Legal

Privacy Policy

Last updated: 30 September 2026

1. Who is responsible

The controller for the personal data described here is Haystack Imaging, a sole proprietorship (eenmanszaak) registered in the Netherlands and owned by Moritz Nelle.

Address

Laan der Verenigde Naties 171, 6716 JC Ede, The Netherlands

KVK

42059439

BTW-id

NL005463504B68

Email

info@haystackimaging.eu

Haystack Imaging is not required to appoint a data protection officer. Questions about this policy go to the email address above.

2. Visiting this website

When you open a page, your browser sends a request to the web server. As with any website, the hosting provider's servers record technical connection data for that request: your IP address, the date and time, the page or file requested, the response size and status, the referring page and your browser's user-agent string.

• Purpose: delivering the pages, keeping the server secure and fixing faults.
• Legal basis: legitimate interest in operating a secure website (Art. 6(1)(f) GDPR).
• Retention: the hosting provider keeps these logs for a limited period for security and troubleshooting, then deletes them. Haystack Imaging does not use them to identify, track or profile visitors.

The site uses no cookies, no analytics, no advertising or social-media plugins, no embedded videos or maps, and no externally hosted fonts or scripts.

One exception, and only if you use it: when you press the light/dark switch in the menu, your browser's local storage keeps the single word “light” or “dark”, so the next page opens the way you chose. It stays on your device, is never sent to Haystack Imaging or anyone else, identifies nobody, and disappears if you switch back to your system's own setting or clear your browser data. Because it only does what you asked for, it needs no consent (Art. 11.7a of the Dutch Telecommunications Act, the exception for storage that is strictly necessary for a service you request). There is therefore no cookie banner: there is nothing to consent to.

3. Emailing Haystack Imaging

This website has no contact form. If you send an email, for example about a project or to register interest in early access to Pitchfork, Haystack Imaging receives what you choose to include: usually your name, email address, organisation and the content of your message.

• Purpose: answering your question and, if a project or a Pitchfork unit follows, communicating about it.
• Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR), or legitimate interest in answering correspondence (Art. 6(1)(f) GDPR).
• Retention: deleted within 12 months if no project follows. Pitchfork registrations are kept until the first units have been allocated, then deleted within 12 months if no unit goes to you.

Providing this information is voluntary. Without an email address, Haystack Imaging simply cannot reply. Correspondence is not used for newsletters or marketing, and is not passed to AI services or other third parties.

4. Clients and projects

For clients, Haystack Imaging processes contact details and the correspondence, quotes and invoices that belong to the work.

• Legal basis: performance of the contract (Art. 6(1)(b) GDPR), and the legal duty to keep business records (Art. 6(1)(c) GDPR).
• Retention: for the duration of the business relationship. Records covered by the Dutch statutory retention duty for tax purposes (fiscale bewaarplicht) are kept for seven years.

Where material you supply for a project contains personal data, for example imagery in which people can be identified, Haystack Imaging processes it only on your instructions, as your processor. A data processing agreement (Art. 28 GDPR) is concluded before such work starts. Project data is processed on hardware Haystack Imaging owns and operates, and is not uploaded to third-party cloud services or AI tools unless you ask for that.

5. Who else processes data

Haystack Imaging does not sell personal data, does not share it with advertisers, and does not use automated decision-making or profiling. One service provider processes data on its behalf:

Web & email host

Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. Hosts this website, including the content delivery network that serves it, and the haystackimaging.eu mailboxes. Hostinger acts as a processor under its data processing addendum. See also its privacy policy.

Hostinger is established in Cyprus, in the EU. According to its privacy policy it stores data in the Netherlands, Lithuania, Cyprus and the United Kingdom, and elsewhere only where the service requires it. For any transfer outside the European Economic Area its data processing addendum provides the European Commission's standard contractual clauses.

Beyond that, data is disclosed only where Dutch law requires it, for example to the tax authority (Belastingdienst) as part of the bookkeeping.

6. External links

This site links to LinkedIn and, on this page, to Hostinger. Nothing is loaded from those sites until you click. Once you do, their own privacy policies apply.

7. Security

The site is served only over encrypted HTTPS, with a strict content security policy that blocks third-party code. Project files and correspondence are stored on a workstation with full-disk encryption.

8. Your rights

Under the GDPR you have the right to:

• access the personal data held about you and receive a copy;
• have inaccurate data corrected;
• have your data erased;
• restrict processing;
• receive your data in a portable format;
• object at any time to processing based on legitimate interest.

Email info@haystackimaging.eu to use any of these rights. You will get an answer within one month.

You also have the right to lodge a complaint with a supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens. Alternatively, you can complain to the authority in the EU country where you live or work.

9. Changes

This policy changes when the website or the way Haystack Imaging works changes. The date at the top always shows the current version.