1. Who processes your data
BnB Attitude is the sole proprietorship of Tom Pronk, advising short-stay hosts on pricing strategy, listing optimisation and revenue management. These pages are aimed at hosts in the Philippines, with pricing shown in PHP. For the data processed through this website, BnB Attitude is the data controller.
The business is established in the Netherlands, so the EU General Data Protection Regulation (GDPR) applies to this website. Because these pages are directed at people in the Philippines, the Data Privacy Act of 2012 (Republic Act No. 10173) may apply alongside it. Where the two differ, whichever gives you more protection is applied.
No data protection officer has been appointed, which is not required for an organisation of this size and these types of processing. Privacy questions can be sent to the email address above.
2. Cookies and browser storage
These pages place no cookies. There are no analytics, advertising pixels, social media trackers or A/B testing tools, and nothing is written to the local storage or session storage of your browser.
Consent is required before information is stored on or read from your device. Because these pages do not do that, there is no cookie banner and you are not asked for consent. A banner here would be asking permission for something that does not happen.
Other information is still recorded elsewhere. Requesting a page writes technical information to the hosting provider's log files, and submitting the contact form sends data to an external processor. Those two are covered in sections 3 and 4.
A note on the English pages
The English pages at bnbattitude.com store one item, a language preference set when you click or dismiss the language suggestion banner. That banner does not run on these Philippines pages. It is described in the English version of this statement.
If cookies are added later
If visitor analytics, a chat widget, a scheduling tool or similar functionality that does use cookies is added, a consent notice will be added and this statement will list each cookie with its name, purpose, lifetime and the party setting it.
3. The contact form
The contact page has a form for requesting a free listing scan. What you enter there arrives in my mailbox.
| Field | Required | Purpose |
|---|
| Name | Yes | Addressing you in the reply |
| Email address | Yes | Responding to your request |
| Listing URL | Yes | Analysing the listing for the scan |
| Number of properties | Yes | Assessing which service fits |
| Phone number | No | Calling or scheduling a call if you prefer that |
| Message | No | Context for your request |
Legal basis. The processing is necessary to take steps at your request prior to entering into a contract (Article 6(1)(b) GDPR, and Section 12(b) of the Data Privacy Act). You fill in the form yourself and decide what to put in it.
Processor. The form runs through Formspree, Inc., a US service that receives the message and forwards it to my mailbox. Formspree also processes your IP address and the time of submission for spam filtering. See sections 9 and 10.
Spam controls. The form contains a hidden field and a timing check to block automated submissions. Neither involves any personal data of yours and neither stores anything on your device.
Your request is not used for a newsletter or a mailing list. If you would rather not hear from me after the first contact, one email saying so is enough.
4. Server logs and hosting
This website runs on Vercel Inc. Like any web server, Vercel records technical data when a page is requested: your IP address, the time, the requested URL, the HTTP status code, your browser and operating system, and the page you came from.
Legal basis. Legitimate interest (Article 6(1)(f) GDPR): keeping the site working, investigating faults, and countering abuse such as attacks and bot traffic. These logs are not used to profile visitors or to link visits to individual people.
5. Google Fonts
The pages use the Plus Jakarta Sans typeface, loaded from Google's servers (fonts.googleapis.com and fonts.gstatic.com). Loading it means Google receives your IP address and information about your browser. Loading a typeface does not set a cookie.
Legal basis. Legitimate interest (Article 6(1)(f) GDPR): consistent and legible rendering of the site. If you would rather avoid this, you can block external resources in your browser, and the site will continue to work with a default typeface.
6. Email, phone and LinkedIn
If you contact me directly by email, phone, WhatsApp or LinkedIn, I process the data you provide: your name, your contact details and the content of your message. This is done to answer your question, on the basis of the same pre-contractual interest or of an existing agreement.
Email runs through the mail provider connected to the bnbattitude.nl domain. Messages sent via LinkedIn and WhatsApp sit on those platforms' servers, where their own privacy terms apply.
