Privacy statement

1. Who is responsible?

The data controller is Lauren Guldemond, represented by her parent/legal guardian Jeroen Guldemond in Bemmel, the Netherlands. Because Lauren is a minor, her parent exercises the rights and obligations under the GDPR on her behalf.

Questions about this statement or about your data can be asked via the contact form on this site.

2. Which data do we process?

2.1 Contact form

When you fill in the contact form, we process:

• Name — to address you personally
• Email address — to be able to reply
• The content of your message — to handle your question

Legal basis: performance of your request (GDPR art. 6(1)(b)) and/or your consent by submitting the form (art. 6(1)(a)).
Retention period: we keep your message in Lauren's mailbox for as long as needed to handle your question, and after that for at most 12 months for possible follow-up. You can ask us to delete your message earlier.

2.2 Technical data (IP address)

When you submit the contact form, our API (api.lauren10.nl) temporarily processes your IP address. We use this solely to prevent the form from being abused by bots or for spam — we limit the number of submissions per IP address.

Legal basis: legitimate interest (GDPR art. 6(1)(f)) — protecting the form against abuse.
Retention period: the counter is automatically removed after a short time. We do not store your IP address in a permanent log.

Our hosting provider (Strato) may record visitors' IP addresses in standard server logs for security and error diagnosis. These logs are used exclusively for technical management and are not linked to any other data.

2.3 Statistics (Google Analytics)

If you give consent via the cookie banner, we measure anonymously how the site is used with Google Analytics 4. We use Consent Mode v2 (default-denied): cookies are only placed after you choose Accept. IP anonymisation is enabled, and we have disabled advertising, remarketing and personalisation in Google Analytics.

Legal basis: your consent (GDPR art. 6(1)(a)). You can withdraw it at any time via the "Cookie settings" link at the bottom of every page.
Retention period: standard Google Analytics cookies remain in your browser for at most 13 months; within Google Analytics, aggregated reports are kept for 14 months.

3. Cookies and local storage

We only place cookies where strictly necessary, or where you give explicit consent.

No consent is needed for the lauren10_consent cookie — it is strictly necessary to remember your preference. Statistics cookies are only placed after you choose Accept.

You can change or withdraw your choice at any time via the Cookie settings link in the footer of every page.

4. Who do we share data with?

We do not sell your data to third parties. To run our service we work with the following processors:

• Cloudflare, Inc. (United States / EU) — hosts the contact API and the temporary storage for anti-abuse measures. Cloudflare is certified under the EU-US Data Privacy Framework. Data processing agreement: standard Cloudflare DPA.
• Resend, Inc. (United States) — sends the email from the contact form to Lauren. Resend is certified under the EU-US Data Privacy Framework. Data processing agreement: standard Resend DPA.
• Google Ireland Ltd. / Google LLC — only after your consent, for Google Analytics 4. Google is certified under the EU-US Data Privacy Framework. Data processing agreement: standard Google Ads Data Processing Terms.
• Hosting provider (Strato) — hosts the static website (HTML, CSS, images) and standard server logs.

We only share data with third parties when necessary for the purposes described above, or when the law requires us to.

5. Security

The site is served exclusively over HTTPS. The contact form is protected with anti-abuse measures. The API can only be reached from lauren10.nl (CORS restriction).

6. Your rights

Under the GDPR you have the following rights regarding the data we process about you:

• Access — request which data we hold about you
• Rectification — have incorrect data corrected
• Erasure — have data deleted ("right to be forgotten")
• Restriction — have processing restricted
• Objection — object to processing based on legitimate interest
• Data portability — receive your data in a structured format
• Withdraw consent — withdraw consent (for example for Analytics) at any time

You can submit a request via the contact form. We respond within four weeks.

Do you disagree with how we handle your data? You have the right to file a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

7. Data of teammates

This site shows names, nicknames and (where applicable) photos of Lauren's teammates and staff. Because most of them are minors, we only publish this data with the consent of the parents/legal guardians involved. Would you like us to remove or change a teammate's data or photo? Please get in touch via the contact form; we will do so as soon as possible.

8. Changes

We may update this privacy statement from time to time, for example when the site changes or the law requires it. The most recent version is always on this page; the date it was last updated is shown at the top.