Privacy Policy

I've read enough privacy policies to know most of them are written to protect the company rather than inform the reader. This one tries to do the opposite. If anything here is unclear, email me and I'll fix the wording.

Short version: I collect your email address if you hand it to me, I use analytics to see which tutorials are worth making more of, and I don't sell anything about you to anyone. Ever.

Ferdy.com is operated by Ferdy B.V., registered in the Netherlands under Chamber of Commerce (KvK) number KvK number, at registered address.

For questions about your data, or to exercise any of the rights listed further down, email privacy@ferdy.com. I answer these myself.

Under the GDPR I am the data controller for this website — meaning I decide what is collected and why, and I'm the one accountable for it.

Only a few things, and most of it is anonymous:

• Your email address — only if you subscribe to the newsletter. Nothing else is required; there's no name field, no company field.
• Analytics data — pages visited, roughly how long, which country, what kind of device, and where you arrived from. Aggregated, and not used to identify you.
• Anything you put in an email to me — kept as long as the conversation is useful, then deleted.
• Technical logs — my host records IP addresses and request data automatically, for security and diagnostics. These rotate out on the host's schedule.

The GDPR requires a lawful basis for every piece of processing. Here are mine, in plain terms:

• Newsletter — consent. You asked for it by entering your address. You can withdraw that consent at any time using the unsubscribe link in every email, and it takes effect immediately.
• Analytics — legitimate interest. I need to know which tutorials help people so I can make more of those and stop making the ones nobody watches. The data is aggregated and the impact on you is minimal.
• Security logs — legitimate interest. Keeping the site online and unbroken.
• Email correspondence — legitimate interest. You wrote to me; I need your address to write back.

I keep this list short on purpose. Every service here is a processor — they handle data on my instructions and can't use it for their own purposes.

• Omnisend — stores newsletter subscribers and sends the emails. They record whether an email was opened and whether a link was clicked, which is how I know if an issue landed.
• hosting provider — runs the server the site sits on.
• Google Fonts — typefaces are loaded from Google's servers, which means Google receives your IP address when a page loads. If you'd rather that didn't happen, the fonts can be self-hosted; I'm working on moving them.
• YouTube — tutorial videos are embedded in privacy-enhanced mode (youtube-nocookie.com), so YouTube sets no tracking cookies unless you press play. Once you play a video, YouTube's own privacy policy applies.
• analytics provider — the traffic statistics described above.

Some of these companies are based outside the EU. Where that's the case, transfers rely on the EU Standard Contractual Clauses or an adequacy decision.

This site sets no advertising or tracking cookies of its own. What you may encounter:

• Functional cookies — remembering a preference such as a filter you selected. No personal data, and they can't be used to identify you.
• Analytics cookies — if the analytics provider uses them, they're first-party and aggregated.
• YouTube cookies — only after you press play on an embedded video.
• Affiliate cookies — set by the merchant, not by me, when you follow an affiliate link. See the affiliate disclosure for detail.

You can clear or block cookies in your browser at any time. Nothing on this site breaks if you do.

• Newsletter address — until you unsubscribe, or after two years of never opening an email, whichever comes first. Dead addresses help nobody.
• Analytics — aggregated indefinitely, but it isn't linked to you personally.
• Emails — deleted once the conversation has clearly ended, generally within a year.
• Server logs — short-term, on the host's rotation schedule.

Under the GDPR you have the following rights, and exercising any of them is free:

• Access — ask what I hold about you. I'll send it.
• Rectification — have anything wrong corrected.
• Erasure — have it deleted. For the newsletter this is instant: use the unsubscribe link.
• Restriction — ask me to stop processing while something is disputed.
• Portability — receive your data in a machine-readable format.
• Objection — object to anything I've based on legitimate interest.
• Withdraw consent — at any moment, without needing a reason.

Email privacy@ferdy.com and I'll respond within 30 days, usually far sooner. If you're not satisfied with how I handle it, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl.

This site is aimed at adults building websites. I don't knowingly collect data from children under 16. If you believe a child has subscribed to the newsletter, email me and I'll remove the address immediately.

When something material changes I'll update the date at the top of this page and, if it affects you meaningfully, say so in the newsletter. I won't quietly broaden what I collect and hope nobody notices.