Privacy statement

Who is responsible?

GFNI, a Dutch sole proprietorship operating MelonCactus, is the controller for the website, business contacts and its own assignment administration (Dutch Chamber of Commerce number 93879695; VAT ID NL003451568B17). We determine our role for commissioned research case by case. Our business address is Ans van den Berglaan 68, 7545 RV Enschede. For questions or privacy requests, email contact@meloncactus.com or call 0622328034.

Enquiries and business correspondence

The form asks for your name, work email, company and role, the decision and research subject, and requested timing. The assessment level, geography, budget, additional context and NDA discussion request are optional. We use these details, and any subsequent business correspondence, to assess and answer your question, prepare a possible proposal and communicate with you. An enquiry is not an accepted assignment; requesting an NDA does not create one. Please do not send passwords, credentials, unlawfully obtained material, confidential documents or unnecessary sensitive personal data in the initial form.

If you request or enter into a contract in your own name, we process the information needed to take steps at your request before the contract or to perform it. For employees and other contacts acting for a company, we rely on our legitimate interest in handling business enquiries and correspondence. We limit this to relevant information, do not use the form for marketing subscriptions and respect your right to object.

Assignments and public-source research

For an agreed assignment, we use contact, project and invoice details to perform and administer it. Contract performance may be the basis for an individual client; for a company’s representatives we rely on our legitimate interest in carrying out the business assignment. A legal obligation also applies to necessary financial records. Research may include personal information from lawfully accessible public sources. Publicly available information remains personal information. For each assignment we determine our role and assess necessity, proportionality, professional relevance, source reliability and information duties for indirectly obtained information. Depending on that assessment, our legitimate interest or another applicable basis may apply. We do not assume a general exemption from the duty to inform people.

Hosting, security and website measurement

Vercel hosts the website and may process technical request and security information to serve and protect it. We rely on our legitimate interest in providing an available and secure website. With Vercel Web Analytics we measure only page views on known public English and Dutch pages to improve the site's navigation and content. Our site code removes query strings and fragments from the page URL it passes as an Analytics event and does not send form field values as Analytics events. Vercel says statistical data may include the time, page path, referring website, approximate location, and browser and device information. When receiving a request, Vercel may also process connection data such as an IP address. Vercel describes a visitor hash derived from the incoming request that is valid for one day, without third-party Analytics cookies. We do not use this measurement for advertising or individual visitor profiles. For this limited measurement we rely on our legitimate interest in understanding and improving use of the website. You can turn off future Analytics measurement in this browser using the setting below, or object by emailing contact@meloncactus.com. The setting stores only an on/off preference in this website's local browser storage, without a visitor ID. It applies only in this browser and may be lost if you clear its data. If the preference cannot be read or saved reliably, Analytics stays off while this page is open, but the choice may not survive a reload; please check the displayed status. Earlier aggregate statistics cannot be searched by name, and we do not promise that an earlier visit can be found or deleted individually. Vercel says a visitor session expires after 24 hours; that does not mean all Analytics or hosting data is deleted then.

Recipients and international processing

Resend delivers form enquiries to our business mailbox, provided by OVHcloud through Zimbra; Outlook is the email client. Vercel provides hosting and website measurement. Research working files and reports are currently stored locally on our computer. We share information with service providers as needed for these purposes and, for an assignment, with the client or other agreed recipients. Some processing takes place outside the European Economic Area, including Resend's storage of email content and delivery logs in the United States. We do not claim EEA-only storage. Resend's published data processing addendum describes when it becomes binding and incorporates EU standard contractual clauses for relevant transfers; Resend also describes its participation in the EU–US Data Privacy Framework. The Vercel Pro data processing addendum incorporates EU standard contractual clauses for transfers where they are required. These are provider-specific safeguards, not a guarantee that all processing stays in Europe. You may request more information about the safeguards relevant to your data by contacting us at contact@meloncactus.com.

How long do we keep information?

We keep enquiries that do not become assignments, and correspondence about them, in our active business mailbox and working files for no more than twelve months after the last substantive contact, and for less time when follow-up is no longer needed. If an enquiry becomes an assignment, subsequent non-fiscal assignment correspondence follows a separate period: from written scope confirmation until no later than 24 months after final delivery, or less time when handover and any corrections are complete. We keep research working files for no more than 24 months after final delivery, and for less time when they are no longer needed. We keep the final report for no more than 24 months from final delivery, or less time when the need for corrections or contractual resolution ends earlier. Where a concrete legal claim or statutory duty requires longer retention, we limit this to the relevant records and review them when that claim or duty ends. We keep scope confirmations, invoices and other necessary basic financial records for the applicable statutory period, generally seven years in the Netherlands after a record ceases to have current administrative value; this does not turn the whole research dossier into fiscal administration. These periods for our active copies do not guarantee that provider-held copies or security records disappear at the same time. Different deletion processes, backup cycles and legal exceptions may apply there. Resend describes a routine 30-day period for email content and delivery logs on its Free, Pro and Scale plans; that is not the period for our business mailbox. Vercel says an Analytics visitor session expires after 24 hours. This is not a general deletion period for raw request data, aggregate statistics or hosting data; the dashboard reporting window is not a deletion guarantee either.

Your rights

You may request access, correction, deletion or restriction of processing, and object to processing based on legitimate interests. Data portability applies where its legal conditions are met. If we ever rely on consent for a particular processing operation, you may withdraw it without affecting earlier lawful processing. Contact us by email; we may ask only for information needed to verify your identity. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Changes

We update this notice when our processing materially changes and show the revision date above. Material changes should be communicated through an appropriate channel where required.