FREDERIK DANEELS
§ PRIVACY POLICY

Privacy Policy

Last updated: October 18, 2026

01 General Information

This Privacy Policy explains how personal data is collected and processed when you visit this website, submit the contact form, or book a call. "Personal data" means any information relating to an identified or identifiable natural person.

For definitions such as "processing" or "controller", we refer to Article 4 of the General Data Protection Regulation (GDPR).

02 Controller

Extra Paar Handen UG
Bocks Allee 9
32369 Rahden
Germany

Represented by: Frederik Daneels
Email: frederik@beyondfreelancing.com
Phone: +49 163 63 23 706

03 Categories of Data Processed

  • Contact data: name, email address, optional company name
  • Communication data: message content you submit via the contact form
  • Booking data: if you book a call via the self-hosted booking system at book.beyondfreelancing.com
  • Business / invoicing data: only if you become a client (billing address, VAT details, invoice history)
  • Technical data: IP address, date/time, browser information; typical server log data

04 Purposes of Processing

  • To respond to inquiries submitted via the contact form
  • To schedule and manage discovery calls
  • To deliver the services you engage me for
  • To manage invoicing and comply with legal retention obligations
  • To ensure the security, stability, and proper functioning of the website

05 Legal Bases (GDPR)

  • Art. 6(1)(b) GDPR: performance of a contract or pre-contractual measures
  • Art. 6(1)(c) GDPR: compliance with a legal obligation
  • Art. 6(1)(f) GDPR: legitimate interests (secure operations, fraud prevention)
  • Art. 6(1)(a) GDPR: consent (only where applicable)

06 How the Contact Form Works

When you submit the contact form on this website, the data you provide is processed by the site backend to:

  • Validate the submission via Cloudflare Turnstile (anti-spam)
  • Send the message to my inbox via Resend (transactional email service)
  • Store the message in my email so I can follow up

Your email address is used solely as the reply destination. It is not added to any newsletter or marketing list.

The site also offers a free downloadable checklist ("The DIY Automation Reality Check") in exchange for your email address. Submitting that form sends you one email containing the download link, and sends me a notification with your email so I can follow up. The same Turnstile and Resend processing described above applies. Your email is not added to any newsletter or marketing list.

07 Recipients / Processors

Depending on the context, your data may be processed by:

  • Hosting / infrastructure: Cloudflare Pages (website delivery, edge logs) and Hetzner (server hosting for the booking system, EU-based)
  • Email delivery: Resend, for sending contact-form messages to my inbox
  • Spam protection: Cloudflare Turnstile
  • Scheduling: self-hosted Cal.com on the EU-based Hetzner server (no third-party scheduling vendor)
  • AI assistant: Anthropic PBC (USA), used internally to support my work with prospects and clients. See section 8 for full details.
  • Advertising / conversion measurement: Google Ireland Ltd.: only if you consent to measurement cookies (Google Ads conversion tracking). See section 13.
  • Enrollment platform for my clients: Cloudflare (Workers and D1 database, EU jurisdiction) and Google (Gmail API, only if a client connects a Gmail mailbox). See section 14.
  • Accounting / tax advisor: if invoicing is required

08 AI Assistant Usage (Anthropic / Claude)

I use Anthropic PBC (San Francisco, USA), the maker of the AI assistant Claude, to support my internal work, for example drafting communications, preparing meetings, and analyzing business situations. I access Claude through a paid Anthropic subscription. When I discuss your situation with my AI assistant, content (which may include your name, the content of emails or messages you have sent me, and business context you have shared) is transmitted to Anthropic.

  • No model training: I have explicitly opted out of allowing Anthropic to use my content to train its models. Your data is therefore not used to train Anthropic's AI.
  • Retention: with the training opt-out enabled, Anthropic deletes inputs and outputs within 30 days.
  • International transfer: the transfer to the United States is covered by EU Standard Contractual Clauses, as described in Anthropic's Privacy Policy.
  • Sub-processors: Anthropic relies on cloud infrastructure providers (currently including AWS and Google Cloud). The current list is published at trust.anthropic.com/subprocessors.
  • Governing terms: my use of Claude is governed by Anthropic's Consumer Terms and Privacy Policy.
  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating the business efficiently), or Art. 6(1)(b) GDPR where processing is necessary to perform an engagement with you.

