Privacy statement
Last updated: 2026-10-06
This statement explains how ORGX B.V. handles personal data when you visit h2lo.nl and use its features. We keep it short and specific: only what actually happens on this website.
1. Who is responsible
ORGX B.V. is the controller for the processing described here.
Address: Overschiestraat 65, 1062 XD Amsterdam, The Netherlands
Chamber of Commerce (KvK) number: 83062378
VAT number: NL862711320B01
Email: office@orgx.com
This statement applies to h2lo.nl. Other ORGX websites have the same statement.
2. What we process, why and on what basis
We only process personal data for the purposes below. We do not sell personal data and we do not take decisions about you based on automated processing or profiling.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Running and securing the website | IP address, browser type, requested page and time, recorded in server logs by our hosting provider. | Legitimate interest (security and reliable operation), Article 6(1)(f) GDPR. | A short period set by the hosting provider. |
| Anonymous visit statistics (our own, no cookies) | Page visited, language, whether the visit looks like a person or a bot, and a one-way code derived from a shortened IP address and browser details. The code cannot be traced back to you and is only used to count unique visits. | Legitimate interest (understanding which pages are used), Article 6(1)(f) GDPR. | Kept as statistics, without any contact details. |
| Website analytics with Google Analytics 4 | Before you choose: only a basic, cookie-free signal (page, browser type and your IP address; according to Google, the IP address is not logged or stored in Analytics). After you click Accept: pseudonymous identifiers, pages viewed, device and browser type, approximate location, how you arrived. | Basic signal without cookies: legitimate interest, Article 6(1)(f) GDPR. Cookies and full measurement: your consent, Article 6(1)(a) GDPR, which you can withdraw at any time (see cookies below). | As configured in our Google Analytics account; cookies last up to 2 years. |
| Consultation requests (booking calendar) | Name, email address, company, phone number and message if you give them, chosen time and time zone, the page you booked from and, if you took a Quick Scan first, your scan result. | Taking steps at your request, and our legitimate interest in answering business enquiries, Article 6(1)(b) and (f) GDPR. | Up to 24 months after our last contact, unless a longer period is required by law or you become a client. |
| Quick Scan | Your answers and the resulting score, stored without name or email address, so we can improve the scan. If you ask for the result by email, the address is used only to send it and is not stored. Your result is kept in your browser for the current visit so it can be added to a consultation request if you make one. | Legitimate interest (improving our scans) and your request, Article 6(1)(b) and (f) GDPR. | Anonymous answers are kept as statistics. The browser copy disappears when you close the tab. |
| Contacting us by email or contact form | The details you send us: name, email address and your message. | Our legitimate interest in answering you, Article 6(1)(f) GDPR. | Up to 24 months after our last contact. |
3. Cookies and similar technologies
We use no advertising cookies. Analytics cookies are only placed after you click Accept. Declining is as easy as accepting, and declining or ignoring the banner means no analytics cookies are set. You can change your choice at any time via the Cookie settings link at the bottom of the page.
Until you accept, Google Analytics runs in a restricted mode: it sets no cookies and stores no identifiers on your device, but it can still receive the basic signal described above.
| Name | Purpose | Duration | Type |
|---|---|---|---|
| orgx_consent | Remembers your cookie choice (accepted or declined). | 12 months | Functional, first party |
| _ga | Google Analytics: tells returning visitors apart. | 2 years | Analytics, only after consent |
| _ga_[ID] | Google Analytics: keeps the state of a visit. | 2 years | Analytics, only after consent |
| orgxQuickScanResult (browser session storage) | Keeps your Quick Scan result for this visit so it can be attached to a consultation request. | Until you close the tab | Functional, first party |
4. Who receives your data
We share personal data only with providers that help us run this website, under agreements that limit what they may do with it:
- Our hosting and content delivery providers (Kinsta and Cloudflare), who serve this website.
- Google (Google Analytics, only after consent).
- Our email provider, which delivers consultation requests and messages to our team.
- Authorities, when we are legally required to share data.
5. Transfers outside the EEA
Some of these providers, notably Google and Cloudflare, may process data in the United States. Such transfers rely on an adequacy decision (the EU–US Data Privacy Framework) or on the EU Standard Contractual Clauses.
6. Your rights
You have the right to:
- access the personal data we hold about you;
- have incorrect data corrected and have data deleted;
- restrict the processing, or object to processing based on our legitimate interest;
- receive your data in a portable format;
- withdraw consent at any time, without affecting earlier processing.
To use these rights, email office@orgx.com. We respond within one month. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or with the authority in your own country.
7. Security
We take appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS) and restricted access to the data we hold.
8. Changes to this statement
We update this statement when our processing changes. The date at the top shows the latest version.
9. Questions
Questions about this statement or your data? Email office@orgx.com or write to ORGX B.V., Overschiestraat 65, 1062 XD Amsterdam, The Netherlands.