Privacy notice

Version 1.0 · effective from 3 October 2026

This notice explains which personal data I process through peakpromotion.nl and in my dealings with customers. It also applies to my CV and portfolio at joppealtingsiberg.peakpromotion.nl. Each section states why, on what legal basis, for how long, and who else sees the data. Your rights are explained at the bottom.

Who I am

Peak Promotion is my sole-trader business. I am Joppe Alting Siberg. I am responsible for the processing in this notice (the legal term is data controller).

• Peak Promotion, Joppe Alting Siberg (sole trader)
• Address: Generaal Kraijenhoffstraat 36, 1411 BE Naarden
• Chamber of Commerce 42128588
• Email: info@peakpromotion.nl
• WhatsApp: Peak Promotion

Privacy questions or a request about your data? Email info@peakpromotion.nl.

I do not have a data protection officer. My business is not required to have one.

If I work with data about your customers, employees or guests, for example in an AI assistant, automation or video, we establish our GDPR roles beforehand based on who determines the purposes and means. If I only act on your business's behalf, we sign a data processing agreement before processing. If responsibility is independent or shared, we record the appropriate arrangements. This notice describes my own processing.

At a glance

• No account is needed for the public website. I do not send newsletters or advertising without your separate consent.
• A message through the form only goes to my mailbox. If nothing follows, I delete it within 1 year.
• To prevent misuse, my database only stores your IP address as a code made with a secret key. That code is deleted within 30 days at the latest. It then remains in automatic backups for up to another 30 days. Cloudflare does see your IP address for hosting and security. Cloudflare's own retention periods apply to its technical logs; these are separate from those of my database.
• Text goes to Cloudflare Workers AI for the AI check and chat. I do not keep chat messages.
• The site itself does not set cookies.

1. Contact form: request a call, report an issue with a report or request an AI check

The contact form on the homepage and on /contact has three modes: request a call (the standard mode), report an issue with or request removal of a free AI check report (/contact?onderwerp=rapport), and request an AI check by email if the report cannot be generated automatically.

Which data:

• For a call request: your name, business name, website (or "I do not have a website yet"), email address, phone number, selection, best time to call, message and optionally your answer to "How did you find me?".
• For a report issue or check request: your name, email address and message (for a check request, also the site's domain, which is prefilled).

I do not use your data for advertising or newsletters.

Purpose:

• call request: prepare the conversation you requested;
• report issue or check request: handle it;
• your answer to "How did you find me?": track how people find me. I only look at aggregated totals.

Legal basis: legitimate interest (Article 6(1)(f) GDPR). My interest is preparing the conversation you requested and finding customers. For "How did you find me?", my interest is knowing which channels work. If you become a customer, the legal basis is also steps prior to a contract (Article 6(1)(b) GDPR).

Profiling: if you fill in the form to request a call, I look at your website's public homepage beforehand (see part 4) and AI briefly estimates which of my services fit your business. This is profiling. I do not use it to make a decision about you: I call everyone who fills in the form. See also "No decisions made solely by a computer".

Retention: the form does not store anything in a database. Your message and, for call requests, the briefing go to my mailbox by email. If no assignment follows, I delete them within 1 year. If an assignment follows, only the form goes into your customer file (part 8), not the AI briefing.

Who sees it: Cloudflare (forwards the email and protects the form with Turnstile), Google (my mailbox is a Gmail account) and, only for call requests, Cloudflare Workers AI (your business name, selection, message without contact details and homepage text; Cloudflare processes the text to generate the answer and does not use the content to train models without explicit consent). See the "Recipients" table.

Must you provide this? For a call, your name, business name, email address, phone number and website are required (the website is not required if you select "I do not have a website yet"); your message is optional. The phone number is needed to call you back; if you prefer not to be called, email or WhatsApp me. Only your name and email address are required for a report issue or check request.

2. Security and preventing misuse

This applies to the contact form, AI check and chat.

