Privacy statement
Most of this statement is about data we do not collect
This statement covers enquiries sent through this website and optional website statistics. Microsoft Clarity loads after you accept statistics. Google Analytics is not yet configured. The sections below explain the purpose, legal basis and retention for the data we process.
Who is responsible
The controller is Think Smart Europe B.V., in Amsterdam
One organisation decides what happens to the personal data described on this page, and it is the one you would be contracting with.
Think Smart Europe B.V. Vijzelstraat 68 1017 HL Amsterdam The Netherlands
Telephone +31 (0)20 210 1552 Email info@thinksmart.eu
For anything about your own data: access, correction, deletion, an objection, write to info@thinksmart.eu and put the word privacy in the subject line so it reaches the right person on the first pass rather than the third.
For a security weakness in this website, or in anything else of ours, write to info@thinksmart.eu. The responsible disclosure terms are in our security.txt, and we will not pursue anyone who investigates in good faith and gives us a reasonable chance to fix it first.
One boundary worth stating plainly, because it is the thing most privacy statements blur. This page covers the website and the enquiries that arrive through it. If you become a client, the personal data we process while running your service, accounts, endpoints, logs, incident records, is governed by the processing agreement that forms part of your contract. That agreement, not this page, is the document that decides what happens to it.
What is processed, and why
What we process and why
The table covers enquiries, abuse prevention, optional statistics and remembering your consent choice.
| Purpose | What is processed | Legal basis | How long it is kept |
|---|---|---|---|
| Answering an enquiry you send us | Your name, organisation, work email address, and the phone number, sector, size band and message if you fill them in | Legitimate interest, Article 6(1)(f), you asked us a question and expect an answer. Where the enquiry concerns a possible contract, Article 6(1)(b) applies as well. | Twelve months in the mailbox if the enquiry does not lead anywhere. If it becomes a client relationship, for the term of the contract and the Dutch statutory retention period that follows it. |
| Keeping the form from being abused | Your IP address, and a hidden field that only an automated script fills in | Legitimate interest, Article 6(1)(f), a public form with no protection becomes a relay for other people's spam within days | Not kept. The IP address is held in memory for the duration of the request and is not written to disk or to any log we can read. |
| Website statistics | Microsoft Clarity page interactions and pseudonymous session identifiers after acceptance | Consent, Article 6(1)(a). You can withdraw it through Change your choice in the footer. | See the cookie statement and Microsoft's retention policy. Google Analytics is not configured. |
| Remembering your answer to that banner | Your statistics choice, version, service IDs and date, stored locally under tse-consent | Not a cookie and not personal data we hold, it never leaves your device and is never sent with a request | Until you clear your browser's site data, or change your answer |
There is no fifth row for server logs, because we have none to write about. The hosting platform, Azure App Service, keeps no access logs for this site, so no record of your visit reaches us in a form we could read, search or keep.
The contact form
What happens to what you type, in order
The form is the only place on this site where you can give us personal data, so it is worth describing exactly rather than generally.
The form posts to a small function on this domain. Nothing is sent to a third-party form service, a marketing platform or a CRM, because there is no CRM behind it.
The function checks the message is well formed, rate-limits by IP address so the form cannot be used to send mail to strangers, relays the message to a mailbox inside the European Union, and then stores nothing. There is no database record, no ticket number and no copy on the web server.
Spam is handled by a hidden field that a person never sees and an automated script fills in. We use that rather than a third-party captcha specifically so that no part of your visit is handed to a captcha provider in order to prove that you are a person.
If the relay is unavailable, the page does not quietly swallow your message. It opens your own mail client with the text already in it, so the enquiry still reaches us and you still have a copy.
The trade-off is real and you should know about it. Because nothing is stored, we cannot show you a copy of your enquiry in a portal later, and if you ask us what you sent us we have to go and look in a mailbox like anyone else.
Cookies and your browser
Optional statistics, with a choice you can change
Microsoft Clarity loads only after you accept statistics. Decline keeps it off. Google Analytics is not configured and receives no data. You can change your choice in the footer.
Before you accept statistics, no analytics provider loads. Clarity is enabled for visitors who accept. It does not load on the NIS2 check, and contact-form content is masked. The form and the check work if you decline.
Use Change your choice in the footer to withdraw consent. We remove first-party analytics cookies and reload the page to stop the trackers. Your choice is remembered locally.
Fonts and images are hosted on this domain. Google Analytics is prepared but has no measurement ID, so it sends nothing. Search Console verification uses a static tag or DNS record and does not add visitor tracking.
Processors and transfers
Hosting, email and optional analytics
Hosting and email deliver the site and your enquiries. Clarity receives interaction data only after consent.
| Party | What it does | What it receives | Where |
|---|---|---|---|
| Microsoft, Azure App Service | Hosts the published files and runs the contact function | The web request itself, including your IP address, at the moment it is served. Microsoft processes connection data on its own infrastructure for delivery and platform security; that processing is not exposed to us. | An Azure region inside the European Union |
| Our email provider | Delivers and stores the relayed enquiry as an ordinary email | The contents of the form and your email address | Inside the European Union |
| Microsoft Clarity | Heatmaps and session recordings after consent | Page interactions and pseudonymous identifiers; contact-form content is masked | Microsoft Ireland Operations Limited; onward transfers to Microsoft Corporation in the US under standard contractual clauses (SCCs) |
Microsoft acts as an independent controller for Clarity. It describes the transfer arrangement in its Clarity privacy FAQ. Google Analytics is not configured. Enquiries from this website are not sent to our delivery centres in Bulgaria.
