Privacy & Cookie Policy
Last updated: March 2026 - Version 1.0
Aldewereld Consultancy, h.o.d.n. SourceParts.eu, respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and protect your personal data in accordance with the General Data Protection Regulation (EU 2016/679, "GDPR") and the Dutch implementation thereof (Algemene Verordening Gegevensbescherming, "AVG").
1. Data Controller
| Controller | Aldewereld Consultancy, h.o.d.n. SourceParts.eu |
| Legal Form | Eenmanszaak (Sole Proprietorship) |
| Owner / Proprietor | Nick Aldewereld |
| Address | Nieuwe Hemweg 26, 1013CX Amsterdam, The Netherlands Mailing address only, visits by appointment |
| KvK | 61862533 |
| BTW-ID (VAT) | NL002168402B79 |
| Email (Privacy) | privacy@sourceparts.eu |
| General Email | info@sourceparts.eu |
| Supervisory Authority | Autoriteit Persoonsgegevens, The Hague, The Netherlands: autoriteitpersoonsgegevens.nl |
2. Personal Data We Collect
We collect different categories of personal data depending on how you interact with us:
2.1 Data you provide directly
| Category | Examples | When |
|---|---|---|
| Identity data | Name, company name, job title | Account creation, orders, inquiries |
| Contact data | Email address, phone number, postal address | Account creation, orders, inquiries |
| Financial data | Bank account details, VAT number, payment information | Orders, invoicing |
| Order data | Products ordered, quantities, delivery preferences | Purchases, quotes |
| Technical data | PCB designs, BOM files, DFM specifications | Design services, manufacturing orders |
| Communication data | Email correspondence, support tickets | Customer support, project coordination |
2.2 Data collected automatically
| Category | Examples | Purpose |
|---|---|---|
| Usage data | Pages visited, features used, time spent | Platform improvement via cookieless analytics, see Section 10 |
| Device data | Browser type, operating system, screen resolution | Technical compatibility |
| Network data | IP address, approximate location (country/city) | Security, fraud prevention |
We do not set cookies and we do not use browser storage (such as localStorage) on this website. See Section 10 for details.
2.3 Data we do NOT collect
We do not collect special categories of personal data (Article 9 GDPR) such as racial or ethnic origin, political opinions, religious beliefs, genetic or biometric data, health data, or data concerning sexual orientation. We do not engage in automated decision-making or profiling that produces legal effects.
3. Legal Basis for Processing
We process your personal data based on the following legal grounds under Article 6(1) GDPR:
| Legal Basis | When Applied |
|---|---|
| Contract performance Art. 6(1)(b) | Processing necessary to fulfill an order, deliver Products, provide Services, manage your account, and handle returns or complaints. |
| Legal obligation Art. 6(1)(c) | Tax and accounting records, export control compliance, sanctions screening, fraud prevention, and responding to lawful requests from authorities. |
| Legitimate interest Art. 6(1)(f) | Platform security and fraud prevention, improving our Services, cookieless aggregated analytics, business-to-business marketing communications to existing customers, and protecting our legal rights. |
| Consent Art. 6(1)(a) | Newsletter subscriptions and marketing communications to individuals who have not previously purchased from us. You may withdraw consent at any time. |
4. Purposes of Processing
We use your personal data for the following purposes:
- Order fulfillment: Processing and shipping orders, managing payments, providing order confirmations and tracking information.
- Service delivery: Performing DFM analysis, design reviews, manufacturing support, and managed services.
- Account management: Creating and managing your user account, providing access to Platform features.
- Customer support: Responding to inquiries, resolving complaints, providing technical assistance.
- Legal compliance: Export control screening, sanctions compliance, tax obligations, regulatory reporting.
- Platform improvement: Analyzing usage patterns (aggregated) to improve functionality and user experience.
- Security: Detecting and preventing fraud, unauthorized access, and other malicious activities.
- Communication: Sending transactional emails (order confirmations, shipping updates), and marketing communications about products and services where you have given your consent.
5. Data Sharing & Recipients
We share your personal data only when necessary and with appropriate safeguards. The named processors we currently use are:
| Processor | Purpose | Location |
|---|---|---|
Umami (self-hosted, analytics.easeo.nl) | Cookieless website analytics | EU, self-hosted on our own infrastructure |
| Revolut | Payment processing | EU |
Webshop host (shop.sourceparts.eu) | Hosting the online webshop | Depends on the hosting provider, details available on request |
DocuSeal (self-hosted, sign.aldewereldconsultancy.nl) | Electronic signature of quotes and contracts | EU, self-hosted on our own infrastructure |
| Email provider | Sending and receiving business email | Depends on the provider, details available on request |
| Shipping carriers | Delivering products | DPA in place, minimum data shared |
| Tax and legal advisors | Legal compliance, dispute resolution | Professional confidentiality |
| Government authorities | When legally required (tax, customs, export controls) | Only upon lawful request |
We do not sell, rent, or trade your personal data to third parties for marketing purposes.
6. International Data Transfers
Your personal data is primarily stored and processed within the European Economic Area (EEA), on servers located in the Netherlands.
When your project involves our group supply chain, limited business data may be shared with Source Parts Inc. (United States) and our manufacturing operation in Shenzhen, China. These entities act as partners and sub-processors for sourcing, design-for-manufacturing review, and production coordination.
