Privacy policy
Version 1.0 ยท Last updated: 1 October 2026
This policy explains what personal data we collect through olunda.com, why we collect it, and what you can do about it. The short version is this. We only collect what you choose to send us. We don't use tracking, analytics or advertising cookies. We don't sell your data or share it for marketing.
Who we are
Olunda is a trade name of Carmona Unlimited B.V., registered with the Netherlands Chamber of Commerce (KvK) under number 96517190, at Dirk Hoogenraadstraat 91, 2586 TD The Hague, the Netherlands.
Carmona Unlimited B.V. is the controller for the personal data described in this policy. That means we decide what is collected and why, and we are responsible for handling it properly.
This policy covers olunda.com.
For anything about your data, email us at info@olunda.com.
What we collect
1. When you use the contact form
- your name
- your email address
- your organisation, if you fill it in
- your message
- the date and time you sent it
Please don't put sensitive information in your message, such as details about health, religion or political views. We don't need it to answer you.
2. When you do the Free automation scan
The Free automation scan is a form on our own website, at olunda.com/scan/. It is handled in the same way as the contact form. We collect:
- your answers to seven questions about your organisation and your work: your sector, the size of your team, the tools you use, where the manual work is, a rough estimate of the time it takes, what goes wrong, and what you have already tried
- your answer to one optional open question
- your name and email address
- your organisation, if you fill it in
- the date and time you sent it
Please don't include personal data about your customers or staff in your answers, such as names or contact details. We only need to understand how your work is organised.
Spam protection on both forms
To stop the forms being abused, we keep a scrambled (hashed) version of your IP address for one hour. It is only used to allow no more than five submissions per hour from the same connection. Both forms also contain a hidden field that catches spam bots. It collects nothing about you.
3. When you visit the website
Like any website, our hosting provider's web server automatically records some technical data when you visit. This includes your IP address, the date and time, the page you asked for, your browser type and the page that referred you. These are called server logs.
4. If we start working together
If a conversation turns into an assignment, we move your contact details into our client administration. That relationship is covered by our agreement with you, not by this website policy.
Cookies
olunda.com does not place cookies on your device when you visit it. That includes the contact form and the Free automation scan. We don't use analytics, tracking pixels, advertising cookies or social media plugins. Our fonts and files are served from our own website, so your browser doesn't contact Google Fonts or any other external content network.
The only cookies the site uses are strictly necessary login cookies for our own administrators when they sign in to manage the website. Visitors never get these. Because we place no cookies on visitors' devices, you won't see a cookie banner.
Why we collect it, and our legal basis
| What | Why | Legal basis (GDPR) |
|---|---|---|
| Contact form | To read and answer your message. If you ask about working with us, to discuss what that could look like. | If your message is about a possible assignment: steps taken at your request before entering into a contract (Article 6(1)(b)). Otherwise: our legitimate interest in answering the questions people send us (Article 6(1)(f)). |
| Free automation scan | So that one of us can read your answers, give you a short read on where you stand and, if it looks like a good fit, invite you for a call. | Steps taken at your request before entering into a contract (Article 6(1)(b)). |
| Hashed IP address (both forms) | To prevent spam and abuse of the forms. | Our legitimate interest in keeping the website secure (Article 6(1)(f)). |
| Server logs | To deliver the website, keep it secure and find faults. | Our legitimate interest in running a secure, working website (Article 6(1)(f)). |
We don't use your data for newsletters or mailing lists. We don't build profiles of visitors. We don't enter your messages, your scan answers or your contact details into external AI tools.
How long we keep it
| Data | How long |
|---|---|
| Contact form messages and scan responses (on the website) | Automatically deleted after 180 days |
| Email notifications of those messages and scans (in our mailbox) | Automatically deleted after 180 days |
| Our list of enquiries (in Microsoft 365), if no assignment follows | Automatically deleted after 180 days. Deleted entries are permanently removed within a further 93 days |
| Hashed IP address used for spam protection | 1 hour |
| Server logs at our hosting provider | A limited period, normally no longer than 30 days |
| Backups at our hosting provider | Deleted data can remain in backups for up to 14 days after deletion, and is then overwritten |
If your enquiry turns into an assignment, we keep what we need for as long as that relationship lasts. Invoicing records are kept for seven years, as Dutch tax law requires.
If you ask us to delete your data sooner, we will, unless the law requires us to keep it.
Who we share it with
We don't sell your personal data and we don't share it with advertisers.
We use two service providers who process data on our behalf. Each has a data processing agreement with us, and they may only use your data to provide their service to us.
| Provider | What they do for us | Where |
|---|---|---|
| TransIP B.V. | Hosts the website and its database (including contact form messages and scan responses), keeps backups and server logs. | the Netherlands |
| Microsoft (Microsoft 365) | Sends the email notification when a message or scan comes in, hosts the mailbox where we receive it, and hosts our list of enquiries. | European Union |
We only share your data with anyone else if the law requires us to, for example when a court or regulator orders it.
Transfers outside the European Economic Area
We store your data within the European Economic Area (EEA). Microsoft keeps our mailbox within its EU Data Boundary, but some limited transfers outside the EU can still happen, for example for security or support. They are covered by Microsoft's data protection terms, including the European Commission's standard contractual clauses.
Automated decisions
We don't make decisions about you based solely on automated processing, and we don't profile you. A person reads every message and every scan.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy of it
- correct data that is wrong or incomplete
- delete your data ("right to be forgotten")
- restrict how we use your data
- object to our use of your data, where we rely on legitimate interest
- data portability: receive the data you gave us in a common, machine-readable format, where we process it to take steps towards a contract
To use any of these rights, email info@olunda.com. It's free. We'll reply within one month. If a request is complex, we may extend that by up to two more months, and we'll tell you if we do. We may ask you to confirm your identity first, so we don't give your data to someone else.
Security
The website only uses an encrypted connection (HTTPS). Only a small number of people at Olunda can access contact messages and scan responses, and they sign in with two-step verification. We keep the website software up to date.
Complaints
If you're unhappy with how we handle your data, please tell us first at info@olunda.com. We'd like the chance to put it right.
You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens: autoriteitpersoonsgegevens.nl.
Changes to this policy
If we change how we handle personal data, for example by adding a new service provider, we'll update this page and change the version number and date at the top.
Version 1.0, 1 October 2026.