Privacy Policy

Kestrel Portfolio B.V.
Last updated: 2026-09-23 · Version 1.2

1. What this policy covers

This policy covers this website: the public pages at kestrelportfolio.com and the demo booking we offer on them.

It is short because the site does very little. We do not run analytics. We do not use tracking, advertising or profiling cookies, tags or pixels. We do not buy or enrich data about our visitors, and we do not sell or share anything about you.

There is one exception to that, and we would rather state it plainly than bury it. Booking a demo is handled by Calendly. Nothing of Calendly's loads until you click "Book a demo". That click fetches Calendly's scheduling script and opens its booking window, and from then on Calendly's servers see your IP address and the page you booked from. Section 3 covers the cookies that involves, and section 4 explains what happens if you go on to book. Until you click, nothing on this site comes from anyone else's servers.

If you have an account on the Kestrel Portfolio platform, a separate policy covers that. Sign in and follow the Privacy Policy link in the footer.

2. Who we are

Kestrel Portfolio B.V., registered with the Dutch Chamber of Commerce under number 42014238, Prins Hendrikkade 26, 3441 XD Woerden, the Netherlands. We are the controller for the data described here.

For any question about this policy, or to exercise your rights, contact: infosec@kestrelportfolio.com (attn. Savannah Fischer, Director).

3. Cookies

Ours. None. This site sets no cookie of its own and stores nothing in your browser.

Calendly's. None until you click "Book a demo". That click fetches Calendly's script through Cloudflare, the network Calendly uses to deliver it, which sets a security cookie named __cf_bm for Calendly's domain. It tells people apart from automated traffic and expires after 30 minutes. The booking window then comes from Calendly itself, which sets its own cookies. All of these are Calendly's, set under Calendly's terms, and we neither read them nor receive anything from them. Calendly asks you about them itself: open the booking window and its own consent notice appears, where you can accept or decline. We have not switched that notice off. What the cookies are and how long they last is described in Calendly's cookie notice, linked from the same window.

4. When you book a demo

Booking opens a Calendly window. Calendly asks for your first and last name, your work email address, your company name and the number of sites you manage. You may add guest email addresses and a free-text note about what would help us prepare. Calendly also records the time you picked and the time zone your browser reports.

Please do not put anything confidential in the note — including anything from a real lease. If you want to show us a document, we will arrange a proper way to do that.

The booking lives in Calendly, not on this website. Nothing you type there is stored in this site's database. We read it in Calendly and in the calendar invitation it creates, and we may copy the details into our own notes so we can follow up.

We use this only to hold the meeting, prepare for it, and keep track of the conversation that follows. We do not add you to a mailing list, and we do not use it to advertise to you anywhere else.

Our legal basis is our legitimate interests under Article 6(1)(f) GDPR — arranging a meeting that you asked us for, from the moment you open the booking window. The impact is minimal: you chose to book, the details are the ones you would put at the bottom of an email, and we do nothing with them beyond the meeting you arranged. You can object at any time, and we will delete the booking.

We do not keep a booking longer than 36 months after the meeting. We delete older ones from Calendly by date range, so nothing sits there indefinitely.

Ask us and we will delete yours sooner. We do not wait for the 36 months to run down, and we will not ask you to justify the request. We delete by your email address, which removes your details from Calendly and from the services Calendly passes them to, and cancels any meeting with you that has not yet happened. Calendly completes a deletion within 7 days of our request, and it cannot be undone afterwards — by them or by us.

If a demo leads to an agreement, the details move into our ordinary customer records and our contract with your organisation governs them from that point.

5. What our servers record

Like any web server, ours writes a log line for each request: the internet (IP) address it came from, the page asked for, the time, and the browser's self-description. We use this only to keep the site up and secure and to work out what went wrong when something breaks. These logs rotate — new entries overwrite old ones within a few days — and we do not build profiles from them or look up who an address belongs to. Our legal basis is our legitimate interests under Article 6(1)(f) GDPR in keeping the site running and secure.

When a page errors or runs slowly, technical details of that request go to our monitoring provider so we can fix it. Your booking goes to Calendly, not to our servers, so it is never included.

6. Who else is involved

We do not sell your data or disclose it to anyone for their own purposes. Four suppliers handle it for us, each under a data processing agreement, and none may use it for their own ends — apart from the cookies Calendly sets under its own terms, described in section 3:

• Scaleway — hosts this website in Paris, France.
• AppSignal (Amsterdam, the Netherlands) — error and performance monitoring, as described above.
• Calendly (United States) — scheduling, as described in section 4.
• Microsoft 365 — the inbox that receives what you send us, kept in the European Union.

Our website, its logs and our inbox stay within the European Union, encrypted in transit and at rest.

Calendly is the exception: it is a United States company, so opening its booking window, and booking through it, sends your details outside the European Union. That transfer is covered by Calendly's certification under the EU–US Data Privacy Framework, backed by the Standard Contractual Clauses in our data processing agreement with them. If you would rather not use Calendly, email us at the address in section 2 and we will arrange a time by hand.

We will disclose data if the law requires it, and we would tell you unless we were forbidden from doing so.

7. Your rights

For the data described above you have the right to access it and get a copy, have it corrected, have it erased, ask us to restrict how we use it, and object to our using it at all (Article 21 GDPR), since we rely on legitimate interests.

Write to infosec@kestrelportfolio.com. We will respond within one month, as Article 12(3) GDPR requires. If you ask us to delete your booking we will raise it with Calendly straight away and remove it from our own notes; Calendly finishes the deletion within 7 days, as section 4 describes.

We hold no account for you and cannot identify you from your visit alone, so please tell us the email address you booked with — otherwise there is nothing for us to look up.

8. Complaints

If you are unhappy with how we have handled your data, we would like the chance to put it right — please contact us first. You can also complain to a data protection supervisory authority at any time. Ours is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl), and you may also complain to the authority in the EU country where you live or work.

9. Changes to this policy

If we change what we collect or why, we will update this page before the change takes effect. The date at the top shows when it was last revised.