Last updated: 17 August 2026
This privacy policy explains how BAKED handles personal information when you visit baked.nl, use its features or contact us through the website.
BAKED is the controller responsible for the processing of personal information described in this policy.
If you have a question about this policy or want to exercise a privacy right, you can contact us at info@baked.nl.
When you use the contact form, we receive:
Your name, email address and message are required so that we can understand and respond to your inquiry. Providing a phone number or organisation is optional.
You are not legally required to provide this information. However, without the required information, we may be unable to process or respond to your inquiry.
Please avoid including sensitive personal information in an inquiry unless it is genuinely necessary for your request.
When you visit the website, technical request information is processed as necessary to deliver the website, maintain its availability and security, diagnose technical problems and prevent repeated or abusive requests.
This information may include an IP address, browser and device information, request timing, requested pages and similar technical metadata.
For contact-form security and rate limiting, BAKED uses a one-way request fingerprint derived from network information rather than storing the raw IP address in the contact submission itself. The fingerprint is used to distinguish requests for security and abuse-prevention purposes and is not used for advertising or profiling.
Hosting and infrastructure providers may separately process technical request information, including IP addresses, in their own operational and security systems as necessary to provide their services.
When you interact with or submit the contact form, Cloudflare Turnstile performs an automatic security check. Cloudflare may process security signals such as your IP address, TLS fingerprint, user-agent header, the Turnstile site key and the associated website origin.
These Turnstile signals are used to distinguish people from bots, prevent spam and improve bot detection. BAKED does not use them for advertising or to profile contact-form visitors.
BAKED processes personal information only where there is a lawful basis for doing so.
Contact details and message content are used to:
Depending on the circumstances, this processing is based on taking steps at your request before entering into a contract, performing a contract, complying with a legal obligation or BAKED's legitimate interests.
BAKED's legitimate interests include operating the website reliably, protecting it against misuse, maintaining its security and availability, diagnosing technical problems and protecting BAKED's legal interests.
Technical information used for website security, reliability and abuse prevention is processed on the basis of these legitimate interests.
The Turnstile security check is also based on BAKED's legitimate interest in preventing spam and protecting the contact form and website against automated misuse.
Google Analytics is used only with your prior consent.
BAKED does not use contact-form information to create advertising profiles, and the contents of contact-form fields are not sent to Google Analytics.
BAKED does not use personal information collected through this website for automated decision-making that produces legal effects or similarly significant effects concerning you.
Contact submissions are scheduled to expire 18 months after they are received.
Information may be deleted earlier where it is no longer reasonably needed for the purpose for which it was collected, or following a valid deletion request.
Information may be retained for longer where this is necessary to comply with a legal obligation or to establish, exercise or defend a legal claim.
Security and abuse-prevention information is retained only for as long as reasonably necessary to enforce the relevant security or rate-limiting measures and investigate misuse.
BAKED does not add the Turnstile challenge token to the stored contact submission. Cloudflare determines the retention of the security signals it processes under the Cloudflare Turnstile Privacy Addendum.
Infrastructure providers may maintain separate operational and security logs according to their documented retention periods and where necessary to provide, protect and troubleshoot their services.
A notification copy may remain in BAKED's receiving mailbox only for as long as reasonably needed to handle the inquiry or meet an applicable legal obligation. Resend processes customer email data while the service agreement is active and states that customer data is deleted within 90 days after account termination.
Google Analytics user-level and event-level data is configured with a two-month retention period.
Analytics cookies set by baked.nl are limited to a maximum lifetime of six months.
BAKED uses a limited number of third-party providers to operate and deliver the website.
These include:
These providers may process the personal or technical information necessary to provide their respective services, which may include an IP address, browser or device information, request information and request timing.
Where a provider processes personal information on BAKED's behalf, BAKED uses the provider subject to the data-protection arrangements applicable to that processing.