Your rights
Eight rights, and what each one means here
These come from the GDPR and apply to every organisation, including ones that hold very little. The second sentence of each card is what it actually amounts to given how this site works.
Access
You can ask what personal data we hold about you and receive a copy. In practice this means we search the mailbox for your address and send you what is there.
Rectification
You can have incorrect data corrected. If we have written your name or your organisation down wrongly, tell us and we will fix it in the record we hold.
Erasure
You can ask us to delete your data. We will, unless a statutory retention duty applies to an invoice or a contract record, in which case we will tell you which one and for how long.
Restriction
You can ask us to stop using your data while a dispute about its accuracy or our basis for holding it is being resolved.
Portability
Where processing rests on consent or a contract, you can receive your data in a machine-readable form. For a website enquiry this amounts to a copy of your own message.
Objection
Where we rely on legitimate interest, you can object and we then have to stop unless we can show compelling grounds that override your interest. For a marketing approach there is no such override.
Withdrawing consent
You can withdraw statistics consent through Change your choice in the footer, then Decline. This stops future collection; it does not automatically erase data already collected. For deletion requests, contact info@thinksmart.eu.
No automated decisions about you
We take none. Nothing on this site scores, profiles or ranks you, and the NIS2 check produces an indication for you to read, in your browser, not a decision we act on.
How to exercise them
One email address, one month, and no copy of your passport
A right you cannot use without effort is not much of a right, so the route is deliberately short.
Write to info@thinksmart.eu with privacy in the subject line and tell us what you want. We respond within one month, as the GDPR requires, and if a request is genuinely complex we will tell you inside that month that we need longer and why.
We will ask enough to be sure the request is really yours and no more. We will not ask you to email us a copy of your identity document, because collecting more personal data in order to answer a question about personal data is the wrong shape.
If you are not satisfied, tell us first if you are willing; a complaint we never hear about is one we cannot fix. You do not have to. You have the right to lodge a complaint with the Dutch supervisory authority at any time.
Autoriteit Persoonsgegevens Postbus 93374, 2509 AJ Den Haag autoriteitpersoonsgegevens.nl
If personal data we hold is ever breached, we report it to the Autoriteit Persoonsgegevens within 72 hours where the GDPR requires it, and we tell the people affected directly where the risk to them is high. We would apply to ourselves the standard we ask our clients to meet.
The questions people actually ask
Including the one about Bulgaria
You deliver from Bulgaria. Does my data go there?
Not from this website. The pages are served from an Azure region inside the European Union and an enquiry from the form is relayed to a mailbox inside the European Union. Neither route passes through our delivery centres.
For client data the answer is different. Our engineering and monitoring capacity is in Sofia, Varna and Stara Zagora, and colleagues there work on client systems. Bulgaria is a member state of the European Union, so that is not a third-country transfer at all, it is processing inside the EU, under the GDPR, under the same management systems and the same access controls as Amsterdam. Nearshore, not offshore.
Which colleagues may see what, and under which controls, is set out in the processing agreement that forms part of a service contract. That is the document to read before you sign, and we will send it before you ask.
Why is there a cookie banner?
We use Microsoft Clarity for optional statistics. Accept lets it load; Decline keeps it off. Your choice is remembered. Use Change your choice in the footer to reopen the banner at any time.
If I use the form, do I end up on a mailing list?
No. There is no mailing list, no marketing automation and no CRM behind the form. Your message is relayed to a mailbox and answered by a person.
If we ever start sending a newsletter, it will be a separate opt-in with its own tick box, and using the contact form will not be it.
The NIS2 check asks about my sector and my size. Where does that go?
Nowhere. The questions, the branching logic and the outcome all run in your browser. Nothing is sent to us, nothing is stored, and we cannot see that you took it or what came out.
If you want to discuss the result, you paste it into the contact form yourself. That is the only way it reaches us.
How do I check that any of this is true?
Before accepting, reload the page with your browser's Network panel open. There should be no requests to Clarity or Google Analytics. After accepting, Clarity requests and cookies may appear. Decline through the footer to stop tracking. The localStorage entry tse-consent records your choice; tse-lang and the sessionStorage entry tse-hero store display preferences.
Do you have to answer me if I am not a client?
Yes. The rights above belong to you as a person, not to you as a customer, and they apply whether you have ever spoken to us or simply sent one question through the form.
Changes
When this statement changes, and why it would
We update this statement when the site changes.
This version is dated 13 October 2026. It reflects Clarity's activation behind consent and the controls for withdrawal. Google Analytics and Search Console are awaiting their identifiers. We update these statements when the configured services or their use changes.
If something here does not match what your browser sees, tell us
A privacy statement is a claim like any other, and this one is written so that you can check it rather than believe it. Anything you find that we have got wrong is worth an email.