Which data:

• Your IP address. My database does not store it directly. I turn it into a code using a secret key (an HMAC). I do the same for the network part of your IP address (a group of addresses). This code is pseudonymised personal data.
• Counters: how often that code used the form, check or chat.
• Only when sending a chat message: a random 128-bit browser code, valid for 30 days. The server keeps an HMAC of it for a daily limit. No browser fingerprint. See the cookie notice.
• For the check: which domain is linked to that code (one new site per internet connection every 30 days; an already checked site does not count, see part 3).
• Cloudflare Turnstile reads your IP address and browser and connection characteristics, such as User-Agent, for the form, check and chat. Turnstile only loads when you use one of these three.

Purpose: prevent spam, bots and overload, and limit the costs of the AI services.

Legal basis: legitimate interest (Article 6(1)(f) GDPR). My interest is keeping the site and free services safe and usable.

Retention: up to 30 days. An automatic task deletes expired codes and counters daily. They then remain in automatic database backups for up to another 30 days. I cannot delete those backups earlier.

Who sees it: Cloudflare. For Turnstile, Cloudflare is my processor. Cloudflare also uses Turnstile's signals itself to improve its bot detection, for which it is responsible. Because Turnstile runs on my site, Cloudflare and I are jointly responsible for collecting and sharing those signals. You can contact either me or Cloudflare with a question or request about this. Also read the Cloudflare Turnstile Privacy Addendum.

Good to know: because I only have the code, I usually cannot link it to you. If you request access, I therefore often cannot find this data (Article 11(2) GDPR).

3. Free AI check: when you request a check yourself

Which data: the domain you enter, and the code and counters from part 2. You do not need to provide an email address or create an account.

Purpose: run the check, show you the result and limit usage to one new site per internet connection every 30 days. An already checked site does not count. An unsuccessful check does not count either.

Legal basis: legitimate interest (Article 6(1)(f) GDPR). My interest is showing businesses how AI services read their sites and finding customers.

Retention: see part 2 for the code and counters. For the check result, see part 4.

Who sees it: Cloudflare and the AI service (see part 4 and the table).

4. Free AI check: when your site has been checked

Someone can request a check of your site. I then get that data from your public website, not from you.

Source: public parts of your site: robots.txt, /.well-known/tdmrep.json, the homepage, whether there is a sitemap.xml and whether there is a llms.txt . If your site redirects to another address, I follow at most 3 redirects; if one leads to another domain, I stop there and fetch nothing from that other domain. If a connection over https fails, I try robots.txt and the homepage once each over http. I do not follow links on the page.

Which data: for a limited company or another incorporated business, this is usually not personal data. A sole trader's or freelancer's homepage may contain personal data, such as a name, phone number, email address, photo or names in reviews. The domain name itself may also relate to a person.

What I do with it:

• My bot is called PeakPromotionCheck/1.0. If your robots.txt blocks that bot, or all bots without a specific rule for PeakPromotionCheck , if your robots.txt returns a server error or "too many requests" (429), does not respond in time or cannot be reached, I fetch nothing else. No text goes to an AI service. If your robots.txt only blocks a path, I do not fetch that file.
• If your site refuses AI use through Content-Signal: ai-input=no, a TDM reservation or noai, no text goes to an AI service.
• Otherwise I read the visible text of your homepage, only in memory. Before the text goes to the AI service, I remove email addresses, phone numbers and bank account numbers.
• The text goes to Cloudflare Workers AI once for a short explanation. I ask the AI service not to name people. I do not keep the text afterwards. Cloudflare processes the content under its Workers AI terms and does not use it to train models without explicit consent.

What I keep: the results per domain: the status of each check, title and description lengths, whether contact details are visible (only yes or no), and the AI explanation. I do not keep text from your site or contact details.

Purpose: give the requester a report about how well AI services can read the site.

Legal basis: legitimate interest (Article 6(1)(f) GDPR). My interest is giving businesses a free report and finding customers. I limit it to public pages, the homepage and as little data as possible.

Retention: a successful check for 30 days, including when your site refuses AI use and only fixed checks are available. An unsuccessful check for 1 hour: your site refuses automated analysis, your robots.txt cannot be reached, the check is blocked, had to stop, or your site redirects to another domain. Then up to another 30 days in automatic backups. If your domain is on the blocklist, I keep no results at all.

