Privacy & Cookies

This is the privacy policy of cimt B.V., registered in Vught (Netherlands), KvK number 27315486, VAT number NL819170276B01. We respect your privacy and handle personal data carefully. This policy describes which data we process, why, for how long, and what your rights are — in line with the General Data Protection Regulation (GDPR).

Who is the data controller

The data controller for information you provide through cimt.nl is:

cimt B.V.
Sparrendaalseweg 5, 5262 LR Vught, Netherlands
KvK: 27315486 · VAT: NL819170276B01
Email: info@cimt.nl

For privacy-specific questions: privacy@cimt.nl (or via your client contact).

Which data we process

We only process data you actively provide through a form, email or phone call. cimt.nl uses no trackers, fingerprinting or marketing cookies.

• Contact form — Step 1: name, organisation, email address. Step 2 (optional): role, topic, timeline, message.
• Quote requests — name, organisation, email, product of interest, indication of users/capacity, current tooling (optional), message (optional).
• Applications via careers@cimt.nl — information you include in your email (CV, motivation).
• Server logs — Cloudflare maintains anonymised access logs for security (bot protection, DDoS mitigation).
• Cookieless analytics — Plausible collects aggregated, non-personal statistics (page views, referrers, device category) without cookies or unique identifiers.

Why we process this data

• Answering your question or quote request — basis: pre-contractual action on your request (GDPR article 6(1)(b)).
• Processing your application — basis: pre-contractual action on your request.
• Security of cimt.nl — basis: our legitimate interest (GDPR article 6(1)(f)) in stable service delivery.
• Aggregated statistics — basis: legitimate interest in improving our website. Plausible does not process personal data.

How long we keep data

• Contact form submissions — 90 days in our backup store, then automatically deleted. Emails in our mailbox we keep for up to 24 months unless there is an active engagement.
• Quote requests — equal to contact form; upon conversion to client the data moves to client administration with retention as required by tax law (7 years).
• Applications — maximum 4 weeks after the application process closes, unless you explicitly consent to longer retention (max 1 year).
• Server logs and analytics — Plausible retains aggregated data; Cloudflare anonymises logs within 24 hours.

With whom we share data (processors)

Our website uses the following processors:

• Cloudflare, Inc. — hosting (Cloudflare Pages), DDoS protection, security logs. Data Processing Agreement (DPA) in place. EU-only data routing where the plan supports it.
• MailChannels, Inc. — handling of outgoing transactional emails (confirmations, form forwarding). DPA in place.
• Plausible Insights OÜ — cookieless analytics, hosted in the EU (Germany). Processes no personal data; DPA not strictly required but in place.
• Microsoft Corporation — Microsoft 365 for business email and Microsoft Bookings for appointments. EU tenant. DPA via Microsoft Online Services terms.
• GitHub, Inc. — source code and CMS storage. No client data.

We never sell personal data to third parties and don't use it for marketing purposes beyond answering your own question.

Cookies and tracking

cimt.nl sets no cookies by default and uses no tracking pixels. Our analytics solution (Plausible) is cookieless and privacy-friendly by design.

The embedded Microsoft Bookings widget on the Contact page may set cookies within its own iframe for booking functionality. Because you only reach that page after a deliberate action (clicking "book a conversation"), this falls under the "necessary for a user-requested service" exception to the Dutch Telecommunications Act (cookie law) — no separate consent required.

Your rights

Under the GDPR you have the right to:

• Access — an overview of which data we process about you.
• Correction — have incorrect or incomplete data updated.
• Deletion — have your data deleted (right to be forgotten).
• Restriction — temporarily pause processing.
• Objection — object to processing on the basis of legitimate interest.
• Data portability — receive your data in a structured format.

You can exercise these rights by emailing privacy@cimt.nl. We respond within one month. Not satisfied with how we handle your data? You can file a complaint with the Dutch Data Protection Authority.

Changes to this policy

We may amend this privacy policy from time to time, for example when we introduce new services or when legislation requires it. Changes are published on this page with a new "last updated" date at the top.

Version 2026-05-19. Questions or comments? privacy@cimt.nl.