Privacy Policy
Last updated: July 3, 2026
This policy explains what personal data Amanah Agency collects when you visit amanah.agency or get in touch with us, why we collect it, and what rights you have over it. We keep this in plain language on purpose. If anything is unclear, email us at info@amanah.agency and we'll clarify it.
1. Who we are
Amanah Agency is a web development agency serving clients in the Netherlands, Belgium, and beyond. For the purposes of data protection law, Amanah Agency is the "data controller" of the personal data described in this policy: the party responsible for deciding how and why your data is used. Contact: info@amanah.agency
2. What data we collect
We only collect personal data you choose to give us. There is no user account system and no database of visitor profiles: the two ways data reaches us are: Contact form (/contact): name, email address, phone number (optional), and your message. Start a Project form (/start-project): name, email address, company name, phone number (optional), the services and package tier you're interested in, and any project details you add. We also use cookies for site analytics and, only with your consent, session recording, covered in the Cookies section below.
3. Why we collect it, and our legal basis
We collect and process contact and start-project form data for one reason: to respond to your enquiry and, if it goes further, to prepare a proposal or deliver a project. The legal basis is Article 6(1)(b) GDPR (steps taken at your request prior to entering a contract) and, more broadly, our legitimate interest in running a responsive agency (Article 6(1)(f)). For analytics and marketing cookies, the legal basis is your consent (Article 6(1)(a)), which you give or refuse through the cookie banner. You can withdraw it at any time.
4. Cookies we use
When you first visit the site, a cookie banner lets you choose what you're comfortable with. We use three categories: Essential: needed for the site to work (e.g. remembering your cookie preference). Always on, no consent required. Analytics: helps us understand how the site is used, so we can improve it. Only loaded if you say yes. Sets cookies such as _ga, _gid, _gat (Google Analytics) and _clck, _clsk (Microsoft Clarity). Marketing: used for measuring and improving advertising relevance. Only loaded if you say yes. Your choice is stored in your browser's local storage, not sent to a server. If you decline or later withdraw analytics consent, we actively delete the analytics cookies listed above from your browser. You can change your mind anytime using the cookie settings button (bottom corner of every page) or by clearing your browser storage.
5. Who we share data with
We don't sell your data, ever. We do use a small number of specialist service providers ("processors") to run the site and respond to you: Resend: sends the emails generated by our contact and start-project forms (your enquiry to us, and your automatic confirmation email), from the email.amanah.agency subdomain. Resend processes your name, email, and message content solely to deliver that email. Google Analytics / Google Tag Manager: anonymised-where-possible website usage statistics (pages visited, general location, device type), only if you accept analytics cookies. Microsoft Clarity: session recordings and heatmaps that show us how visitors use the site (mouse movement, scrolling, clicks), only if you accept analytics cookies. Clarity is configured to mask sensitive form input by default. Google PageSpeed Insights: if you use our free website-analysis tool (/tools/website-check), the URL you submit is sent to Google's PageSpeed Insights API server-side to generate the report. No personal data is involved unless you choose to receive the full report by email, in which case your email address is handled the same way as our other forms, via Resend. Each of these providers processes data under its own privacy policy and only for the purpose we've engaged them for. We do not share your data with any other third party, and we never sell it for advertising.
6. International data transfers
Resend, Google, and Microsoft may process data on servers located outside the European Economic Area, including in the United States. Where that happens, it's covered by the provider's own EU-approved safeguards, typically the European Commission's Standard Contractual Clauses (SCCs), which require your data to be protected to a standard equivalent to the GDPR, regardless of where it's processed.
7. How long we keep your data
Contact and start-project enquiries: we keep the email thread in our mailbox for as long as reasonably needed to handle your enquiry and, if you become a client, for the life of that relationship plus a period afterward to meet our legal and accounting obligations (in the Netherlands, generally up to 7 years for financial records). We don't keep a separate database of form submissions beyond the email itself. Analytics data: Google Analytics and Microsoft Clarity retain usage data according to their own retention settings, generally 14 months for Google Analytics. Cookie consent preference: stored in your browser until you clear it or withdraw consent. If you'd like your enquiry data deleted sooner, just ask, see "Your rights" below.
8. Your rights
Under the GDPR, you have the right to: Access the personal data we hold about you. Correct it if it's inaccurate or incomplete. Erase it ("right to be forgotten"), subject to our legal retention obligations. Object to processing based on legitimate interest. Restrict processing in certain circumstances. Data portability: receive your data in a structured, machine-readable format. Withdraw consent at any time for anything based on consent, such as analytics cookies, without affecting processing that already happened. To exercise any of these, email info@amanah.agency. We'll respond within one month, as required by law. If you're unhappy with how we've handled your data, you also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the data protection authority in your own EU country of residence.
9. Security
The site is served entirely over HTTPS. Form submissions are rate-limited and filtered against automated spam before they ever reach a human inbox. We don't operate a database of customer data: form data lives in our email inbox, which is protected by our email provider's standard account security. No system is 100% secure, but we take reasonable, proportionate steps for a business of our size.
10. Children's privacy
This site is a business-to-business marketing site and isn't directed at children. We don't knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we'll delete it.
11. Changes to this policy
We may update this policy as our tools or obligations change. The "last updated" date at the top of this page always reflects the current version. For meaningful changes, we'll aim to make that visible on the site rather than quietly editing this page.
12. Contact us
Questions about this policy or your data? Email info@amanah.agency and we'll get back to you personally, no ticket systems, no chatbots.