7. Client data
If you become a client, I additionally process data needed to carry out the engagement: name and contact details, invoicing and payment details, revenue and booking data from your rentals, and access to rental platforms and pricing tools insofar as you provide it. This is done on the basis of the agreement and, for invoicing, on the basis of the statutory record-keeping obligation.
Client revenue and booking data is not shared with third parties and is not used in an identifiable form in publications, presentations or sample dashboards.
8. Retention periods
| Data | Retention | Reason |
|---|
| Contact form request with no follow-up | 12 months | Being able to look back if the same person asks again later |
| Email correspondence with prospects | 12 months after the last contact | Continuity of the conversation |
| Client data | Up to 2 years after the agreement ends | Terms of engagement |
| Invoices and accounting records | 7 years | Dutch statutory tax retention period |
| Server logs at the hosting provider | Per Vercel's retention policy, in the order of weeks | Fault investigation and abuse prevention |
9. Who receives your data
Your data is not sold and is not used for third-party advertising. I do use service providers who process data as processors on my instructions.
| Party | Role | What they receive |
|---|
| Vercel Inc. | Website hosting | Visitor IP addresses and technical log data |
| Formspree, Inc. | Contact form handling | Everything you enter in the form, plus IP address and timestamp |
| Google Ireland Ltd. and Google LLC | Typeface delivery | IP address and browser data when the page loads |
| The mail provider for bnbattitude.nl | Sending and storing email | Content and metadata of email correspondence |
Data is also provided to my accountant and to the Dutch tax authorities insofar as required for bookkeeping and tax returns, and to other parties where a legal obligation requires it.
10. International transfers
Your data is processed in the Netherlands, where BnB Attitude operates, and by the service providers listed above. Formspree, Vercel and Google are US companies, so processing may take place on servers in the United States. Those transfers rely on the EU-US Data Privacy Framework where the party in question is certified under it, and otherwise on the Standard Contractual Clauses adopted by the European Commission.
If you are in the Philippines, this means data you submit through this website leaves the country. Contracting with these providers keeps the same level of protection in place wherever the data is processed. If you want to know which basis applies to a specific party, send an email and I will look it up for you.
11. Security
The website is served over HTTPS only, so traffic between your browser and the server is encrypted. Accounts used to access client data are protected with two-factor authentication. Access to clients' rental platforms and pricing tools runs through a separate user account with limited permissions wherever possible.
If you suspect something is wrong with the security of this website or of data I process, report it by email. I respond to such reports and fix what can be fixed.
12. Your rights
You have the following rights regarding your personal data. They exist under the GDPR and have close equivalents under the Data Privacy Act of 2012:
- Access. Request which data about you is being processed.
- Rectification. Have incorrect or incomplete data corrected or completed.
- Erasure or blocking. Have your data deleted, unless a statutory retention obligation such as the tax retention period prevents it.
- Restriction. Have processing paused, for example while the accuracy of data is being checked.
- Objection. Object to processing based on legitimate interest, such as the server logs.
- Portability. Receive the data you provided yourself in a common file format.
- Withdrawing consent. Where you gave consent for something, you may withdraw it at any time, without that affecting the lawfulness of processing carried out beforehand.
- Damages. Under the Data Privacy Act you may claim compensation for damage suffered through inaccurate, incomplete or unlawfully obtained use of your data.
Send a request to tom [at] bnbattitude.nl. You will get an answer within one month. To prevent data ending up with the wrong person, I may ask for additional information showing that the request comes from you. There is no charge for a request.
13. Filing a complaint
If you disagree with how your data is handled, let me know by email first and I will look into it.
You also have the right to complain to a supervisory authority. Because BnB Attitude is established in the Netherlands, that is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), PO Box 93374, 2509 AJ The Hague, the Netherlands, telephone +31 88 1805 250, autoriteitpersoonsgegevens.nl.
If you are in the Philippines, you may instead contact the National Privacy Commission, 5th Floor Delegation Building, PICC Complex, Roxas Boulevard, Pasay City, privacy.gov.ph.
14. Changes
This statement is updated whenever the website or the way I work changes, for example if an analytics tool or a scheduling tool is added. The version number and the month of the last change are shown at the top of the page. The version published at any given moment is the one that applies.