Legal
Privacy policy
We process as little personal data as possible and use no tracking, advertising networks or analytics cookies. Below you can read exactly what we do process, why, and for how long.
Last updated: August 2026
In short: we place no tracking or advertising cookies and do not measure your behaviour. We only process the data you provide yourself through the contact form or by email, plus the technical log files that every web server keeps.
1. Who is responsible for your data
JMNL Innovation is the data controller for the personal data processed through this website and through our services.
| Business | JMNL Innovation (sole proprietorship) |
|---|---|
| Address | Dorstseweg 25B, 4854 NA Bavel |
| Chamber of Commerce | 65677463 |
| info@jmnl.nl | |
| Website | jmnl.nl |
We are not required to appoint a data protection officer (DPO) and have not done so. You can direct privacy questions straight to info@jmnl.nl.
2. What data we process
2.1 Contact form
When you use the contact form on this website, we process the data you enter:
- Name — so we can address you personally;
- Email address — so we can reply;
- Organisation — optional, to put your question in context;
- Message — the content of your question.
In addition, your IP address, the time and the referring page are sent automatically when you submit. We use those details solely to counter misuse of the form (spam and automated submissions). The IP address is also used briefly in hashed form to count how many messages are sent per hour from the same address.
Please do not enter special categories of personal data in your message (such as data about health, religion or political opinions) and no confidential technical details about vulnerabilities. If you want to report a security issue, please use our responsible disclosure procedure.
2.2 Email and other correspondence
If you send us an email or contact us by telephone, we process the data you provide: your name, contact details and the content of your message.
2.3 Server logs
Like every web server, ours records technical data about each visit: IP address, date and time, the page requested, the HTTP status code, the amount of data transferred, the referring page and the browser type. These logs are needed for operation, security and troubleshooting. They are not used to profile individual visitors.
2.4 Client relationship
If you are a client or prospect, we also process the data needed to perform the agreement and to meet our administrative obligations: contact persons, correspondence, quotations, invoices and payment details.
3. Why we process that data
The General Data Protection Regulation (GDPR) requires us to have a legal basis for every processing operation. These are our processing activities and their bases:
| Processing | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|
| Contact form and email | Answering your question and maintaining contact | Legitimate interest (1(f)) — or, if your question leads to an assignment, performance of a contract (1(b)) |
| Spam and abuse prevention | Keeping the form usable | Legitimate interest (1(f)) |
| Server logs | Availability, security and troubleshooting | Legitimate interest (1(f)) |
| Carrying out assignments | Delivery of our services | Performance of a contract (1(b)) |
| Invoicing and accounting | Meeting the statutory retention obligation | Legal obligation (1(c)) |
| Security reports | Handling a responsible disclosure report | Legitimate interest (1(f)) |
We do not use your data for automated decision-making or profiling, and we do not send commercial newsletters unless you have expressly signed up for them.
4. How long we keep data
We do not keep data longer than necessary for the purpose for which it was collected.
| Data | Retention period |
|---|---|
| Contact form messages and email correspondence without follow-up | Maximum 24 months after the last contact |
| Correspondence that led to an assignment | For the duration of the assignment and afterwards for as long as needed for the file |
| Invoices and accounting records | 7 years (Dutch statutory tax retention obligation) |
| Server logs | Generally a maximum of 12 months, unless an incident requires longer investigation |
| Spam prevention counter (hashed IP address) | 1 hour |
| Responsible disclosure reports | Until the report has been handled and resolved, plus a maximum of 24 months for verification |
5. Cookies and local storage
This website places no cookies for tracking, statistics or advertising. No cookie banner is therefore needed.
We do store one technical preference in your browser's local storage:
| Name | Purpose | Retention |
|---|---|---|
jmnl-lang |
Remembers whether you view the site in Dutch, English or German | Until you clear your browser storage |
This value stays on your own device and is not sent to us or to third parties. You can remove it through your browser settings.
6. Third-party services
To display this website, some files are loaded from external servers. In doing so, the provider concerned necessarily sees your IP address, the time of your visit and information about your browser. We have no influence over this and receive no data from these parties ourselves.
| Service | Purpose | Provider |
|---|---|---|
| Google Fonts | Loading the Inter typeface | Google Ireland Limited / Google LLC (United States) |
| Tailwind CSS (CDN) | Loading the styling library | jsDelivr / Tailwind Labs |
For transfers of data to the United States, Google relies on the EU-US Data Privacy Framework. If you wish to avoid these connections, you can configure your browser to block external resources; the website will remain readable but will be displayed differently.
We also use a hosting provider that runs our website and email. That party processes data solely on our instructions and under a data processing agreement.
7. Sharing with others
We do not sell your data and do not share it with third parties for commercial purposes. We only provide data to others where necessary:
- to our hosting and email provider, as a processor;
- to our bookkeeper or accountant, for financial administration;
- where a legal obligation or court order requires us to do so.
With parties that process data on our instructions we conclude a data processing agreement, so that the same level of security and confidentiality is guaranteed.
8. Security
Security is our profession. We take appropriate technical and organisational measures to protect your data against loss and unlawful processing, including:
- encrypted connections (TLS/HTTPS) for the entire website and the contact form;
- data minimisation — we only ask for what we genuinely need;
- measures against automated misuse of the contact form;
- access to data only for those who need it for their work;
- timely installation of security updates.
Do you suspect that your data is not properly secured, or do you see signs of misuse? Please contact us at info@jmnl.nl. For technical vulnerabilities, use our responsible disclosure procedure.
9. Your rights
Under the GDPR you have the following rights:
- Access — you may request which data we process about you;
- Rectification — you may have incorrect data corrected or completed;
- Erasure — you may ask us to delete your data, insofar as no statutory retention obligation applies;
- Restriction — you may ask us to temporarily halt the processing;
- Objection — you may object to processing based on a legitimate interest;
- Portability — you may receive the data you provided in a common file format;
- Withdrawal of consent — if you have given consent, you may withdraw it at any time, without affecting the lawfulness of processing before that point.
Send a request to info@jmnl.nl. We respond within one month. To prevent us from providing data to the wrong person, we may ask you to make your identity plausible. We charge no fee for these requests.
10. Filing a complaint
If you disagree with the way we handle your data, we would like to hear it from you first so we can put it right. You also always have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens: autoriteitpersoonsgegevens.nl. If you live in another EU member state, you may also lodge a complaint with your local supervisory authority.
11. Changes to this policy
We may amend this privacy policy, for example when our services or the law change. The current version is always on this page, with the date of the last change at the top. In the event of significant changes we will actively inform existing clients.
Questions about this privacy policy? Get in touch via info@jmnl.nl or the contact form.