Privacy statement
Version October 2026
I build software for business clients and process as little personal data as possible. This page explains which data I process, why, how long I keep it and what your rights are.
Controller
- HustleCodes
- Mario Penterman
- Address
- Barchvenne 20, 7244 BM Barchem, the Netherlands
- KvK
- 42192195
- VAT
- NL005570109B50
- info@hustle.codes
Contact form, email and WhatsApp
When you fill in the contact form, I process your name, email address, your phone number and company name if you provide them, and your message. The form is handled by a script on Cloudflare and delivered to my mailbox as an email. Until delivery, the message sits briefly in a Cloudflare queue; if delivery fails, it stays there for a few days at most. I don’t store the message anywhere else and don’t send an automatic confirmation. The same applies when you email me directly.
When you send me a message on WhatsApp, I process your phone number, your name and profile photo as you set them in WhatsApp, and your messages. I use the WhatsApp Business app on my phone for this. The WhatsApp button on this site is a plain link: nothing from WhatsApp or Meta is loaded until you click it.
Purpose: to answer your question and, if you wish, discuss a quote or a collaboration. Legal basis: my legitimate interest in responding to your message (art. 6(1)(f) GDPR) and, once we discuss a project, the steps prior to entering into a contract (art. 6(1)(b) GDPR).
Retention: at most 12 months after our last contact. If the contact leads to a project, I keep the correspondence for the duration of the project and afterwards as long as my administration requires.
Spam check (Cloudflare Turnstile)
To prevent spam and abuse, the form uses Cloudflare Turnstile. Turnstile starts as soon as the form comes into view, even if you don’t fill anything in, and checks in the background whether the form is filled in by a human and processes technical data about your browser and your IP address for that. Turnstile sets no cookies and doesn’t track you across other websites. Cloudflare processes this data on my behalf.
Clients, quotes and invoices
When we work together, I process the contact details of you or your staff (name, role, business email and phone number), the data needed for quotes, contracts and invoices, and the correspondence about the project.
Purpose: carrying out the project, invoicing and staying in touch. Legal basis: performance of the contract (art. 6(1)(b) GDPR) and my legal obligation to keep records (art. 6(1)(c) GDPR).
Retention: I keep invoice and accounting data for 7 years, as the Dutch tax authority requires. Other correspondence I keep for up to 2 years after the project ends. My quotes, invoices and accounts run through accounting software that processes this data on my behalf.
Data in software I build for clients
In some projects I process personal data on behalf of my client, for example in an application I build or maintain for that client. The client is then the controller and I am the processor; the arrangements are set out in a data processing agreement with that client. If you have questions about your data in such an application, please contact the organisation that uses it.
Website, cookies and analytics
This website is hosted on Cloudflare. Cloudflare processes your IP address and technical data to deliver and secure the site, and keeps log files briefly for security purposes.
For visitor statistics I use Umami. It works without cookies and I only see aggregate numbers.
The website sets one functional cookie that remembers your language choice (valid for a year). No other cookies, so no tracking or advertising cookies and no cookie banner.
Who I share data with
I never sell your data. I only share it with suppliers that process it on my behalf: Cloudflare, Inc. (hosting, contact form, Turnstile and email routing), Umami Software, Inc. (analytics), my email provider and my accounting software. My email provider and accounting software keep your data in the EU or Switzerland. Cloudflare also processes data in the US; Cloudflare is certified under the EU-US Data Privacy Framework and uses the EU standard contractual clauses. Umami keeps the statistics in the EU; where the service requires a transfer outside the EU, the EU standard contractual clauses apply.
When you send me a WhatsApp message, it goes through WhatsApp Ireland Limited (part of Meta). Messages are end-to-end encrypted, but WhatsApp does process some data itself, such as your phone number and when you send messages, under its own terms and privacy policy, and also outside the EU. If you would rather avoid that, use the contact form or email me.
I also disclose data where the law requires it, for example to the Dutch tax authority.
Security
I protect data with appropriate measures: encrypted connections (TLS), two-factor authentication on my accounts, access limited to myself, and keeping no more than necessary.
Your rights
You have the right to access your data, have it corrected or deleted, restrict its processing, object, and receive it in a portable format. Send your request to info@hustle.codes; I respond within one month and may ask you to verify your identity.
If you’re unhappy with how I handle your data, you can lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Changes
I may update this statement, for example when I switch suppliers. The current version is always on this page. I inform current clients of significant changes by email.