Legal
Privacy policy
Last updated: 3 November 2026
In short: this website has no analytics, no advertising, no tracking and no cookies. We only process personal data when you sign up for launch emails, email us, or buy one of our products through a store. We never sell your data.
1. Who we are
Gurkulla is the controller of the personal data described in this policy. We are a Dutch sole proprietorship (eenmanszaak) that publishes practitioner guides and forms for business continuity, DORA and NIS2.
Gurkulla
Geuzenstraat 60
1056 KG Amsterdam, the Netherlands
KVK (Chamber of Commerce) number: 42134217
VAT ID: NL005523613B56
Email: hello@gurkulla.com
Questions about this policy or your data: email hello@gurkulla.com.
2. What we collect, why, and for how long
| When | What | Why and legal basis | How long |
|---|---|---|---|
| You visit this website | Your IP address, browser type, the page requested and the time, in the web server's technical logs | To deliver the site and keep it secure. Legitimate interest (Article 6(1)(f) GDPR) | Kept by our hosting provider, Cloudflare, for a short period under its own retention rules. We do not receive or keep these logs |
| You sign up for launch emails | Your email address, and the date and time you gave consent | To send you an email when a new guide or forms pack launches, and to see in anonymous, combined figures how many emails were opened. Your consent (Article 6(1)(a) GDPR) | Until you unsubscribe. We then keep only a record that you unsubscribed, so we do not email you again |
| You email us | Your email address, name if you give it, and what you write | To answer you. Legitimate interest, or steps towards a contract if you ask about a purchase | Up to 2 years after our last contact, unless we need it longer for a claim or our accounts |
| You buy through Gumroad or Etsy | The store shares your name, email address, country and order details with us | To deliver the product, give support, handle refunds and keep our accounts. Contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)) | 7 years, because Dutch tax law requires us to keep business records that long |
We only ask for what we need. The signup form asks for your email address and nothing else. We do not use your data for profiling or automated decisions.
3. Buying through a store
We do not run our own checkout. When you buy, you buy through Gumroad, Etsy, Amazon, Apple Books or Google Play Books. The store collects your payment details and is responsible for how it handles them, under its own privacy policy. We never see your card or bank details. Amazon, Apple and Google do not share buyers' personal details with us.
- Gumroad
- Etsy
- Amazon (Kindle and paperbacks)
- Apple Books
- Google Play Books
4. Who else handles your data
We use a small number of service providers who process data on our behalf, under a data processing agreement:
- Website hosting and security: Cloudflare (Cloudflare, Inc., United States, with servers worldwide)
- Email: Google Workspace (Google Ireland Limited), for our hello@gurkulla.com mailbox
- Launch emails: Brevo (Sendinblue SAS, Paris, France). Your email address is stored in the EU
- Bookkeeping: our accountant or bookkeeping software, only for order records
We do not sell, rent or trade your personal data, and we do not share it for advertising.
5. Transfers outside the EU
Some of our providers, including Cloudflare and Gumroad, are based in the United States or use servers there. Where data leaves the European Economic Area, it is protected by the EU-U.S. Data Privacy Framework or by the European Commission's Standard Contractual Clauses.
6. Your rights
Under the GDPR you can ask us to:
- show you the personal data we hold about you (access)
- correct it if it is wrong (rectification)
- delete it (erasure), unless the law requires us to keep it
- limit how we use it (restriction)
- give it to you in a common file format (portability)
- stop using it where we rely on legitimate interest (objection)
You can withdraw your consent to launch emails at any time with the unsubscribe link in every email, or by emailing us. This does not affect emails already sent.
Email hello@gurkulla.com to use any of these rights. We reply within one month. If you are unhappy with how we handle your data, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or to the authority in your own country.
7. Cookies and tracking
This website uses no analytics, tracking pixels, advertising cookies or third-party embeds. Our host may set one strictly necessary security cookie, explained in the Cookie policy. Our fonts are hosted on our own server, so your visit is not shared with font services. See our Cookie policy.
8. Security
We protect your data with appropriate technical and organisational measures, including encrypted connections (HTTPS), two-step verification on our accounts, and access limited to the people who need it.
9. Children
Our products are for professionals. We do not knowingly collect data from anyone under 16.
10. Changes to this policy
If we change how we use personal data, we will update this page and the date at the top. If a change affects how we use the email address you gave us, we will tell you by email first.