1. Who is responsible?
Jodo Bad is responsible for processing personal data through this website. If you have a privacy question or wish to exercise your rights, you can contact us using the contact details at the bottom of this page.
2. Which data do we process?
When you use the contact form, we may process:
- your name;
- your telephone number and/or email address;
- the service you selected;
- the content, status and handling of your request.
When you use the review form or share a review directly with Jodo Bad and consent to publication, we may also process:
- the publication name you selected;
- your optional town or city and the type of work carried out;
- your rating, review text, consent to publication and the way in which that consent was recorded;
- your email address, which is not made public and is used for security and, if necessary, to contact you about the submission;
- the moderation status and any public response from Jodo Bad.
Our technical service providers may also process data required for security and proper operation, such as the IP address, time, device, browser and requested page. Do not share medical data, identity documents or other sensitive information in a free-text field. To limit repeated review submissions, we retain a fingerprint of the email address and IP address that is calculated using a secret value and cannot be read directly; the IP address itself is not retained in the review database for this purpose.
3. Why do we process this data?
We use data to confirm receipt of your request, answer your question, contact you, prepare a possible quotation or assignment, limit spam and keep the website secure. We do this to take steps at your request before entering into a possible contract, to perform that contract and on the basis of our legitimate interest in answering questions and securing the website.
We process reviews to show customer experiences and, only after you have given explicit consent, to publish them on the website and respond to them. A review submitted through the website form appears immediately after an automated technical anti-spam check; this does not establish in advance that the author is in fact a customer. Spam, insults, personal data and demonstrably fabricated contributions may be hidden. Obvious email addresses, telephone numbers and postcodes in public review fields are rejected before publication. A critical review is not removed because of its low score. Jodo Bad may also record a review after you have shared it directly with us, for example via WhatsApp, email or a conversation. You may withdraw your consent at any time using our contact details.
We do not sell personal data and do not use your request for unsolicited advertising.
4. How long do we retain data?
We retain a contact request for as long as needed to handle the request and reasonable follow-up questions. If the request leads to a quotation, assignment or contract, relevant data may be needed for longer to perform it, pursue or defend a legal claim, or comply with a statutory record-keeping obligation. Assessment and deletion may be carried out manually.
We retain a hidden review no longer than necessary to deal carefully with the submission, possible misuse or a request from the author. A published review and the non-public contact address are retained while the consent remains valid and the review remains relevant. After consent is withdrawn, we stop publishing the review and delete the personal data as soon as there is no other valid reason to retain it.
5. With whom do we share data?
Only authorised people within Jodo Bad have access to requests. We use Vercel for hosting and Supabase for the database, storage and secure administration environment. We use Resend for an internal email notification about a new request or an immediately published review, and for the confirmation sent after a contact request. Resend may therefore temporarily process the content and contact details from your request or review. These providers may use approved subprocessors. Where data is processed outside the European Economic Area, appropriate safeguards must be in place. We otherwise share data only when required for our services or by a legal obligation.
The contact form and review form use Vercel BotID on its free basic level to identify automated submissions. Around the time a form is submitted, Vercel checks technical browser signals for this purpose. This check is used for security and spam prevention, not for advertising or visitor profiles.
When you open the quick-help button, we use Crisp for the chat function. Crisp processes the chat content and technical data needed to provide the session, notifications and replies. The chat function is loaded only after you open the button yourself.
6. Security
We use measures including encrypted connections, secure administrative access and access restrictions. No digital system can guarantee absolute security.
7. Cookies
The public website currently does not use cookies for advertising or visitor profiling. The restricted administration environment uses necessary session cookies to keep the administrator securely signed in.
After you open the chat, Crisp uses necessary storage to keep your chat session available during and between pages. Do not use the chat if you do not want this; you can also call us, use WhatsApp or complete the contact form.
8. Your rights
To the extent permitted by the GDPR, you may request access, rectification, erasure, restriction or transfer of your data, or object to its processing. We may ask for additional information to verify your identity securely. You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
If you have consented to a review, you may withdraw that consent by contacting us. Withdrawal is free of charge and does not affect the lawfulness of processing carried out before consent was withdrawn.
9. Changes
This policy may change when the website, our working methods or the law changes. The current version is always available on this page.