Privacy.

Who is responsible

Hugo van de Haar, a sole trader registered in the Netherlands, is the controller for the personal data described here. Full details are on the terms page. For anything on this page, write to hugo@vandehaar.com.

Visiting the site

The site itself sets no cookies; the external booking calendar is described below. There is no advertising pixel, tag manager or session replay. Netlify measures page loading, responsiveness and layout stability through Real User Monitoring, which works without cookies. These measurements are used to assess site performance. The research charts read from a file served with the site. I do not link readership to notification-list addresses.

Hosting. The site is served by Netlify, which keeps standard server logs for security and operation: IP address, the page requested, the time, and the browser's user-agent string. I do not read those logs as a matter of course and do not connect them to anything else. The basis for this is legitimate interest, in keeping a website online and defended. Netlify is a United States company and acts as a processor. Its privacy policy describes its handling of service data.

Fonts. The typefaces are stored on this domain. Reading a page does not require a request to a font provider.

Booking a call

The booking page loads a calendar from Cal.eu, the European instance of Cal.com. Opening the page makes a request to them, and booking a slot gives them what you type: your name, your email address, your time zone and any note you add. They pass it to me and to my calendar, and they set their own cookies in your browser.

The basis is the steps you take before entering into a contract, at your own request. The calendar is provided through Cal.eu. Cal.com's privacy policy describes its handling of booking information and service providers.

The calendar is an additional service on the booking page. If you would rather not involve them at all, email me instead and we will find a time by hand. That route has exactly the same outcome and one fewer party.

Writing to me

The contact form does not submit anything to a server. It opens a message in your own email programme with the fields filled in, and nothing leaves your machine until you press send. Once you do, your message sits in my mailbox like any other email.

I keep correspondence for as long as the conversation is live and for a reasonable period afterwards, in case it resumes. Where an email becomes part of an engagement, invoices and the records behind them are kept for seven years, which Dutch tax law requires. Everything else I delete when it stops being useful.

Reading The Demand Side

The publication is read on this site or downloaded as a PDF, and neither asks anything of you. You do not need an account or an email address to read it. Hosting and performance measurement apply as described above.

The notification list. Under the list of editions, and at the foot of each edition, there is a form with one field. If you fill it in, the only personal field I ask you to enter is your email address. Netlify also processes technical submission information, including an IP address, for handling and spam checks. I do not use that information to track your reading.

It is used for one thing, which is to send you one email when a new edition is published. It is not a newsletter and there are no summaries, announcements or offers in between. The basis is your consent, given by sending the form yourself; there is no pre-ticked box and nothing else is bundled with it.

The addresses sit with Netlify, who host this site and act as a processor for the form. They go to no one else, and to no mailing platform. I hold an address until you ask me to remove it, which you can do by replying to any of those emails; one line is enough, and it is gone the same day. If the list is ever discontinued, the addresses go with it.

The research covers companies

The published research covers companies: what their websites say, what roles they advertise, and what their public filings and announcements show. It is compiled from sources anyone can reach, on dates that are printed alongside the figures.

Individual people are not the subject and are not profiled. Where a person appears in a public source, such as a founder quoted in a funding announcement, they appear as part of the company's public record. Aggregate reporting is the rule, and companies are named individually only where the finding is favourable.

If you work at a company covered by the research and something is wrong, write to me. Corrections are published alongside the figures.

What I do not do

• No selling or renting of personal data. Service providers process the information described on this page.
• No automated decision-making and no profiling.
• No advertising networks, no social media pixels, no embedded video or maps.
• No open tracking or click tracking in anything I send you.

Your rights

Under the General Data Protection Regulation you can ask for a copy of what I hold about you, ask for it to be corrected or deleted, object to my processing it, ask me to restrict it, or ask for it in a portable form. Where I rely on consent you can withdraw it at any time, and withdrawing does not affect what happened before.

One email to hugo@vandehaar.com is enough, and I will answer within a month. If you are not satisfied, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority where you live.

Security

The public site is static and served over HTTPS. Correspondence, bookings and notification-list submissions are handled through the services described above; they are not stored in the public website files.

Changes

If this statement changes in a way that matters, the date below changes with it. Last updated 6 September 2026.

Written in English because the work is. A Dutch version is available on request, and Dutch law applies either way.