Where personal data is transferred outside the EEA for this purpose, appropriate safeguards apply. These safeguards are currently being formalized through written agreements between the parties. Until that process is complete, we limit any such transfer to the minimum data necessary for the specific project, apply encryption in transit, and do not use the data for any purpose beyond that project.
- Data minimization: Only necessary data is shared for specific operational purposes
- Encryption: Data is encrypted in transit and at rest
We do not transfer bulk customer personal data outside the EEA. Technical design files and manufacturing specifications are handled under separate confidentiality agreements.
7. Data Retention
We retain personal data only as long as necessary for the purposes for which it was collected:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account data | Duration of account + 12 months | Contract performance |
| Order & invoice data | 7 years from transaction date | Dutch tax law (AWR) |
| Export control records | 5-10 years depending on regulation | EU/national export control law |
| Communication records | 3 years from last contact | Legitimate interest |
| Marketing consent | Until consent is withdrawn | Consent |
After the retention period expires, data is securely deleted or anonymized.
8. Your Rights
Under the GDPR, you have the following rights regarding your personal data. To exercise any of these rights, contact us at privacy@sourceparts.eu. We will respond within 30 days.
| Right | Description |
|---|---|
| Access (Art. 15) | Request a copy of the personal data we hold about you. |
| Rectification (Art. 16) | Request correction of inaccurate or incomplete personal data. |
| Erasure (Art. 17) | Request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations. |
| Restriction (Art. 18) | Request restriction of processing in certain circumstances. |
| Data Portability (Art. 20) | Receive your personal data in a structured, machine-readable format. |
| Objection (Art. 21) | Object to processing based on legitimate interests, including direct marketing. |
| Withdraw Consent (Art. 7) | Withdraw previously given consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. |
| Automated Decisions (Art. 22) | You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you. We do not currently engage in such processing. |
| Lodge a Complaint | You have the right to lodge a complaint with the Autoriteit Persoonsgegevens or the supervisory authority in your EU member state of residence. |
9. Security Measures
We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:
- Encryption: TLS/SSL encryption for all data in transit. AES-256 encryption for data at rest on our servers.
- Infrastructure: EU-based colocated servers in Amsterdam with military-grade hardening, LUKS2 full-disk encryption, and comprehensive audit logging.
- Access control: Role-based access control (RBAC), multi-factor authentication for administrative access, and principle of least privilege.
- Monitoring: Intrusion detection systems, regular security audits, and vulnerability assessments.
- Incident response: Documented breach notification procedures in compliance with Article 33 and 34 GDPR (notification to authorities within 72 hours of becoming aware of a breach, notification to affected individuals when required).
10. Cookie Policy
10.1 We use privacy-friendly, cookieless analytics
We use privacy-friendly, cookieless analytics: a self-hosted instance of Umami, running at analytics.easeo.nl. It stores no cookies on your device and does not track you across other websites. Only aggregated, anonymized visit statistics are collected, so no consent banner is required.
10.2 No cookies, no browser storage
This website sets no cookies and uses no browser storage (such as localStorage) of any kind, neither for analytics nor for remembering your language choice. Because nothing is stored on your device, there is no cookie consent banner on this site.
10.3 Third-party scripts
The only script loaded on this site is our own self-hosted analytics tool (Umami). We do not use Google Analytics, advertising pixels, social media plugins, or any other third-party technology that sets cookies or similar identifiers on your device.
11. Analytics & Tracking
We use a self-hosted, cookieless analytics tool (Umami, running at analytics.easeo.nl) to understand in aggregate how visitors use our Platform. No consent banner is needed because it does not set cookies, does not use browser storage, and does not track visitors across other websites.
Where possible, we use anonymized or aggregated data for analytics purposes so that individual visitors cannot be identified. We do not use Google Analytics or other tracking tools that transfer data to the United States.
Our visitor statistics are collected with this cookieless, privacy-friendly analytics tool that we manage ourselves on our own infrastructure: it sets no cookies and no personal data is shared with third parties.
12. Minors
Our Platform and Services are not directed at individuals under the age of 16. We do not knowingly collect personal data from minors. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@sourceparts.eu and we will delete such data.
13. Changes to This Policy
We may update this Privacy & Cookie Policy from time to time. Changes will be published on this page with an updated "Last updated" date. Material changes that affect your rights will be communicated via email to registered users at least 30 days before they take effect.
We encourage you to review this page periodically for the latest information on our privacy practices.
14. Contact Us
For any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data:
| Privacy inquiries | privacy@sourceparts.eu |
| General inquiries | info@sourceparts.eu |
| Postal address | Aldewereld Consultancy, Attn: Privacy Nieuwe Hemweg 26, 1013CX Amsterdam, The Netherlands Visits by appointment only |
We aim to respond to all privacy-related inquiries within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Autoriteit Persoonsgegevens at autoriteitpersoonsgegevens.nl.
© 2024-2026 Aldewereld Consultancy. All rights reserved.
This Privacy & Cookie Policy complies with the General Data Protection Regulation (EU 2016/679), the Dutch UAVG, the ePrivacy Directive (2002/58/EC), and the Dutch Telecommunications Act (Telecommunicatiewet). This document is provided for informational purposes and does not constitute legal advice.