Privacy Policy

Back On Rails ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website backonrails.nl and use our services. By using our website, you consent to the practices described in this policy.

• Personal identification information (name, email address, phone number) provided voluntarily through our contact and quote forms.
• Business information such as company name, website URL, and project requirements submitted via our configurator.
• Technical data including IP address, browser type, operating system, referring URLs, and pages visited - collected automatically via cookies and server logs.
• Communication records when you contact us via email, phone, or our AI chatbot.

• To respond to inquiries and provide quotes for our marketing and web development services.
• To deliver, maintain, and improve our services and website experience.
• To send relevant communications about your project or our services (only with your consent).
• To analyze website traffic and user behavior to improve our digital presence.
• To comply with legal obligations under Dutch and European law.

Under the General Data Protection Regulation (GDPR), we process your personal data based on: (a) your explicit consent, (b) the necessity to perform a contract or take pre-contractual steps at your request, (c) our legitimate business interests that do not override your rights, and (d) compliance with legal obligations. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Our website uses essential cookies required for proper functionality. We may also use analytics cookies (such as privacy-friendly alternatives to Google Analytics) to understand how visitors interact with our site. You can manage cookie preferences through your browser settings. We do not use tracking cookies for advertising purposes.

• We do not sell, trade, or rent your personal information to third parties.
• We may share data with trusted service providers who assist us in operating our website and business (e.g., hosting, email services), bound by confidentiality agreements.
• We may disclose information when required by law, regulation, or legal process.

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy, or as required by applicable law. Quote requests and project data are typically retained for 2 years after last contact. You may request earlier deletion at any time.

• Right of access - request a copy of your personal data we hold.
• Right to rectification - request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") - request deletion of your personal data.
• Right to restriction - request limitation of processing in certain circumstances.
• Right to data portability - receive your data in a structured, machine-readable format.
• Right to object - object to processing based on legitimate interests or direct marketing.

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. This includes SSL/TLS encryption, secure server infrastructure, and access controls. However, no method of transmission over the Internet is 100% secure.

Your data is primarily processed within the European Economic Area (EEA). If data is transferred outside the EEA, we ensure appropriate safeguards are in place in accordance with GDPR requirements, such as Standard Contractual Clauses.

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically. Continued use of our website after changes constitutes acceptance of the revised policy.