|---|---|
| You email me or book a call | Name, email address, company, anything you write | To reply and prepare a quote · pre-contractual steps at your request |
| You buy the website audit | Name, email, billing address, company name, VAT ID if given, website URL, payment status | To deliver the audit and issue an invoice · performance of a contract; invoicing is a legal obligation |
| You become a client | Contact details, contract and invoice data, project communication, and any personal data contained in systems or data you give me access to | To perform the contract · contract; for the data in your systems I act as a processor on your instructions |
| You visit this site | See section 4 | Serving the page securely · legitimate interest |
3. Payments
Payments are handled by Stripe Payments Europe, Ltd. I never see or store your card or bank details; Stripe sends me your name, email, billing address, the amount and the payment status. Stripe is an independent controller for the payment itself; see stripe.com/privacy.
4. Website, cookies and hosting
- No cookies. This site sets none. No analytics scripts, no advertising pixels.
- Hosting: Cloudflare, Inc. Cloudflare processes your IP address and request headers to serve the page and block abuse, and may keep aggregate, non-identifying traffic statistics. Cloudflare acts as my processor.
- Fonts: the typefaces are loaded from Google Fonts. Your browser therefore requests them from Google's servers, which see your IP address. Google states it does not use these requests for tracking or profiling.
- Payment links take you to a page operated by Stripe, which has its own cookies and privacy statement.
5. Who else sees your data
Only providers I need to run the business, each under a data processing agreement or acting as an independent controller for their own service: Stripe (payments and invoices), Cloudflare (hosting and email routing), my email provider, my bookkeeping software and my accountant (invoices only). I do not sell, rent or share personal data with anyone else, and I do not transfer it outside the EU/EEA except where those providers do so under the EU Standard Contractual Clauses or an adequacy decision.
6. How long I keep it
- Enquiries that don't become work: deleted within 12 months.
- Invoices and the data on them: 7 years, required by Dutch tax law.
- Project files and communication: for the duration of the engagement plus 2 years, for warranty and support, unless we agree otherwise or you ask for deletion earlier.
- Audit reports and the URL you gave me: 12 months, so I can honour the credit against later work.
7. Your rights
You can ask me to show, correct, delete or hand over your data, to restrict or object to processing, and you can withdraw consent where consent was the basis. Email hello@petricorelabs.com; I reply within one month. If you are not satisfied, you can complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens.
8. Client data I process for you
When building or maintaining software for you, I may have access to personal data of your staff, customers or suppliers. For that data you are the controller and I am the processor: I act only on your instructions, keep it confidential, secure it appropriately, and delete or return it at the end of the engagement. A data processing agreement is part of every project contract on request.
9. Security
Two-factor authentication on every account that touches your data, encrypted storage and transport, access limited to me, and no credentials in source code. If a breach ever affects your data I will tell you without undue delay and notify the authority where required.
10. Changes
If this statement changes materially, the date at the top changes and clients under contract are told directly.