FREDERIK DANEELS
§ PRIVACY POLICY

Privacy Policy

Last updated: October 28, 2026

01 General Information

This Privacy Policy explains how personal data is collected and processed when you visit this website, submit the contact form, or book a call. "Personal data" means any information relating to an identified or identifiable natural person.

For definitions such as "processing" or "controller", we refer to Article 4 of the General Data Protection Regulation (GDPR).

02 Controller

Extra Paar Handen UG
Bocks Allee 9
32369 Rahden
Germany

Represented by: Frederik Daneels
Email: [email protected]
Phone: +49 163 63 23 706

03 Categories of Data Processed

  • Contact data: name, email address, optional company name
  • Communication data: message content you submit via the contact form
  • Booking data: if you book a call via the self-hosted booking system at book.beyondfreelancing.com
  • Business / invoicing data: only if you become a client (billing address, VAT details, invoice history)
  • Technical data: IP address, date/time, browser information; typical server log data

04 Purposes of Processing

  • To respond to inquiries submitted via the contact form
  • To schedule and manage discovery calls
  • To deliver the services you engage me for
  • To manage invoicing and comply with legal retention obligations
  • To ensure the security, stability, and proper functioning of the website

05 Legal Bases (GDPR)

  • Art. 6(1)(b) GDPR: performance of a contract or pre-contractual measures
  • Art. 6(1)(c) GDPR: compliance with a legal obligation
  • Art. 6(1)(f) GDPR: legitimate interests (secure operations, fraud prevention)
  • Art. 6(1)(a) GDPR: consent (only where applicable)

06 How the Contact Form Works

When you submit the contact form on this website, the data you provide is processed by the site backend to:

  • Validate the submission via Cloudflare Turnstile (anti-spam)
  • Send the message to my inbox via Resend (transactional email service)
  • Store the message in my email so I can follow up

Your email address is used solely as the reply destination. It is not added to any newsletter or marketing list.

The site also offers a free downloadable checklist ("The DIY Automation Reality Check") in exchange for your email address. Submitting that form sends you one email containing the download link, and sends me a notification with your email so I can follow up. The same Turnstile and Resend processing described above applies. Your email is not added to any newsletter or marketing list.

07 Recipients / Processors

Depending on the context, your data may be processed by:

  • Hosting / infrastructure: Cloudflare Pages (website delivery, edge logs) and Hetzner (server in Finland, EU, for the booking system, my automation server n8n and the client portal)
  • My mailbox: Infomaniak Network SA (Switzerland, covered by an EU adequacy decision)
  • Email delivery: Resend, for sending contact-form messages to my inbox
  • Spam protection: Cloudflare Turnstile
  • Scheduling: self-hosted Cal.com on the EU-based Hetzner server (no third-party scheduling vendor)
  • AI assistant: Anthropic PBC (USA), used to support my work with prospects and clients, under a processor agreement. See section 8 for full details.
  • Advertising / conversion measurement: Google Ireland Ltd.: only if you consent to measurement cookies (Google Ads conversion tracking). See section 13.
  • Enrollment platform for my clients: Cloudflare (Workers and D1 database, EU jurisdiction) and Google (Gmail API and Google Drive API, only if a client connects a Gmail mailbox or a Google Drive). See section 14.
  • Client portal for my clients: Cloudflare (login and stored files; files in the EU, login data such as email address and session replicated worldwide), Hetzner (portal users, chat, tickets and logs, EU) and Resend (login and notification emails, EU region). Short notifications to my phone (Telegram, push) contain no personal data, only a reference number and a link.
  • Accounting / tax advisor: if invoicing is required

08 AI Assistant Usage (Anthropic / Claude)

I use Anthropic (Anthropic PBC, San Francisco, USA), the maker of the AI assistant Claude, to support my work, for example drafting communications, preparing meetings, analyzing business situations, and supporting and maintaining the systems I build for my clients (including the client portal and the enrollment platform). I access Claude through a business plan (Claude Team) under Anthropic's Commercial Terms. When I work on your situation with my AI assistant, content (which may include your name, the content of emails or messages you have sent me, and business context you have shared) is transmitted to Anthropic. I only share what the task at hand needs.

  • Processor agreement: Anthropic acts as my processor under its Data Processing Addendum, which is part of the Commercial Terms.
  • No model training: under the Commercial Terms, Anthropic may not train its models on my content. Your data is therefore not used to train Anthropic's AI.
  • Retention: conversations are kept in my account only as long as I need them; deleted conversations are removed from Anthropic's systems within 30 days. Content flagged for a usage-policy violation may be kept longer, as described in Anthropic's policies.
  • International transfer: the transfer to the United States is covered by the EU Standard Contractual Clauses included in Anthropic's Data Processing Addendum.
  • Sub-processors: Anthropic relies on cloud infrastructure providers (currently including AWS and Google Cloud). The current list is published at trust.anthropic.com/subprocessors.
  • Google user data excluded: data obtained through Google APIs (see section 14) is never passed to Anthropic.
  • Governing terms: my use of Claude is governed by Anthropic's Commercial Terms and Data Processing Addendum.
  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating the business efficiently), or Art. 6(1)(b) GDPR where processing is necessary to perform an engagement with you. Where I process data on behalf of a client (for example in the enrollment platform), Anthropic is a sub-processor under my agreement with that client.

