Privacy notice

Privacy notice

At Hearthwood, we believe that handling personal data with care is part of well-designed software and sound business practices.

We collect no more data than necessary, use data only for clear purposes, and aim to limit dependence on external parties.

Who is responsible?

Hearthwood is responsible for processing personal data as described in this privacy notice.

Forest Lodge BV, trading as Hearthwood.

For questions about privacy or the processing of personal data, you can reach us through the contact form.

What data do we process?

The data we process depends on how you interact with us.

When you visit the website, technical data may be processed, such as an IP address, the time of a request, and data for security and error analysis. We do not use this data to profile individual visitors.

When you contact us, we process the information you provide, such as your name, email address, telephone number, organization, and the contents of your message.

Before a message is sent through the contact form, we verify the provided email address using a one-time verification code. This limits abuse and messages sent on behalf of others.

For customers, suppliers, and other business contacts, additional data may be needed for contracts, administration, communication, and legal obligations.

Why do we process personal data?

We process personal data only when there is a clear purpose and a valid legal basis. When relying on a legitimate interest, we limit processing to what is reasonably necessary for purposes such as security, fraud prevention, or normal business operations.

answering questions and requests

preparing or performing a contract

providing and supporting our services

our business and financial administration

securing our website, systems, and services

preventing and investigating abuse

complying with legal obligations

As little data as possible

Data that is not collected cannot be lost, misused, or retained unnecessarily. We therefore limit the collection and retention of personal data in our business operations and software to what is actually necessary. We do not use personal data for other purposes simply because it is available.

Security

We take technical and organizational measures to protect personal data against loss, unauthorized access, alteration, and misuse. Security is part of the architecture and design, rather than something added to software afterwards. No technical measure can guarantee absolute security.

encrypting data where appropriate

separating systems and responsibilities

restricting access permissions and securing connections

logging relevant security and administrative actions

minimizing the exposure of systems to the internet

limiting data and retention periods

Sharing and processing outside the EEA

We do not sell personal data. We share it with other parties only when necessary for our services, business operations, or a legal obligation. When a party processes data on our behalf, we make arrangements for protection and processing where needed. We aim to minimize the number of external parties with access. Where possible, we choose processing within the European Economic Area. Outside the EEA, we ensure a valid legal basis and appropriate safeguards as required by the GDPR.

How long do we retain data?

We retain personal data no longer than necessary for the purpose for which it was collected, unless a legal retention obligation requires a longer period. Retention periods may vary by type of data and depend, among other things, on the duration of a customer or business relationship, the need to retrieve communications, administrative and tax retention obligations, and security or audit purposes. Data that is no longer needed is deleted or anonymized.

Your rights

When we process your personal data, you have the following rights, depending on the circumstances. Please use the contact form to exercise them. We may request additional information where reasonably necessary to verify your identity. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

request access to your personal data

have inaccurate data corrected

have data deleted or its processing restricted

object to certain processing activities

have data transferred where data portability applies

Automated decision-making and changes

Hearthwood does not use personal data collected through this website for automated decision-making that has legal or similarly significant effects on individuals. Our services and website may change, so we may update this privacy notice. This page always contains the latest version.

Last updated: 1 September 2026.