Privacy Policy
Last updated: 2026-08-22 · Draft — not final.
1. Data Controller
Controller for the purposes of the General Data Protection Regulation (GDPR):
The Governance Stack
[owner name / legal form]
[street + number]
[postcode + city], Netherlands
KVK: [KVK number]
Email: [email address]
2. Data Protection Officer
As a sole proprietorship/small business, appointing a mandatory Data Protection Officer (DPO) does not apply (Art. 37 GDPR does not apply at this scale and for this type of processing). For questions about data protection, please contact the controller directly via the email address above.
3. Collection and Storage of Personal Data
3.1 Website visits (server logs)
When you visit this website, the hosting server automatically processes the following data:
- IP address of the visiting device (shortened/anonymised after processing)
- Date and time of the visit
- Name and URL of the requested page
- Referring website (referrer-URL)
- Browser and operating system used
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in functional and cyber security).
Retention period: 7 days, then automatic deletion.
3.2 Orders (checkout via Lemon Squeezy)
Sales are made by The Governance Stack; payment is handled by payment and invoicing partner Lemon Squeezy via a hosted checkout (details under point 4.1). When you place an order, the following data is collected via the order form / the Lemon Squeezy checkout:
- Name
- Email address
- Company name (optional, for invoicing)
- VAT number (for business purchases within the EU, for reverse-charge VAT)
- Billing address
- Chosen kit and tier
Process:
- You choose a kit and proceed to the Lemon Squeezy hosted checkout.
- You pay directly via Lemon Squeezy; Lemon Squeezy calculates and collects the applicable VAT automatically (Lemon Squeezy acts as the merchant of record).
- After payment is confirmed, you immediately receive a download link to the ZIP with your kit, together with the invoice, by email.
Important: payment details (such as credit card numbers) are entered exclusively on the Lemon Squeezy payment page — they are not collected or stored on our own website.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract) + Art. 6(1)(c) GDPR (legal retention obligation under Dutch tax legislation).
Retention period: 7 years (tax retention obligation under the Dutch tax authority).
4. Third Parties / Processors
4.1 Payment processing — Lemon Squeezy
Payments are processed via the Lemon Squeezy hosted checkout. Lemon Squeezy acts as the merchant of record: Lemon Squeezy is the contracting party for the payment transaction and collects/remits the applicable VAT, while The Governance Stack remains the contracting party for the kit itself. A data processing agreement (DPA) under Art. 28 GDPR applies.
Important: payment details are entered exclusively on the Lemon Squeezy payment page — The Governance Stack only receives a payment confirmation and the invoicing details, never full card details.
| Service | Payment processing (Lemon Squeezy Hosted Checkout), invoice generation, VAT remittance |
|---|---|
| Contracting party | Lemon Squeezy LLC (Utah, USA) |
| Transfer outside the EEA | USA — [verify at lemonsqueezy.com/legal whether the applicable entity falls under the EU-US Data Privacy Framework; otherwise EU Standard Contractual Clauses (SCCs, Implementing Decision 2021/914)] |
| Legal basis | Art. 6(1)(b) GDPR (performance of a contract); Art. 6(1)(c) GDPR (tax obligation); Art. 28 GDPR (processing agreement) |
| Data categories | name, email address, company name, billing address, VAT number, purchase amount, chosen kit/tier; payment method data solely with Lemon Squeezy |
| Retention period | in line with the tax retention obligation: 7 years |
| Processor privacy policy | lemonsqueezy.com/privacy · DPA: lemonsqueezy.com/dpa |
4.2 Hosting — Cloudflare Pages
This website is hosted via Cloudflare Pages. Cloudflare provides the technical delivery of the website (edge delivery, DNS, CDN, DDoS/bot protection). A data processing agreement under Art. 28 GDPR applies.
| Service | Static hosting (Cloudflare Pages), DNS, CDN, DDoS/bot protection |
|---|---|
| Contracting party | Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA |
| Purpose | Technical delivery of website content |
| Legal basis | Art. 6(1)(f) GDPR (legitimate interest — hosting performance, functional and cyber security) |
| Data categories | (truncated) IP address, user agent, requested path, timestamp |
| Third country | USA — safeguarded via the EU-US Data Privacy Framework (Cloudflare is certified) + EU Standard Contractual Clauses (SCC, Implementing Decision 2021/914); processing agreement under Art. 28 GDPR in place |
| Retention period | server logs for 7 days |
| Processor privacy policy | cloudflare.com/privacypolicy |
No email/newsletter tool and no analytics: we do not use a separate tool for transactional emails or newsletters, and no analytics software runs on this site. The only data processors are therefore the two mentioned above (Lemon Squeezy and Cloudflare Pages).
5. Cookies
We use only strictly necessary cookies (session cookies, security tokens, language preference). No tracking or third-party cookies are placed. For this reason no cookie banner is required.
Payment runs via the Lemon Squeezy hosted checkout page (redirect). No checkout iframe is embedded on our own website — the payment process therefore does not place cookies on our domain. On the Lemon Squeezy payment page, Lemon Squeezy's cookie and privacy statements apply.
6. Your Rights
Under the GDPR you have the following rights:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object (Art. 21 GDPR)
- Right to withdraw consent (Art. 7(3) GDPR)
Send your request to: [email address]. We respond within one month (extendable to three months for complex requests).
7. Right to Complain
You have the right to lodge a complaint with a supervisory authority. The competent authority is:
Autoriteit Persoonsgegevens
Bezuidenhoutseweg 30
2594 AV The Hague
Phone: 088 - 1805 250
Web: autoriteitpersoonsgegevens.nl
8. Data Security
We use TLS encryption (HTTPS). Personal data is transmitted and stored encrypted. Only authorised persons with a need-to-know have access to data.
9. Validity of this Privacy Policy
This privacy policy is current and dated 22 August 2026. We will update this policy when our processing activities change.
This is a concept document, not legal advice. Have this — in particular the sections on processors (point 4), international transfers and the exact cookie situation (point 5) — reviewed by your own lawyer before publishing. Fill in all square brackets with the tools and company details actually used; a leftover placeholder is a credibility risk for a compliance brand.