Back to home

Privacy Policy

Last updated: September 2026

1. Who I am

This is the personal website of Erik van de Blaak in Arnhem, the Netherlands: my portfolio and blog. I don't sell anything through this site. I am responsible for what happens to your data when you use it.

Questions about your data? Email erik@vandeblaak.com.

2. The contact form

When you fill in the contact form on the homepage, you send me:

  • your name
  • your email address
  • the subject you choose
  • your message

Your message arrives in my mailbox as an email, together with the time and your IP address. The server also keeps a monthly log file with the time, your IP address, name, email address and subject, without the text of your message. That lets me see who got in touch and when, and spot abuse.

The form accepts at most five messages per hour from the same IP address. To count them, the site stores your IP address with the time; after an hour that record no longer counts and is cleaned up.

I only use this data to reply to you. I keep messages and log entries for at most two years after our last contact. The legal basis is my legitimate interest in answering messages and protecting the form against spam.

3. Comments on blog posts

When you post a comment, the site stores your name, email address, comment, IP address and the time. I read every comment before it goes online. The site only shows your name, your comment and the date. I never publish your email address or IP address.

The IP address is used against spam: you can post one comment per minute and at most ten per hour. A comment is kept as long as it appears with the article. If you want me to remove your comment, email me. The legal basis is your consent: you post the comment yourself.

4. Cookies and browser storage

  • Session cookie: protects the contact form and the comment form against abuse from other sites (a so-called CSRF token) and remembers when you last commented. This cookie disappears when you close your browser. It does not require consent.
  • Google Analytics cookies: only on the homepage, and only if you consent. See below.
  • Browser storage (not a cookie): the homepage remembers your language and your cookie choice in your browser's local storage. That data stays on your device and never reaches me.

You can change your cookie choice via "Cookie Settings" at the bottom of the homepage. Cookies that have already been set can be deleted in your browser settings.

5. Google Analytics

If you consent on the homepage, that page loads Google Analytics. I can then see how many people visit the site, which pages they read and where they come from. To do that, Google Analytics collects things such as the pages visited, the type of device and browser, the referring website and an approximate location. The IP address is anonymized.

Google processes this data, possibly outside the European Union, for example in the United States. The data is kept according to the retention period set in Google Analytics, at most 14 months. This site shows no ads. The legal basis is your consent, which you can withdraw at any time via "Cookie Settings".

6. Videos, fonts and other external files

  • YouTube: some blog posts and portfolio items show a video via youtube-nocookie.com. Your browser then connects to YouTube (Google), which sees your IP address. According to YouTube, this mode only sets cookies once you play the video.
  • Fonts, icons and scripts: the Inter font is served from this site's own server. Icons and scripts come from jsDelivr, and the standalone design pages (the 3D, DOS and globe demos) load their fonts from Google Fonts. Those parties see your IP address when your browser fetches the files.
  • Share buttons and links: the buttons for sharing an article and the links to LinkedIn and GitHub are plain links. Nothing is sent to those sites until you click one.

7. Hosting, server logs and security

The site and its database are hosted by Protagonist, a Dutch hosting provider. Like any web server, it records your IP address, the time, the page requested and your browser. A security filter at the host can temporarily block IP addresses when traffic looks suspicious. Protagonist keeps these logs according to its own retention periods. The legal basis is the legitimate interest in keeping the site safe and available.

All connections to the site use HTTPS. The admin area, where comments are stored, is protected by a password.

8. Who I share data with

I don't sell data or pass it on for marketing. Data only ends up with:

  • Protagonist, for hosting the site and the database;
  • Google, for Google Analytics (with your consent) and when your browser loads YouTube videos or, on the design pages, Google Fonts;
  • authorities that are legally entitled to it.

9. Your rights

Under the GDPR you can:

  • ask which data I hold about you;
  • have incorrect data corrected;
  • have your data deleted;
  • restrict or object to the processing;
  • receive your data in a common file format;
  • withdraw consent you gave earlier.

Email your request to erik@vandeblaak.com. I will respond within one month.

10. Complaints

If you disagree with how I handle your data, please email me first. You can also file a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

11. Changes

If something changes on the site that makes this policy inaccurate, I update this page. The date at the top shows when that last happened.