For the internal contact notification, Resend receives the configured BAKED recipient address and the visitor's name, email address, message and, where provided, phone number and organisation. Resend also processes the email metadata needed to send that notification. This information is used only to deliver the internal notification, not for BAKED marketing.
Resend states that account data, including email metadata, logs and API records, is stored in the United States regardless of the selected sending region. Its data-processing terms provide for approved transfer mechanisms, including the European Commission's Standard Contractual Clauses where applicable.
Cloudflare Turnstile processes security signals for bot detection on BAKED's behalf and may also use those signals under its own responsibility to improve its bot-detection capabilities.
Some providers or their subprocessors may process personal information outside the Netherlands or the European Economic Area.
Where personal information is transferred to a country outside the EEA, the transfer is made using a mechanism permitted under applicable data-protection law. Depending on the provider and destination, this may include an adequacy decision of the European Commission or appropriate safeguards such as the European Commission's Standard Contractual Clauses.
You can contact info@baked.nl if you want more information about the safeguards applicable to an international transfer of your personal information.
YouTube privacy-enhanced embeds and Vimeo embeds are not activated merely by loading the BAKED page. The external video service is contacted when you choose to start an externally hosted video. Information about that interaction may then be processed by the relevant video provider under its own privacy terms.
BAKED uses Google Analytics only after you explicitly consent to analytics.
The Google tag is included on every page so that Google can verify the installation. Loading that script means your browser contacts Google, which makes your IP address visible to Google as part of that request.
Before consent is given, measurement is switched off: Google Analytics sends no analytics request, sets no analytics cookie and records no information about your visit.
Advertising storage, advertising user data and advertising personalisation are disabled.
Enhanced Measurement is disabled. BAKED therefore does not rely on Google's automatic collection of form interactions, site searches, file downloads or browser-history changes.
After consent, BAKED sends its own page-view information using an approved page path and sanitised referral information.
Referral information is limited to either:
Query strings and URL fragments are not included in the referral information sent by BAKED.
Contact-form fields and their contents are not included in analytics events.
After consent, Google Analytics may process information including:
Collection of granular location and device information is disabled for all regions in the Google Analytics property.
For traffic from the European Union, Google states that IP addresses are used for geographic derivation and are discarded before they are logged or stored by Google Analytics.
BAKED's Google Analytics property uses a two-month user and event data-retention period.
Analytics cookies created through baked.nl are limited to a maximum lifetime of six months.
If you decline analytics, measurement stays switched off, no analytics request is sent to Google and no analytics cookie is set.
You can change or withdraw your analytics choice at any time through the cookie settings available on this page or through the website footer.
Withdrawing consent prevents new analytics events from being sent and removes accessible first-party Google Analytics cookies set through this website where the browser permits BAKED to remove them.
Withdrawal of consent does not affect the lawfulness of processing that took place before consent was withdrawn.
The website uses local browser storage or similar technologies where necessary to remember functional preferences.
These may include:
These preferences are used to provide functionality requested by you or to remember your privacy choice.
Google Analytics may set first-party analytics cookies only after you explicitly accept analytics.
Cloudflare Turnstile is loaded only after you interact with the contact form. It is a necessary security measure rather than analytics and is therefore not controlled by the optional analytics-consent setting.
Declining analytics does not restrict the normal use of the website.
You can change your analytics preference at any time through the cookie settings available on this page or in the website footer.
Under applicable data-protection law, you may have the right to:
These rights are subject to the conditions and exceptions provided by applicable law and therefore may not apply in every situation.
To make a request, contact info@baked.nl.
BAKED may ask for additional information where reasonably necessary to understand your request or verify that the request relates to you. BAKED will not request more information than is reasonably necessary for that purpose.
You also have the right to lodge a complaint with the Dutch data-protection supervisory authority, the Autoriteit Persoonsgegevens.
BAKED may update this privacy policy when the website, its providers, applicable legal requirements or the way personal information is processed changes.
The date shown at the top of this policy indicates when it was last updated.
Material changes will be reflected in this policy before or when the relevant change in processing takes effect.