Privacy Policy
Last updated: 12 October 2026
I help organisations build better systems and workflows. In doing so, I process personal data, for example when you contact me, book an appointment, subscribe to the newsletter or work with me. Below, I explain which data I use, why, and what choices and rights you have.
1. Who is responsible?
Mister Workflow is a trading name of GHMT Consultancy B.V. This company is responsible for the personal data I process for my own business operations.
- Contact person: Maarten Tigchelaar
- Address: Schuilenburgstraat 54, 8043 WR Zwolle, the Netherlands
- Chamber of Commerce (KvK): 62108557
- Email: maarten@misterworkflow.com
- Phone: +31 6 14 89 45 94
When I process personal data solely on behalf of a client, I may act as a data processor. You can read more about this under ‘Data in a client's environment’.
2. Contact and appointments
Getting in touch
Through the contact form, I receive your first name, last name, organisation, email address, phone number and message or question. I use this data to respond to your enquiry. The form is provided through ClickUp.
Completing this form does not subscribe you to the newsletter.
When you contact me by email or phone, I may also process your contact details and the content of your enquiry. Email correspondence is handled through Microsoft 365.
Booking an appointment
When you book through Calendly, I receive your name, email address, phone number, organisation, an explanation of your question and appointment details. I use this information to schedule the appointment, communicate with you and prepare for the conversation.
The data is processed in Calendly, Outlook and ClickUp. Make provides the connection to ClickUp.
Legal basis
For responding to business enquiries and organising contact, I rely on my legitimate interest in making my services accessible and handling business communications. I limit this use to what is necessary for these purposes.
When you, as an individual, request steps needed to enter into a contract with you, processing may be necessary for those steps. That processing is then based on preparing the contract at your request.
3. The Build Better Systems newsletter
For the newsletter, I process your email address, your first and last name if provided, your language preference and your subscription or unsubscribe status.
The newsletter is managed and sent through Mailchimp. Through Make, contact details and language preferences are also managed in ClickUp. I use this data there solely for newsletter management, not for individual sales follow-up.
Signup uses double opt-in: you confirm your subscription by email. The legal basis for sending the newsletter is your consent.
You can withdraw your consent using the unsubscribe link in every newsletter or by emailing me. Your unsubscribe request is also processed in ClickUp.
Open and click tracking has been disabled for the current Dutch and English newsletter campaigns. I therefore do not use those campaigns to measure who opens an email or clicks a link. If I introduce such measurements later, I will explain this and configure the processing in accordance with the applicable rules and recipients' choices. Subscribing to the newsletter does not automatically constitute consent to measuring reading behaviour.
4. Proposals, engagements and administration
For proposals and engagements, I process data needed for our collaboration, such as contact details, organisation details, correspondence, agreed arrangements, proposal and engagement details, client documents and invoicing details.
I use:
- ClickUp: organising work and managing client information.
- Microsoft 365, Outlook and OneDrive for Business: correspondence, appointments and client files.
- Prospero: proposals and signed engagements.
- Moneybird: proposals, invoices and financial administration.
The legal basis is performance of the contract when you, as an individual, are a party to that contract. For necessary communications with contacts at business clients, I rely on the legitimate interest in preparing and carrying out the business relationship. I also process financial administration to comply with legal obligations.
Recording proposal views
Prospero records when a proposal is opened or viewed. I use this information only to check whether the proposal has been received and viewed. I do not use it to determine the timing of sales follow-up.
The technical operation and the information and consent measures needed for this view recording are currently being investigated further. You can contact me if you would like to receive a proposal through another channel.
5. Video calls and AI assistance
Zoom and ClickUp AI Notetaker
I use Zoom for video calls. I do not make recordings through Zoom itself.
ClickUp AI Notetaker is used for video recordings, transcripts and meeting notes. Its sole purpose is documenting conversations and carrying out the engagement. Currently, only I have access to these recordings, transcripts and notes.
I am introducing a process in which participants are informed in advance and asked for consent to recording and transcription, with the option to speak without the notetaker. This process is still being set up. This privacy policy does not in itself constitute consent to a recording. You can let me know before a conversation that you wish to speak without being recorded.
ChatGPT
I use ChatGPT Plus to summarise meeting notes, analyse client documents and develop advice and proposals. Personal data contained in that information may be processed.
I review AI outputs myself before using them in advice, proposals or client reports.
The setting allowing my conversations to be used for model improvement was turned off on 12 October 2026. According to OpenAI, this applies to new conversations. Turning off this setting does not delete existing chats or files and does not reverse any previous processing.
The account type and additional privacy arrangements for processing client data with ChatGPT are being assessed. Where information is processed on behalf of a client, that client's instructions and the terms of the engagement are also relevant.
6. Data in a client's environment
For consultancy and automation work, clients may grant me access to their ClickUp and Make workspaces. As a result, I may encounter personal data concerning their employees, customers or other individuals.
If I process this data solely in accordance with the client's instructions, the client is responsible for the purpose and legal basis. My role and the associated arrangements depend on the engagement.
Access to client environments is currently renewed annually as standard. I am setting up a review of whether this access is necessary and of the arrangements governing continued access.
Do you have a privacy question about data in my client's environment? Please contact that organisation in the first instance. If I receive a request concerning such data, I will coordinate it with the relevant client.
7. Who is data shared with?
The services described above process data to provide the functionality used. I also use Lovable to host the new website and Make for the connections described.
My bookkeeper has access to the financial administration in Moneybird.