Who sees it: only people who enter your site themselves in the check on this website (on the homepage or on /ai-check) see the report. Within 30 days, everyone who does so receives the same stored report. If you request a check through the form, I run it myself and email you the report. That email remains in my mailbox as described in part 1. There is no public link and I do not publish reports. Also Cloudflare (hosting and database) and the AI service (see the table).

Has someone entered your site in my contact form? The same bot also looks at your homepage to prepare that conversation. That briefing remains in my mailbox (Gmail) for up to 1 year. An objection also adds your domain to the blocklist for this purpose.

Objecting or requesting removal: send me a message through the contact form or email info@peakpromotion.nl. I delete the results and add your domain to a blocklist so it is not checked again. The list only contains the domain. It remains there for as long as your objection applies. If you want it removed, email me. I aim to reply within 2 working days and handle it within 1 month at the latest.

Why I do not inform you separately: I do not know the owner of every checked site. Informing everyone separately would involve disproportionate effort (Article 14(5)(b) GDPR). That is why this explanation is public, here and on /ai-check.

5. AI assistant (chat)

Which data:

• The messages you type. Each request includes at most your last 10 messages, each up to 500 characters.
• The codes and counters from part 2: up to 30 questions per internet connection and 10 per browser per day. A daily and monthly ceiling also applies to all visitors combined. It grows within limits with the total number of active subscriptions in my customer portal. The chat only receives that number, no names or account details.
• A temporary session code. It only lives in your browser's memory and expires after 30 minutes or when you close the page.

Purpose: answer your questions about my services.

Legal basis: legitimate interest (Article 6(1)(f) GDPR). My interest is giving visitors quick answers and finding customers. If you ask about an assignment for your own business, also steps prior to a contract (Article 6(1)(b) GDPR).

Retention: I do not keep your messages, including in logs. Cloudflare processes the content under its Workers AI terms and does not use it to train models without explicit consent. The chat's IP and browser counters are deleted within three days at the latest. Daily and monthly totals contain no visitor code and are deleted within 34 days at the latest. Automatic backups remain available for up to another 30 days (see part 2).

Who sees it: Cloudflare, including Workers AI (see the table).

Tip: do not share personal information in the chat. Prefer a person? Use the "Send Joppe a message" button.

6. Statistics

I use Cloudflare Web Analytics. It counts visits and measures how quickly pages load. It sets no cookies, builds no visitor profiles and does not track you across other sites. I only see aggregated figures, no data per person. Your IP address does technically pass through Cloudflare as my processor.

Legal basis: legitimate interest (Article 6(1)(f) GDPR). My interest is knowing how the site is used and keeping it fast.

My website code also counts which fixed pages and buttons are used, for example the customer portal button. I only keep a date (UTC), a fixed event name and the total for that day. No IP addresses, browser information, full web addresses, referring sites, form contents, session codes or data per visitor. The totals remain for 31 days and are only available to me. This counts events, not unique visitors. The counter uses no cookies or local storage and respects Do Not Track and Global Privacy Control. I do not link these figures to customer data. I review and approve any improvements based on these figures myself.

7. Hosting and technical logs

On every visit, Cloudflare receives your IP address, the requested page, the time and browser information. This is necessary to display and protect the site. Automatic Workers invocation logs are disabled in my website configuration. My own website code does not log form fields or chat messages. Cloudflare may also process technical data to operate and protect its network, under its own retention periods. The database retention periods above do not apply to that data. Also read the Cloudflare privacy policy.

Legal basis: legitimate interest (Article 6(1)(f) GDPR). My interest is a working, secure site.

8. Email, WhatsApp and customers

Email: if you email me at info@peakpromotion.nl, Cloudflare forwards your email to my Gmail mailbox (Google). If no assignment follows, I delete your email within 1 year.

WhatsApp: if you message me through WhatsApp, I only use your number or username and messages to reply. I use WhatsApp Business. WhatsApp Ireland processes those messages for me as a processor. If no assignment follows, I delete the conversation within 1 year.

Customers: if you become a customer, I keep your details in your customer file.

• Quotations, order confirmations, invoices and payments are part of my business records. I keep them for 7 years, as required by tax law.
• I keep other emails and contact person details for up to 2 years after the assignment ends.