If you would prefer that I do not use AI tools to process your specific information, contact me at frederik@beyondfreelancing.com and I will accommodate your request.

09 International Data Transfers

Some service providers may process data outside the EU/EEA. Where this is the case, appropriate safeguards under GDPR apply (e.g., adequacy decision, Standard Contractual Clauses).

10 Retention Periods

  • Inquiry / lead data: retained as long as needed for follow-up and communication documentation
  • Contract / invoicing data: typically up to 10 years (German statutory retention)
  • Server logs: retained for a limited period for security and troubleshooting

11 Your Rights

You have the following rights under GDPR:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)
  • Right to withdraw consent (Art. 7(3) GDPR)
  • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

To exercise your rights, contact me via the details in section 02.

12 Security

I use appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. The site is served over HTTPS with HSTS, and form submissions are validated server-side.

13 Cookies & Analytics

This website uses Cloudflare Web Analytics to understand overall traffic (e.g., page views, visit counts, referring pages). It is cookieless and does not track individuals across websites or build a personal profile of you. Cloudflare's own privacy policy for this product is available at cloudflare.com/web-analytics. Cloudflare may also set technical cookies necessary for security and bot mitigation (e.g., Turnstile), with no profiling.

When this site runs paid Google Ads campaigns, it also uses Google Ads conversion tracking (via Google's gtag.js) to measure whether a visitor who arrived from an ad went on to book a call. This sets cookies and is only activated with your consent, via Google Consent Mode v2:

  • On your first visit, a banner asks whether you accept measurement cookies or want necessary-only browsing. No ad-measurement cookie is set until you accept.
  • Your choice is stored in your browser (localStorage) and applied automatically on later visits. You can change it any time via "Cookie preferences" in the footer.
  • If you accept, Google may process your IP address, the ad you clicked, and the fact that you reached the booking step. Google acts as an independent controller for this processing. See Google's Privacy Policy.
  • Legal basis: Art. 6(1)(a) GDPR (consent).

14 Enrollment Platform: Connecting a Gmail Mailbox

I run an enrollment platform for training providers who are my clients. It sends emails to their participants, such as registration confirmations, payment reminders and practical information. A client can choose to send those emails from their own Gmail or Google Workspace mailbox. This section explains what happens when an administrator connects such a mailbox ("Connect with Google" in the client portal).

  • What the platform asks Google for: your email address (scopes openid and email), to know which mailbox is connected, and permission to send email on your behalf (scope gmail.send). Nothing more.
  • What it does with that access: it only sends the emails your organisation has set up in the platform, to your own participants, from your connected address. It cannot and does not read, search, delete or modify any email in your mailbox, and it has no access to your contacts, calendar or files.
  • What is stored: the connected email address, an encrypted refresh token (AES-GCM, with a key held only as a platform secret), and the message ID Google returns for each sent email. The short-lived access token is used in memory and never stored. Data is stored in a Cloudflare D1 database in the EU jurisdiction.
  • No sharing, no other use: Google user data is not sold, not shared with third parties, not used for advertising, and not used to develop or train AI or machine-learning models. No person reads it, except where you ask me for support, where security or the law requires it, or where it is aggregated and anonymised for platform operations.
  • Limited Use: the platform's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
  • Disconnecting and deletion: an administrator can disconnect the mailbox in the client portal at any time. The platform then revokes its access at Google and deletes the stored token and address. You can also remove access yourself at myaccount.google.com/permissions; the platform then stops sending from your mailbox. To have any remaining data deleted, contact me via the details in section 02.
  • Legal basis: Art. 6(1)(b) GDPR (performance of the contract with my client). For participants' data, my client is the controller and I act as their processor.

15 Changes to This Policy

This Privacy Policy may be updated from time to time. The latest version applies.