Privacy Policy

PrivacyPolicy

Introduction

This Privacy Policy explains how TriggerHive ('we', 'us', 'our') collects, uses and protects your personal data when you use our website or services. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) and other applicable privacy legislation. This policy was last updated on 2 October 2026.

Controller

TriggerHive is a sole proprietorship of Gijs van Hout, located at Julianastraat 92, 5427 AW Boekel, the Netherlands. Registered with the Chamber of Commerce under number 97815829. We act as data controller for personal data collected through our website and services.

Role as Processor

When executing assignments for clients, TriggerHive may also act as a processor of personal data on behalf of the client. In that case, the client is the controller and TriggerHive processes data exclusively according to the client's instructions. For such processing activities, we enter into a separate Data Processing Agreement with the client, in which the specific arrangements regarding data processing, security and confidentiality are laid down.

Which Data We Collect

We may collect the following personal data: Name, Email address, Company name, Phone number, IP address and browser information, Information you provide in messages when you contact us, Billing details (address, VAT number), and Information necessary to provide our services. We receive most of this data because you provide it to us yourself, for example through the contact form, the appointment scheduler, or when you use our services. When you visit our website, we also process technical data such as your IP address, and with your consent, data via statistics and marketing cookies. How this works is explained below under 'Our Website' and 'Cookies'.

Legal Basis for Processing

We process your personal data on the basis of one or more of the following legal grounds: (a) Performance of a contract: to prepare quotations, provide services and send invoices; (b) Legal obligation: to comply with tax retention obligations (7 years); (c) Legitimate interest: to host and secure our website, prevent fraud and spam, measure visitor numbers without cookies and respond to enquiries and appointment requests you send us; (d) Consent: for statistics and marketing cookies (Google Analytics, Google Ads and Leadfeeder), for sharing a hash of your email address and phone number with Google Ads when you send a form, and for sending newsletters or marketing communications (only with your explicit opt-in). You can withdraw your consent at any time.

How We Use Your Data

We use your personal data for the following purposes: To prepare quotes and enter into agreements, To provide and improve our services, To respond to your questions and provide support, To send invoices and process payments, To send you information about our services (only with your explicit consent), To measure, with your consent, which ads lead to a request, To comply with legal obligations (such as tax retention requirements), To secure our website and prevent fraud. We will not use your data for purposes other than those for which it was collected, unless we have obtained your consent or are legally required to do so.

Retention Period

We retain your personal data only as long as necessary to fulfill the purposes for which they were collected: Invoices and financial data: 7 years (statutory tax retention obligation). Customer communication and project documentation: duration of the agreement plus 2 years. Project files and source code: duration of the project plus the warranty period, unless otherwise agreed. Website inquiries and appointment requests that do not lead to a business relationship: maximum 2 years. Requests for the free website check without follow-up, including the measurement and the screenshot: 1 year. Server log files: maximum 6 months. For cookies, the periods in the overview under 'Cookies' apply. We do not store the hash used for enhanced conversions ourselves (see 'Enhanced conversions').

Your Rights

Under the GDPR, you have the following rights regarding your personal data: Right of access to your data, Right to rectification of incorrect data, Right to erasure ('right to be forgotten'), Right to restriction of processing, Right to data portability, Right to object to processing, Right to withdraw consent at any time. To exercise these rights, you can contact us via gijs@triggerhive.com. We will respond to your request within 30 days. If you believe that we are not processing your data correctly, you have the right to lodge a complaint with the Dutch Data Protection Authority (www.autoriteitpersoonsgegevens.nl).

Data Security

We implement appropriate technical and organizational measures to protect your personal data, including: Encryption of data during transport (TLS/SSL) and storage. Two-factor authentication (2FA) on all systems that have access to personal data. Regular backups with encryption. Strict access control based on 'need-to-know'. Encrypted storage media (disk encryption). Regular evaluation and updating of our security practices.

Subprocessors

We use the following external service providers (subprocessors) who may have access to personal data: Hosting provider: for hosting our website and applications. Email provider: for business communication. Accounting service: for invoicing and financial administration. Version control (GitHub/GitLab): for software development. Project management tools: for project communication with clients. Which parties our website itself uses (Cloudflare, Resend, Google and Leadfeeder) is listed below under 'Our Website' and 'Cookies'. All these parties are contractually obliged to protect personal data in accordance with the GDPR. We never sell your personal data to third parties.

International Transfer

Some of our subprocessors are located outside the European Economic Area (EEA), particularly in the United States. For our website, these include Cloudflare, Resend and Google. For these transfers, we ensure appropriate safeguards: Service providers that are certified under the EU-US Data Privacy Framework, or Standard Contractual Clauses (SCCs) approved by the European Commission. Upon request, we can inform you which safeguards apply to specific transfers.

