Privacy policy
Data controller
- Owner
- Nick Van de Velde (wwworthit)
- Tax ID (NIF)
- Z5176885G
- Registered address
- Avenida de Rumania 14, 03710 Calpe (Alicante), Spain
- nick@wwworthit.com
Purposes and legal basis
I only process personal data for these purposes:
- Your request through the form. I use your name, email address, your business, website and message to answer your request and prepare a proposal. I also keep your name, email address and, if you give it, your phone number in my client list in Notion. If you ask as a freelancer or private person, the legal basis is steps taken at your request before entering into a contract (GDPR art. 6(1)(b)). If you ask on behalf of a company or organisation, the legal basis is my legitimate interest in keeping in touch with that organisation (GDPR art. 6(1)(f) and art. 19 of the Spanish LOPDGDD).
- Security of the site and the form. Cloudflare processes technical data such as your IP address, browser and device. It uses this to deliver the site and to stop abuse and spam (Turnstile). The legal basis is my legitimate interest in a site that is secure and works (GDPR art. 6(1)(f)). Cloudflare also uses this data as an independent controller to improve its bot detection, not to profile you or for advertising.
- Prospecting. I write to businesses whose website I measured. What I use for that and how to opt out is explained below under Prospecting.
- Statistics. Google Analytics only measures how the site is used if you accept analytics cookies. The legal basis is your consent (GDPR art. 6(1)(a)). You can withdraw it at any time in the cookie settings; this does not affect what happened before. Cloudflare Web Analytics also counts how many pages are viewed, without cookies, without storing anything on your device and without recognising you. The legal basis is my legitimate interest in knowing whether the site is read (GDPR art. 6(1)(f)).
To answer your request I need your name, email address and message. Without them I cannot reply. The other fields are optional.
I do not use your data for advertising and make no automated decisions about you.
Prospecting: why you got an email from me
I write to businesses whose website I measured and where I found something specific that could work better. For that I use:
- the name of your business, your website address and your business address, as they appear publicly on OpenStreetMap or Google Maps;
- your business's general email address (such as info@ or contact@), as it appears on your own website or on OpenStreetMap, and for Belgian businesses the legal form and company number shown on your website;
- the results of a check of your homepage by my website check at check.wwworthit.com, including a screenshot of the page: speed, how it fits on a phone, a secure connection, and whether search engines may show it. For the speed test, the check only passes your website address to Google PageSpeed Insights.
I only email general business addresses, never a personal one. I don't buy email lists. Every email says that it is a commercial message. Emails to businesses in the United States also include my postal address.
The legal basis is my legitimate interest in offering businesses a service that matches what I measured on their website (GDPR art. 6(1)(f)). For Belgian businesses I also follow the rule that advertising by email to the general address of a company is allowed, as long as you can opt out at any time.
Opting out. Reply to my email with "no" or "unsubscribe" and I will never email you again. I read every reply before anything else goes out, so after you opt out you get nothing more. Businesses in Belgium get one short confirmation.
How long I keep it. If you don't reply, I delete your details after 6 months. If you do reply, I keep our contact for 12 months, or longer if you become a client. After an opt-out I delete your details within 7 days and only keep an unreadable code of your address and domain, so I never write to you again. The fact that I emailed you is kept for 12 months, so I don't write to you again in that period. Details from Google Maps and my overview lists are deleted after 30 days. The website check report disappears after 90 days. I delete my outgoing emails and your replies from my mailbox after 12 months at most.
Recipients and rights. Vimexx handles my email, Cloudflare runs the website check and Google measures the speed (see the recipients below). Your rights are listed at the bottom of this page. If your business is based in Belgium, you can also complain to the Belgian Data Protection Authority (dataprotectionauthority.be).
Retention period
The website itself stores nothing. A request sent through the form arrives as an email in my mailbox, and your name, phone number and email go into my client list in Notion. If no project follows, I delete it in both places after 12 months. If you become a client, I keep it for as long as we work together and after that for as long as the law requires for invoices.
The site's technical logs contain no form content and are deleted after at most 7 days. Google Analytics keeps statistics for 14 months. Your cookie choice is stored in your browser for 1 year. CookieYes keeps proof of that choice for as long as needed to show your consent.
Recipients and processors
| Name | Purpose | Country |
|---|---|---|
| Cloudflare, Inc. | hosting, security, form, statistics without cookies (Web Analytics) | US (EU-US Data Privacy Framework) |
| Vimexx | mailbox that receives the forms and sends and receives my email | Netherlands |
| Google Ireland Ltd. / Google LLC | statistics after consent (GA4, Tag Manager); speed test of a prospect's website (PageSpeed Insights, website address only) | Ireland / US |
| CookieYes Ltd. | consent management | UK |
| Notion Labs, Inc. | client list (name, phone, email) | US |
| Sanity AS | content management | Norway / US |
I don't share your data with anyone other than these recipients, and I never sell it. I only pass it on to an authority when the law requires it.
International transfers
Some recipients process data outside the European Economic Area:
- Cloudflare and Google may process data in the United States. Both are certified under the EU-US Data Privacy Framework (adequacy decision (EU) 2023/1795).
- Sanity may process data in the United States on the basis of the European Commission's standard contractual clauses.
- Notion may process data in the United States on the basis of the European Commission's standard contractual clauses in its data processing agreement.
- CookieYes is based in the United Kingdom, which is covered by an adequacy decision (Implementing Decision (EU) 2025/2574).
You can request a copy of these safeguards at nick@wwworthit.com.
Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to nick@wwworthit.com. You can also lodge a complaint with the Spanish Data Protection Agency (aepd.es).
Images on this site
Some of the photos on this site, including photos of me, were made with artificial intelligence.