Skip to content
NowSquare

Legal

Privacy Policy

Last updated: 22 August 2026

This policy explains what personal data nowsquare.com processes, why, and what your rights are. It covers this website only. NowSquare's products run on their own websites, under their own privacy policies.

1. Who is responsible

Kokhuis Product Innovation, trading as NowSquare, is the data controller for personal data processed through nowsquare.com.

  • Chamber of Commerce (KVK): 17148641
  • VAT ID: NL001693031B39
  • Registered in Nuenen, the Netherlands
  • Contact: [email protected]

2. Data this website processes

Newsletter. If you subscribe to the newsletter, we process the email address you submit. The address is saved in the website's own subscriber list and passed to our newsletter processor, Mailchimp, which records the subscription status and consent record. The newsletter uses double opt-in: you receive a confirmation email, and you are only subscribed after you confirm. The form also contains two technical anti-abuse fields (a hidden field and a timing value); they are checked when the form is submitted, used only to reject automated submissions, and are not stored.

Email correspondence. The Contact page shows an email address; there is no contact form on this website. If you email us, we process your email address, the content of your message, any name or company details you choose to include, and the correspondence that follows.

Technical delivery and security. The server infrastructure that delivers this website records standard technical request data in server logs: IP address, request time, requested URL, and browser information (user agent). It uses these records to deliver pages and to keep the site secure.

Cookies. The website sets two strictly necessary cookies: a session cookie (nowsquare_session) and a security token (XSRF-TOKEN) that protects form submissions against cross-site request forgery. Google Analytics may also set two first-party analytical cookies. _ga contains a randomly generated, pseudonymous browser identifier used to distinguish visits; its 90-day expiry is not extended by later visits. _ga_3ZFG2REKTT stores session state and can be refreshed during a visit, but it remains capped at 90 days after the latest session activity. The site sets no advertising cookies.

Website analytics. We use Google Analytics 4 to measure page views, sessions, traffic sources, scroll depth, outbound product links, form starts and submissions, file downloads, and supported video engagement so we can understand and improve nowsquare.com. GA4 enhanced measurement is on for those interactions and for page history changes; site-search measurement is off. We also record three first-party intent events: product_click identifies one of the five NowSquare products, contact_click records use of the email link, and sign_up records an eligible newsletter request after the server returns success. Those custom event parameters contain only the product label, contact method, or newsletter method. Through those custom parameters, we do not send form values or email addresses, message text, User-ID, link text, URLs, URL query strings, or URL fragments. GA4 still receives its normal page context for these events, including the page URL. Its separate enhanced-measurement outbound-click event can include the clicked destination URL. Email redaction is on, and the email and fullname URL query keys are redacted before collection. For visitors in the EEA, Google says GA4 discards IP addresses before logging them. Google Signals, advertising personalization, user-provided data collection, data sharing with Google products and services, and granular location and device collection are off. The GA4 property has no Google Ads link. The site tag does not configure User-ID or cross-domain measurement. We do not use Analytics data for advertising or to build visitor profiles across websites.

3. Purposes and legal bases

  • Newsletter. Purpose: sending the NowSquare updates you asked for. Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw consent at any time via the unsubscribe link in every email, or by writing to [email protected].
  • Correspondence and partnership enquiries. Purpose: answering your message and, where you ask about working together, taking the steps you request before a possible contract (Article 6(1)(b) GDPR). For other business correspondence: our legitimate interest in answering messages and keeping ordinary business records (Article 6(1)(f) GDPR).
  • Technical delivery and security. Our legitimate interest in operating, protecting, diagnosing, and securing the website (Article 6(1)(f) GDPR).
  • Website analytics. Purpose: measuring aggregate use of nowsquare.com and improving its content and operation. Legal basis: our legitimate interest in understanding and improving this website (Article 6(1)(f) GDPR). The analytical cookies are configured to have little effect on visitors' privacy and are used only for this measurement purpose.

This policy is an information notice, not an agreement. Using the website does not constitute consent to anything.

