Last updated:
This privacy policy explains how BAKED handles personal information when you visit baked.nl, use its features or contact us through the website.
BAKED is the controller responsible for the processing of personal information described in this policy.
If you have a question about this policy or want to exercise a privacy right, you can contact us at info@baked.nl.
When you use the contact form, we receive:
Your name, email address and message are required so that we can understand and respond to your inquiry. Providing a phone number or organisation is optional.
You are not legally required to provide this information. However, without the required information, we may be unable to process or respond to your inquiry.
Please avoid including sensitive personal information in an inquiry unless it is genuinely necessary for your request.
When you visit the website, technical request information is processed as necessary to deliver the website, maintain its availability and security, diagnose technical problems and prevent repeated or abusive requests.
This information may include an IP address, browser and device information, request timing, requested pages and similar technical metadata.
For contact-form security and rate limiting, BAKED uses a one-way request fingerprint derived from network information rather than storing the raw IP address in the contact submission itself. The fingerprint is used to distinguish requests for security and abuse-prevention purposes and is not used for advertising or profiling.
Hosting and infrastructure providers may separately process technical request information, including IP addresses, in their own operational and security systems as necessary to provide their services.
When you interact with or submit the contact form, Cloudflare Turnstile performs an automatic security check. Cloudflare may process security signals such as your IP address, TLS fingerprint, user-agent header, the Turnstile site key and the associated website origin.
These Turnstile signals are used to distinguish people from bots, prevent spam and improve bot detection. BAKED does not use them for advertising or to profile contact-form visitors.
BAKED processes personal information only where there is a lawful basis for doing so.
Contact details and message content are used to:
Depending on the circumstances, this processing is based on taking steps at your request before entering into a contract, performing a contract, complying with a legal obligation or BAKED's legitimate interests.
BAKED's legitimate interests include operating the website reliably, protecting it against misuse, maintaining its security and availability, diagnosing technical problems and protecting BAKED's legal interests.
Technical information used for website security, reliability and abuse prevention is processed on the basis of these legitimate interests.
The Turnstile security check is also based on BAKED's legitimate interest in preventing spam and protecting the contact form and website against automated misuse.
BAKED does not use contact-form information to create advertising profiles, and the contents of contact-form fields are not included in website statistics.
BAKED does not use personal information collected through this website for automated decision-making that produces legal effects or similarly significant effects concerning you.
Contact submissions are scheduled to expire 18 months after they are received.
Information may be deleted earlier where it is no longer reasonably needed for the purpose for which it was collected, or following a valid deletion request.
Information may be retained for longer where this is necessary to comply with a legal obligation or to establish, exercise or defend a legal claim.
Security and abuse-prevention information is retained only for as long as reasonably necessary to enforce the relevant security or rate-limiting measures and investigate misuse.
BAKED does not add the Turnstile challenge token to the stored contact submission. Cloudflare determines the retention of the security signals it processes under the Cloudflare Turnstile Privacy Addendum.
Infrastructure providers may maintain separate operational and security logs according to their documented retention periods and where necessary to provide, protect and troubleshoot their services.
A notification copy may remain in BAKED's receiving mailbox only for as long as reasonably needed to handle the inquiry or meet an applicable legal obligation. Resend processes customer email data while the service agreement is active and states that customer data is deleted within 90 days after account termination.
BAKED uses a limited number of third-party providers to operate and deliver the website.
These include:
These providers may process the personal or technical information necessary to provide their respective services, which may include an IP address, browser or device information, request information and request timing.
Where a provider processes personal information on BAKED's behalf, BAKED uses the provider subject to the data-protection arrangements applicable to that processing.
For the internal contact notification, Resend receives the configured BAKED recipient address and the visitor's name, email address, message and, where provided, phone number and organisation. Resend also processes the email metadata needed to send that notification. This information is used only to deliver the internal notification, not for BAKED marketing.
Resend states that account data, including email metadata, logs and API records, is stored in the United States regardless of the selected sending region. Its data-processing terms provide for approved transfer mechanisms, including the European Commission's Standard Contractual Clauses where applicable.
Cloudflare Turnstile processes security signals for bot detection on BAKED's behalf and may also use those signals under its own responsibility to improve its bot-detection capabilities.
Some providers or their subprocessors may process personal information outside the Netherlands or the European Economic Area.
Where personal information is transferred to a country outside the EEA, the transfer is made using a mechanism permitted under applicable data-protection law. Depending on the provider and destination, this may include an adequacy decision of the European Commission or appropriate safeguards such as the European Commission's Standard Contractual Clauses.
You can contact info@baked.nl if you want more information about the safeguards applicable to an international transfer of your personal information.
YouTube privacy-enhanced embeds and Vimeo embeds are not activated merely by loading the BAKED page. The external video service is contacted when you choose to start an externally hosted video. Information about that interaction may then be processed by the relevant video provider under its own privacy terms.
The website uses local browser storage or similar technologies where necessary to remember functional preferences.
These may include:
These preferences are used to provide functionality requested by you.
Cloudflare Turnstile is loaded only after you interact with the contact form. It is a necessary security measure for bot and spam detection.
Under applicable data-protection law, you may have the right to:
These rights are subject to the conditions and exceptions provided by applicable law and therefore may not apply in every situation.
To make a request, contact info@baked.nl.
BAKED may ask for additional information where reasonably necessary to understand your request or verify that the request relates to you. BAKED will not request more information than is reasonably necessary for that purpose.
You also have the right to lodge a complaint with the Dutch data-protection supervisory authority, the Autoriteit Persoonsgegevens.
BAKED may update this privacy policy when the website, its providers, applicable legal requirements or the way personal information is processed changes.
The date shown at the top of this policy indicates when it was last updated.
Material changes will be reflected in this policy before or when the relevant change in processing takes effect.
BAKED also uses its hosting provider, Vercel, for cookie-free website statistics. Vercel Web Analytics counts visitors and page views so we can understand website use and improve the website. BAKED receives aggregated statistics.
Measurements include the visit time, page URL, referring website, country, region or city, and browser and device information. Vercel distinguishes visitors using a hash derived from request information. The visitor session is discarded after 24 hours; this does not mean all aggregated statistics are deleted after 24 hours. Vercel does not use these measurements to follow visitors across different websites.
BAKED measures only public production pages, excluding previews and Dashboard access. Page URLs exclude query strings and fragments. Contact-form contents and custom events are not sent.
Vercel Web Analytics does not set analytics cookies. The website does not use an analytics cookie banner. Necessary browser storage for functional preferences and contact-form security is described separately in this policy.