If you would prefer that I do not use AI tools to process your specific information, contact me at [email protected] and I will accommodate your request.

09 International Data Transfers

Some service providers may process data outside the EU/EEA. Where this is the case, appropriate safeguards under GDPR apply (e.g., adequacy decision, Standard Contractual Clauses).

10 Retention Periods

  • Inquiry / lead data: retained as long as needed for follow-up and communication documentation
  • Contract / invoicing data: typically up to 10 years (German statutory retention)
  • Server logs: retained for a limited period for security and troubleshooting

11 Your Rights

You have the following rights under GDPR:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)
  • Right to withdraw consent (Art. 7(3) GDPR)
  • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

To exercise your rights, contact me via the details in section 02.

12 Security

I use appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. The site is served over HTTPS with HSTS, and form submissions are validated server-side.

13 Cookies & Analytics

This website uses Cloudflare Web Analytics to understand overall traffic (e.g., page views, visit counts, referring pages). It is cookieless and does not track individuals across websites or build a personal profile of you. Cloudflare's own privacy policy for this product is available at cloudflare.com/web-analytics. Cloudflare may also set technical cookies necessary for security and bot mitigation (e.g., Turnstile), with no profiling.

When this site runs paid Google Ads campaigns, it also uses Google Ads conversion tracking (via Google's gtag.js) to measure whether a visitor who arrived from an ad went on to book a call. This sets cookies and is only activated with your consent, via Google Consent Mode v2:

  • On your first visit, a banner asks whether you accept measurement cookies or want necessary-only browsing. No ad-measurement cookie is set until you accept.
  • Your choice is stored in your browser (localStorage) and applied automatically on later visits. You can change it any time via "Cookie preferences" in the footer.
  • If you accept, Google may process your IP address, the ad you clicked, and the fact that you reached the booking step. Google acts as an independent controller for this processing. See Google's Privacy Policy.
  • Legal basis: Art. 6(1)(a) GDPR (consent).

14 Enrollment Platform: Connecting Gmail and Google Drive

I run an enrollment platform for training providers who are my clients. It sends emails to their participants, such as registration confirmations, payment reminders and practical information. A client can choose to send those emails from their own Gmail or Google Workspace mailbox. A client can also choose to receive a nightly copy of their own data in their own Google Drive, so they always hold their data themselves. This section explains what happens when an administrator connects either one ("Connect with Google" in the client portal). Both are optional and separate: connecting one does not connect the other.

  • What the platform asks Google for: for both connections, your email address (scopes openid and email), to know which account is connected. For the mailbox: permission to send email on your behalf (scope gmail.send). For Google Drive: access only to files the platform itself creates in your Drive (scope drive.file). Nothing more.
  • What it does with the mailbox: it only sends the emails your organisation has set up in the platform, to your own participants, from your connected address. It cannot and does not read, search, delete or modify any email in your mailbox, and it has no access to your contacts or calendar.
  • What it does with Google Drive: every night (or when you click "Make a copy now") it writes a copy of your organisation's own data from the platform to a folder "Klantenportaal frederikdaneels back-up" in your Drive: a Google Sheet to read, a database file, and a README. It replaces the Sheet each night and removes its own database files after 30 days. With drive.file, Google only lets the platform see and change the files it created itself. It cannot see, read or change any other file in your Drive. Keys of connected services (Mollie, Billit, Google) are never included in the copy.
  • What is stored: per connection the connected email address and an encrypted refresh token (AES-GCM, with a key held only as a platform secret); for the mailbox also the message ID Google returns for each sent email; for Google Drive the IDs of the folder and Sheet the platform created, and the date and outcome of the last copy. The short-lived access token is used in memory and never stored. Data is stored in a Cloudflare D1 database in the EU jurisdiction.
  • How long it is kept: the connected address and the token are kept only while the connection exists. The message ID and the sending address of each sent email are kept as part of your organisation's email history in the platform, so you can see what was sent to whom. They are deleted with the rest of your organisation's data at the end of the agreement, within 30 days, as set out in article 16 of the platform terms. Backups that contain them disappear automatically after 30 days.
  • No sharing, no other use: Google user data is not sold, not shared with third parties, not used for advertising, and not used to develop or train AI or machine-learning models. No person reads it, except where you ask me for support, where security or the law requires it, or where it is aggregated and anonymised for platform operations.
  • Limited Use: the platform's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
  • Disconnecting and deletion: an administrator can disconnect the mailbox or Google Drive in the client portal at any time. The platform then revokes its access at Google and deletes the stored token and address. Copies already in your Drive stay there: they are yours. You can also remove access yourself at myaccount.google.com/permissions; the platform then stops sending from your mailbox or writing to your Drive. To have any remaining data deleted, contact me via the details in section 02.
  • Legal basis: Art. 6(1)(b) GDPR (performance of the contract with my client). For participants' data, my client is the controller and I act as their processor.

15 Changes to This Policy

This Privacy Policy may be updated from time to time. The latest version applies.