4. Mailchimp

The newsletter is delivered through Mailchimp, operated by The Rocket Science Group LLC, doing business as Mailchimp, an Intuit company. Mailchimp processes newsletter email addresses and related subscription data (such as subscription status and the consent record) on our behalf, and may process this data in the United States. Mailchimp states that it participates in the EU–US Data Privacy Framework, and its Data Processing Addendum includes the European Commission's Standard Contractual Clauses as a fallback safeguard. Every newsletter contains an unsubscribe link.

5. Google Analytics

Google Analytics is provided by Google Ireland Limited. Google processes the measurement data on our behalf under Google's data-processing terms. The service uses the pseudonymous browser identifier described in section 2. The site tag and custom events do not configure names, email addresses, User-IDs, messages, or form contents as Analytics fields. Google may process data outside the EEA under the safeguards described in its data-processing terms. Google Analytics user-level and event-level data is set to a two-month retention period; Google's aggregate standard reports can remain available for longer.

You may prevent Google Analytics collection with the Google Analytics opt-out browser add-on or browser controls that block analytical cookies or Google requests. You may also object to this processing by contacting [email protected].

6. Other recipients

Beyond Mailchimp, personal data may be handled by:

  • Google Ireland Limited, which provides Google Analytics as described in section 5;
  • the hosting and infrastructure providers that run this website and keep its server logs;
  • the email providers that transmit and store our correspondence;
  • professional advisers, such as legal or accounting advisers, where necessary;
  • public authorities, where the law requires us to provide data.

We do not sell personal data.

7. International transfers

Newsletter data is processed by Mailchimp in the United States under the safeguards described in section 4. Google Analytics data may be processed outside the EEA under Google's data-processing terms and applicable transfer safeguards. Email correspondence travels between the email providers of sender and receiver, which can involve processing outside the EEA depending on the providers involved. The website loads the Google Analytics script from Google. Fonts, styles, images, and all other scripts are served from nowsquare.com.

8. Retention

  • Newsletter: Mailchimp keeps your subscription data until you unsubscribe; after that, Mailchimp keeps the minimum suppression record needed to keep honouring the unsubscribe. The website's own copy of your address stays on its subscriber list until it is removed: email [email protected] and we delete it from both systems. If you never confirm the opt-in email, no newsletter is sent, and the same removal route applies to the submitted address.
  • Website analytics: the _ga browser identifier expires 90 days after the first visit without renewal. The _ga_3ZFG2REKTT session-state cookie can be refreshed during a visit and expires no later than 90 days after the latest session activity. User-level and event-level GA4 data uses a two-month retention setting; aggregate standard reports can remain available for longer.
  • Business enquiries that do not lead to an engagement: deleted or anonymised no later than 24 months after the last meaningful contact, unless a dispute or a legal obligation requires longer.
  • Correspondence connected to a contract: kept for as long as contractual, accounting, tax, or other legal obligations require.
  • Server and security logs: retained according to the hosting provider's configured log-rotation period and only for website delivery, diagnosis, and security. NowSquare will update this notice when the exact provider retention period has been verified.

9. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you;
  • have incorrect data rectified;
  • have your data erased;
  • restrict processing;
  • data portability, where processing is based on consent or contract;
  • object to processing based on legitimate interest;
  • withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal;
  • not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (this website does not make such decisions);
  • lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

Send requests to [email protected]. If we cannot reasonably confirm that you are the person the data is about, we may ask you to verify your identity; we do not ask for an identity document by default.

10. Security

We take appropriate technical and organisational measures to protect personal data against loss, misuse, and unauthorised access. No website can guarantee absolute security.

11. External websites

The product websites this site links to (rewardloyalty.co, invoicescript.co, voxelbooking.com, voxelsite.com, stampify.co), LinkedIn, and other external sites have their own privacy practices. This policy stops where those sites begin.

12. Changes

When this policy changes materially, we update it here and change the "Last updated" date at the top.