AI tools

In software development, we may use AI-assisted tools (such as GitHub Copilot or similar services) to improve code quality and efficiency. In doing so, we apply the following safeguards: We do not enter any personal data (names, email addresses, etc.) of end users or clients into these tools. Code snippets are anonymized before being submitted; no trade secrets, passwords, or API keys are shared. Where possible, we configure these tools not to use submitted data for model training.

Project Information

When executing development assignments, we may temporarily have access to the client's systems, databases or files. The following rules apply: We never use production data containing real personal data in test or development environments, unless strictly necessary and after written consent. Access to client systems is revoked immediately after completion of the project. Local copies of project files are deleted within 30 days after project completion, unless otherwise agreed or legally required. Specific agreements regarding data processing are recorded in the Data Processing Agreement.

Our Website

Below, each section describes what our website does with your data and which parties are involved.

Hosting and security (Cloudflare)

Our website runs on Cloudflare Pages by Cloudflare, Inc. (United States). To deliver the pages to you and protect the site from abuse, Cloudflare processes technical data such as your IP address, the time of your request and your browser. Images come from our own file server, which also runs on Cloudflare. The fonts are hosted on our own server; we do not load fonts from Google or other parties.

Visitor statistics without cookies (Cloudflare Web Analytics)

We count page visits with Cloudflare Web Analytics. This works without cookies and without local storage on your device, and does not track you across websites. We only see totals, such as the number of visits per page. Because nothing is stored on your device, this is independent of your cookie choice.

Contact Form

When you fill out the contact form, we ask for your name, email address and message, and optionally your phone number and company name. We send your message via the email service Resend (Resend, Inc., United States) as an email to our own mailbox, so that we can respond to you. The form is protected with Cloudflare Turnstile (see below). If you allowed marketing, a hash of your email address and phone number is also sent to Google when you submit (see 'Enhanced conversions').

Appointment Scheduler

When you request an appointment through the appointment scheduler, we ask for your first name, email address, the subject, the desired duration, whether you want to meet online or on location, and the times you select. Optionally, you provide your last name, company name and telephone number, and for an appointment on location the address. This data is sent via our own server to the TriggerHive platform, our own system in which we store and schedule appointment requests. In doing so, we pass on your IP address, solely to limit the number of requests per visitor and thus prevent abuse. If you allowed marketing, a hash of your email address and phone number is also sent to Google when you submit (see 'Enhanced conversions').

Free website check

When you request a free website check, we ask for your website address, your company name, your name and your email address. This data goes via our own server to the TriggerHive platform, where we record your request. We use your IP address only to limit the number of requests per visitor. For the check, we view your website as a visitor would: we measure the loading time, read the public DNS data of your domain and take a screenshot in phone format. To find your Google Business Profile, we send your company name and the address shown on your website to Google's Places API. The report is on a personal page, of which we send you the link by email. That link expires after 90 days. We track whether and how often the page is opened, without cookies. We use this data only for the check, the report and a possible follow-up conversation, not for newsletters. If you allowed marketing, a hash of your email address is also sent to Google when you submit (see 'Enhanced conversions'). The legal basis is your own request, as a step prior to a possible agreement. If there is no follow-up, we delete the check, the screenshot and your request after one year.

Spam Protection (Cloudflare Turnstile)

On the pages with the contact form, the appointment scheduler and the free website check, we use Cloudflare Turnstile to verify that a form is being submitted by a human. For this purpose, Turnstile processes your IP address and characteristics of your browser, among other things. It does not place cookies on our website and is not used for advertising. We do this on the basis of our legitimate interest to prevent spam and abuse.

Cookies

On your first visit, a cookie banner asks for your choice. There are three categories: necessary (always on), statistics, and marketing. Without your consent, we only place necessary cookies and do not load any scripts from Google or Leadfeeder.

Google Tag Manager and Consent Mode

If you give permission for statistics or marketing, we load Google Tag Manager from Google Ireland Limited. Via Google Tag Manager we load Google Analytics 4 (statistics) and the Google Ads tag (measuring advertising results). With Google Consent Mode we pass on your choice per category to Google. Google Analytics only places cookies if you allow statistics. Google Ads only places cookies and only uses your visit for advertising if you allow marketing; if marketing is off, the tag can at most pass on without cookies that there was a visit. If marketing is on, Google Ads can also use your visit to show you advertisements from TriggerHive later on other websites (remarketing). Google Analytics does not store full IP addresses and retains event data for a maximum of 14 months. More information: Google's privacy policy.

Enhanced conversions (Google Ads)

If you allow marketing and then send the contact form, the appointment scheduler or the request for the free website check, we send your email address and, if you filled it in, your phone number to Google. Not as readable text: your browser first turns them into a hash (SHA-256), a fixed string of characters from which the data cannot directly be read back. Your name, company name, address and message are not included.

