Privacy & cookies
This page explains what personal data ProductCamp Amsterdam collects, why, who it goes to, and what you can do about it. We are a volunteer-run foundation and we collect as little as we can get away with.
Who is responsible
The controller for your personal data is Stichting ProductCamp Amsterdam, a foundation registered in the Netherlands.
- Chamber of Commerce (KvK): 63736926
- Email: team@productcampamsterdam.org
Our registration in the Dutch Handelsregister identifies us. Write to the address above for anything to do with your data, including a postal address if you need one.
We have not appointed a Data Protection Officer. We are not required to have one, and for questions you can write to the address above.
What we collect, and why
When you visit the site
We use Cloudflare Web Analytics to count visits. It sets no cookies, does not fingerprint you, and does not build a profile. We rely on our legitimate interest in knowing whether the site works.
If you accept analytics cookies, we also use Google Analytics 4, which sets cookies in your browser and gives us page-level statistics. This happens only after you click Accept. If you decline or ignore the banner, Google Analytics is never loaded and no request is made to Google. The lawful basis is your consent, and you can withdraw it at any time using the Cookie settings link in the footer.
When you use the contact form
We collect your name, email address, chosen topic and message so we can reply. The form is delivered by Web3Forms and protected against spam by hCaptcha, which processes technical data such as your IP address to tell humans from bots. The lawful basis is your consent when you submit the form, together with our legitimate interest in answering enquiries and in keeping the form usable.
When you subscribe to the newsletter
Our newsletter runs on Substack, which acts as its own controller for subscriber data. When you subscribe through the embedded form, your email address goes to Substack under their privacy policy. The lawful basis is your consent, and every issue carries an unsubscribe link.
When you buy a ticket
Tickets are sold through Eventbrite, which is a separate controller for the data you give them. We receive an attendee list so we can run the event. Eventbrite's own privacy policy governs what they do with your data.
Cookies
No analytics cookies are set unless you accept them. Google Analytics is not loaded at all until you click Accept, so declining or ignoring the banner means no analytics cookie is ever written and no request reaches Google.
Some cookies are still set without a banner, because they come from services the pages need in order to work: the newsletter sign-up embed, the spam protection on the contact form, and the venue map. These are session and security cookies set by those providers, not advertising cookies, and we cannot switch them off individually while the feature is on the page. Your consent choice itself is stored in your browser's local storage rather than in a cookie, so recording it does not require consent.
| Name | Set by | Purpose | Retention | Needs consent |
|---|---|---|---|---|
pca-consent | This site | Remembers whether you accepted or declined analytics. Local storage, not a cookie. | 12 months | No, strictly necessary |
_ga, _ga_* | Google Analytics | Distinguishes visitors and sessions for page statistics. | Up to 2 years | Yes |
__cf_bm | hCaptcha | Bot protection for the contact form. Set on any page that loads the form's script. | 30 minutes | No, strictly necessary |
__cf_bm, cf_clearance, AWSALBTGCORS, cookie_storage_key | Substack | Security, load balancing and sign-up state for the embedded newsletter form. | Session to 1 year | No, but only set on pages carrying the embed |
| Google Maps cookies | Set by the embedded venue map on the homepage. | Session to 2 years | No, but only set on the homepage |
You can change your decision at any time with the Cookie settings link in the footer. Declining after having accepted stops analytics immediately and deletes the Google Analytics cookies we set.
Who else sees your data
We do not sell your data and we do not share it for advertising. It reaches the following parties only because they run part of the service:
- Cloudflare: hosting, cookieless analytics and email delivery for our addresses.
- Google Analytics: page statistics, only with your consent.
- Google Maps: the embedded venue map on the homepage. Loading that map tells Google your IP address.
- Web3Forms and hCaptcha: contact form delivery and spam protection.
- Substack: newsletter, if you subscribe.
- Eventbrite: ticketing, if you buy a ticket.
- jsDelivr: a content delivery network we load an animation library from. It receives your IP address and browser details, and sets no cookies.
Several of these are based in the United States, so your data may be transferred outside the European Economic Area. Those transfers rely on the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework, depending on the provider.
How long we keep it
- Contact form messages: up to 12 months after your last message.
- Newsletter subscription: until you unsubscribe.
- Analytics: according to the retention set in Google Analytics, and in aggregate form in Cloudflare.
Your rights
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or send it to someone else. You can object to processing based on legitimate interest, and you can withdraw consent at any time without affecting what we did before you withdrew it.
Write to team@productcampamsterdam.org and we will respond within one month.
If you are not satisfied, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (opens in new tab).
Changes
If we change how we handle data we will update this page and move the date at the top. There is no version history, so if the detail matters to you, keep a copy.