Legal basis: legitimate interest for ordinary email and WhatsApp (Article 6(1)(f) GDPR). My interest is answering questions and finding customers. For customers: performance of the contract (Article 6(1)(b) GDPR) and, for business records, a legal obligation (Article 6(1)(c) GDPR). For contact persons at a customer: legitimate interest in carrying out the assignment.

Peak Portal: for access to the customer portal, you accept the account terms separately. I keep your user ID, the accepted version, language, text checksum and date/time. This lets me establish which text you accepted; I do not store an IP address for this. This record is deleted when your account is deleted. The portal privacy notice describes other account data. This agreement is not consent for advertising or AI training.

9. Recognisable people in my work

Recognisable people only appear in videos or photos on my site with their written consent. I make people who have not consented unrecognisable. I always make children and other minors unrecognisable.

Legal basis: consent (Article 6(1)(a) GDPR). You may withdraw consent at any time. I then remove the image.

Recipients and transfers outside the EU

I only share your data with the parties below, or others if the law requires me to do so.

I have data processing agreements with the processors in this table. I do not have one for my Gmail account (see the table).

Transfers to the US: when I send data to the US, I use the DPF if the recipient is certified under it. Otherwise I use the European Commission's standard contractual clauses (SCCs) or the transfer arrangements in the table. Want a copy of the SCCs? Email me and I will send it. If the DPF ceases to apply, Cloudflare's SCCs in my data processing agreement apply.

Cookies

peakpromotion.nl itself does not set cookies. I do not use tracking or advertising cookies. That is why there is no cookie banner.

What the site does use:

• Cloudflare Turnstile protects the form, check and chat. Cloudflare may use cookies or local storage inside the Turnstile frame.
• Cloudflare Web Analytics reads loading times and basic visit information (page, referring site, browser type) and sends it to Cloudflare without cookies or local storage.
• The chat uses a temporary session code in your browser's memory.

This is needed to operate and protect the site, or counts visits without tracking you. That is why I do not ask for consent. All details are in my cookie notice.

AI on this site

Peak Promotion (Joppe Alting Siberg) provides the AI explanations in the check and the chat assistant. Before your first chat message, you see that you are talking to AI. Text produced by AI is marked as AI-generated on the page and in the technical data.

No decisions made solely by a computer

I do not make decisions about you solely by a computer that have legal or similarly significant effects on you (Article 22 GDPR). The limits and Turnstile only prevent misuse. If something fails, you can always contact me.

Security

I protect your data in ways including:

• The site only works over an encrypted connection (HTTPS).
• Accounts at Cloudflare, the AI service and my email provider have two-step verification.
• Secret keys are not in the code, and I grant as few permissions as possible.
• Form fields and chat messages are not logged.
• My laptop and phone are encrypted and receive updates.

If something does go wrong with your data (a data breach), I report it to the Dutch Data Protection Authority within 72 hours, unless the breach is unlikely to pose a risk. If the risk to you is high, I also inform you. I record every breach, including those I do not have to report. I keep that record for 5 years.

Your rights

You have these rights regarding your personal data:

• Access: you may know which data I hold about you.
• Rectification: you may have inaccurate data corrected.
• Erasure: you may ask for your data to be deleted.
• Restriction: you may ask me to temporarily stop using your data.
• Portability: you may receive data you provided to me in a commonly used file format, if I process it for a contract or with your consent.
• Withdrawing consent: if you gave consent, you may withdraw it at any time.

Some rights do not always apply, for example if the law requires me to retain data. I will explain why.

Objecting

If I process your data based on legitimate interest (wherever this is stated above), you may object. I then stop, unless I have compelling reasons to continue. If you own a checked site, I delete the results and do not check your site again (see part 4).

How to exercise your rights

Email info@peakpromotion.nl. You will receive a reply within 1 month, free of charge. I may ask you to show that the data concerns you. I will ask for no more than necessary. I keep your request and my reply for 5 years to show how I handled it.

Complaint

If you are unhappy with how I handle your data, please tell me first so we can find a solution together. You may also always complain to the supervisory authority: the Dutch Data Protection Authority.

Changes

If the way I process data changes, I update this notice. I review it at least once a year. The version and date are always at the top.

Version 1.0 · 3 October 2026