The purpose is to measure which ads lead to a request. Google compares the hash with Google accounts that were signed in when someone saw or clicked one of our ads. This way a request still counts when a cookie can no longer do that.

The legal basis is your consent for marketing. You can withdraw it at any time via Cookie settings at the bottom of every page; after that, nothing is sent to Google with a new form. Without consent for marketing, the forms work as usual and none of this data goes to Google.

The recipient is Google Ireland Limited. For this hashed data, Google is our processor, under the Google Ads data processing terms; we are the controller. For ad measurement with cookies (see 'Google Tag Manager and Consent Mode'), Google is a controller in its own right. Google may also process the data in the United States; Google LLC is certified for this under the EU-US Data Privacy Framework (see 'International Transfer').

A hash is not anonymisation but pseudonymisation: the same email address always gives the same hash, which is what lets Google match it. The hash therefore remains personal data and is covered by this privacy policy and the GDPR.

We do not store the hash ourselves: it exists only briefly in your browser and then goes straight to Google. Google uses it to link a request to an ad, and retains and deletes it under its own terms. More information: about enhanced conversions and Google's privacy policy.

Leadfeeder

If you give consent for marketing, we will load Leadfeeder after the page loads, a service from Dealfront. Leadfeeder recognizes based on your IP address which company visits our website, and records which pages are viewed, when and how often. We use this to see which companies are interested in our services (B2B lead insight). We want to recognize companies, not individual persons. For this purpose, Leadfeeder places the cookie _lfa, which expires after 1 year, and stores _lfa_expiry in your browser's local storage. Leadfeeder Finland Oy (Finland, EU), part of Dealfront Group GmbH (Karlsruhe, Germany), processes this data as our processor; we are the data controller. Leadfeeder retains the data according to its own terms and deletes it as soon as it is no longer needed for this purpose. More information: Leadfeeder's (Dealfront) privacy notice and the role distribution for the Leadfeeder tracker. If you withdraw your consent for marketing via the cookie banner, Leadfeeder will stop and the site will immediately delete _lfa and _lfa_expiry.

Overview of cookies and local storage

  • th-consent (cookie, TriggerHive). Purpose: remembers your cookie choice. Retention period: 6 months. Category: necessary.
  • th_lang (local storage, TriggerHive). Purpose: remembers whether you want to see the Dutch or English site. Retention period: until you delete it yourself. Category: necessary.
  • cf_clearance (cookie, Cloudflare). Purpose: remembers that your browser has passed a Cloudflare security check, so it doesn't need to be repeated on every visit. Retention period: 1 year. Category: necessary.
  • _ga (cookie, Google Analytics). Purpose: distinguishes visitors for statistics. Retention period: 2 years. Category: statistics.
  • _ga_6PKK8DK1CZ (cookie, Google Analytics). Purpose: tracks the session for statistics. Retention period: 2 years. Category: statistics.
  • _gcl_au (cookie, Google Ads). Purpose: measures whether a visit from an advertisement leads to contact. Retention period: 90 days. Category: marketing.
  • _gcl_ls (local storage, Google Ads). Purpose: stores data about an ad click, to measure ad results. Retention period: until you delete it yourself. Category: marketing.
  • IDE (cookie from doubleclick.net, Google Ads). Purpose: displays and measures Google ads, including on other websites (remarketing). Retention period: 13 months. Category: marketing.
  • _lfa (cookie, Leadfeeder/Dealfront). Purpose: recognizes a returning visit for B2B lead insight. Retention period: 1 year. Category: marketing.
  • _lfa_expiry (local storage, Leadfeeder/Dealfront). Purpose: tracks the expiration date of _lfa. Retention period: same as _lfa. Category: marketing.

Change or withdraw your choice

You can change or withdraw your consent at any time. To do so, click on Cookie settings at the bottom of any page; the cookie banner will then reopen and you can adjust your choice. Until you give new consent, Google Tag Manager and Leadfeeder will not load. If you also want to remove the cookies from the overview, delete them through your browser settings. Withdrawal does not affect the processing that took place before the withdrawal.

Third-Party Websites

Our website may contain links to third-party websites, such as LinkedIn, Instagram, Facebook and WhatsApp. These links do not load anything from these parties unless you click on them. We are not responsible for the privacy practices of these external websites. We recommend that you read the privacy policy of each website you visit.

Changes to the Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of material changes by posting the new Privacy Policy on this page and updating the "last updated" date.

Contact Information

If you have any questions about this Privacy Policy or our data practices, please contact us at: Email: gijs@triggerhive.com, Phone: +31 6 17218887, Address: Julianastraat 92, 5427 AW Boekel, Netherlands.