I sometimes engage a fellow consultant for an engagement. They may have access to my environment and the client's environment. I enter into a confidentiality agreement with that consultant. The procedures for reviewing access rights and ending access after an engagement are being developed further.
Techlogics manages only my domain and DNS settings. Under this arrangement, Techlogics has no access to contact form, newsletter or appointment data.
The applicable data processing arrangements for Prospero and the Lovable Pro account I use are still being confirmed. Available supplier documentation and a general privacy policy are not the same as confirmation that every required agreement applies to my account.
8. Website, cookies and technical data
The new website is hosted by Lovable with a custom domain. Hosting services may process technical data to deliver and secure the website. The exact hosting logs, retention periods and any standard statistics are being confirmed with Lovable.
The embedded ClickUp contact form is loaded only after you choose to load it. You can also open the form directly in ClickUp or contact me by email or phone. External services may process technical data and cookies when used.
The website currently loads the Open Sans and Source Sans 3 fonts through Google Fonts. This connects your browser to Google and transmits information including your IP address. Hosting these fonts locally is planned.
Google Analytics is not currently configured. If I add it, I will update the privacy and cookie information and configure the necessary choices before activation.
The setting for model training using my own project content in Lovable was turned off on 12 October 2026. This is separate from the processing of visitor data.
You can find more information about cookies and your choice regarding the ClickUp form in this website's cookie policy.
9. How long is data retained?
I have established the periods below as my retention policy. The cleanup routines are currently being set up. As a result, existing data remains in my systems or archives and has not yet been deleted in accordance with these periods in all cases. You can submit a deletion request now; I will assess it in accordance with your statutory rights.
| Data | Established retention policy |
|---|---|
| Standalone contact enquiries that do not lead to an engagement | No later than 6 months after handling the enquiry |
| Discovery Calls that do not lead to an engagement | No later than 6 months after completing the enquiry and any follow-up |
| Active newsletter contacts | While the subscription is active |
| Name and language after unsubscribing from the newsletter | Delete within 30 days if these were needed solely for the newsletter |
| Minimal record of a newsletter unsubscribe request | Only as long as necessary to prevent the unsubscribe request from being ignored; necessity is assessed during cleanup |
| Video recordings and full transcripts | Within 30 days after reviewing the notes, and no later than 90 days after the conversation |
| Client documents, correspondence and reviewed reports | No later than 2 years after the collaboration ends; earlier if no longer needed |
| Chats and source files containing client data in ChatGPT | Within 30 days after reviewing the result, and no later than 90 days after processing |
| Proposals that have not been accepted | No later than 6 months after final closure, unless still needed for administration or a dispute |
| Invoices and core financial administration | In accordance with the statutory tax retention obligation, generally 7 years |
| Signed engagements and supporting records | As long as necessary for the applicable tax retention obligation, ongoing obligations or disputes |
Where both a 30-day and a 90-day period are stated, the deadline reached first applies. The client file retention period does not replace the shorter period for raw recordings and transcripts.
For tax records, the retention period begins when it starts under the applicable rules. A contract that remains current may therefore need to be kept for longer than seven years from signing. Longer statutory periods apply to certain categories.
Make is used in the EU1 region, on the Core plan. The newsletter and Calendly connections do not retain personal data in Make Data Stores. Make states that its standard retention period for log data is 30 days. Other storage, such as incomplete executions, and any separate copies are not automatically covered by that period.
When determining a retention period, I consider the purpose, what is necessary for the collaboration, legal obligations and any disputes. Suppliers may also apply their own retention periods to data they process for their own legal or security purposes.
10. Processing outside the EEA
Some of the services used and their suppliers may process personal data outside the European Economic Area, including in the United States. Using Make's EU1 region does not mean that all other services and their suppliers process data solely within the EEA.
The public terms of services including ClickUp, Mailchimp, Calendly, Make, Microsoft and OpenAI describe safeguards for international transfers. Depending on the service and transfer, these may include an applicable adequacy decision, the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
The applicable arrangements for Prospero and my Lovable Pro account are still being confirmed. I therefore do not state that every transfer safeguard has already been individually checked for every supplier.
You can request information about processing by a particular service and the associated safeguards by emailing maarten@misterworkflow.com. The following official information is available:
11. Security
My ClickUp account uses two-factor authentication. The security settings of my other services are being checked. Currently, only I have access to notetaker recordings and transcripts. I enter into an NDA with fellow consultants I engage.
I am working on further configuration of access controls, ending access that is no longer necessary and the cleanup described above. I therefore do not claim that all accounts already use two-factor authentication or that all temporary access is already revoked automatically.
If you suspect that personal data is not properly protected, please contact me.
12. Your rights
Depending on the circumstances, you can:
- request access to your personal data;
- have inaccurate data corrected;
- request deletion;
- request restriction of processing;
- object to processing based on legitimate interests;
- request your data in a portable format where this right applies;
- withdraw consent where processing is based on consent.
Withdrawal does not affect the lawfulness of processing that took place beforehand on the basis of valid consent.
You can send a request to maarten@misterworkflow.com. I normally respond within one month. If a statutory extension is necessary, I will explain why within that month. If needed, I will request additional information to establish that the request comes from the correct person.
Statutory exceptions may apply, for example to data I am legally required to retain. I will explain why I cannot fulfil a request in whole or in part.
You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
13. Changes
I update this policy when my services, data processing or the way it is organised changes. The date of the latest update is shown at the top.