Privacy Policy

360virtualtour.net is a 360° virtual tour and architectural photography studio based in the Netherlands and serving clients across the European Union. This policy explains what personal data we collect through this website, why we collect it, how long we keep it and what rights you have.

1. Data controller

The data controller responsible for this website is SENFIA, a sole proprietorship (eenmanszaak) registered in the Netherlands; 360virtualtour.net is its trade name.

• Address: Kaapstraat 42, 2572 HK Den Haag, the Netherlands
• Chamber of Commerce (KvK): 90070828
• VAT ID (BTW): NL004785524B06
• Contact: contact form

2. Personal data we collect

Contact and quote form

When you send us a message through the contact or quote form we process:

• your name
• your e-mail address
• your phone number, if you choose to share it
• your declaration that you contact us on behalf of a business and, if you provide it, your company registration (KvK) number or VAT ID
• the content of your message and any project details you include

We use this data only to answer your inquiry, prepare a quotation and, if you place an order, to perform the contract. The legal basis is your consent, given by ticking the consent box in the form, and steps taken prior to entering into a contract (Article 6(1)(a) and (b) GDPR). Your message is stored in our database and delivered to our mailbox (see section 4).

Booking and inquiry forms inside the tours we host

Some virtual tours on this website (addresses starting with /360/) belong to our clients and can contain a booking, reservation or inquiry form of that business. What you enter there is passed on by our server directly to that business by e-mail; we do not store it in a database. For that data the business is the controller and we act on its behalf as a processor (Article 28 GDPR). To exercise your rights regarding such a request, please contact the business shown in the tour.

Website analytics, only with your consent

This website uses Google Analytics 4 to understand how visitors use our pages, but only if you give consent:

• Until you press "Accept" in the consent banner, the Google Analytics script is not loaded and no data is sent to Google.
• If you decline or make no choice, it stays that way: no analytics cookies and no data sent to Google, not even cookieless signals.
• If you accept, Google Analytics collects information such as pages visited, approximate region, device and browser type, linked to a random ID stored in a cookie. Advertising features and Google signals are switched off, and Google Analytics 4 does not store IP addresses. You can withdraw at any time with "Cookie settings" at the bottom of every page.

Cookieless visit counter

A counter on our own server counts how often our pages are opened, as daily totals: the page address, the name of the site you came from (such as "google"), the device type and the code of your browser language. Nothing is written to or read from your device; no IP address, browser signature, time or identifier is stored. These totals are not personal data. Details are in our Cookie Policy.

Website security

To prevent attacks, our server checks every request automatically. When a request presents itself as the Google or Bing search crawler, its IP address is verified via DNS to find out whether it is genuine; the result is kept in server memory for at most 24 hours and is never written to disk. The IP addresses of ordinary visitors are not used in this check.

To limit abuse of our forms and of the sign-in page of our administration area, the number of attempts per IP address (for IPv6 addresses only the network part, /64) is counted in server memory for at most 24 hours; it is not written to disk and is lost whenever the server restarts. The log of our website application never contains your IP address or e-mail address in readable form, only a short pseudonymous code that changes with every restart. Sign-in attempts to the administration area are recorded with the e-mail address entered and the IP address and kept for 180 days. The legal basis is our legitimate interest in keeping the website secure (Article 6(1)(f) GDPR).

Server logs

Every request to this website first passes through the network of Cloudflare (see section 4), which forwards it through an encrypted tunnel to our own server. Like any web server, ours writes each incoming request to a technical log: IP address, date and time, the requested address, the response code, the amount of data transferred, the referring page and the browser identifier. We use these logs only to detect and block attacks and to fix technical errors — never for analytics, profiling or advertising — and we do not share them with anyone. The log is archived every night; at most 5 daily archives are kept and older ones are deleted automatically, so no entry is kept longer than about 6 days. The legal basis is our legitimate interest in keeping the website secure and working (Article 6(1)(f) GDPR).

Spam protection

Our forms are protected by Cloudflare Turnstile, which checks whether a submission comes from a human. Turnstile may process technical data such as your IP address and browser characteristics. In addition, each form carries a one-time code signed by our server when the page loads, so that automated submissions can be recognised; this code contains no personal data. This processing is based on our legitimate interest in keeping the website secure (Article 6(1)(f) GDPR).

3. Cookies

We use a small number of cookies and similar technologies: strictly necessary storage for your consent choice, your display mode and, if you pick one, your country; and analytics cookies only with your permission. You will find the details in our Cookie Policy.

4. Third parties that process data for us

• Cloudflare, Inc. (USA): every request to this website passes through Cloudflare's network (content delivery, protection against attacks, encrypted tunnel to our server); Cloudflare Turnstile protects our forms; e-mail sent to our domain is received by Cloudflare Email Routing and forwarded to our mailbox, and our outgoing e-mail passes through a Cloudflare Worker on its way to SMTP2GO. Data: IP address, request data, browser characteristics, e-mails sent to and from us.
• Google Analytics 4 (Google Ireland Ltd.): usage statistics, only after consent; pages visited, device data, approximate location.
• E-mail: form messages are delivered by our own mail server. Outgoing e-mail is sent through SMTP2GO (SMTP2GO Ltd., New Zealand), and a copy of incoming messages is kept in our Gmail mailbox (Google). Data: name, e-mail address, message content.
• Hosting: the website, its database and the server logs run on our own server in the Netherlands, which we operate ourselves; no hosting company has access to it.

These providers process data under their own privacy terms. Where data leaves the EU, it is protected by an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework for certified US companies such as Cloudflare and Google; New Zealand) or by standard contractual clauses. Your data is never sold.

5. How long we keep your data

• Form messages in our database: deleted automatically 24 months after receipt. Related e-mail correspondence: up to 24 months after our last contact, unless a contract or legal obligation (for example the statutory retention period for invoices) requires longer.
• Data entered in a client's booking or inquiry form inside a tour: not stored by us; the business it is sent to decides how long it keeps it.
• Google Analytics data: 14 months, after which it is deleted automatically.
• Daily totals of the cookieless visit counter: 25 months, after which they are deleted automatically.
• Attempt counters for forms and sign-in (IP address or IPv6 network part): at most 24 hours, in server memory only.
• Sign-in attempts to the administration area (e-mail address entered, IP address): 180 days, then deleted automatically.
• Server access logs: at most about 6 days.
• Your consent choice: until you change it or clear your browser data.

6. Your rights

Depending on where you live, you have rights under the GDPR and, for residents of Türkiye, under Law No. 6698 (KVKK). These include the right to:

• access the personal data we hold about you
• have inaccurate data corrected
• have your data deleted
• restrict or object to processing
• data portability
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal
• lodge a complaint with your local data protection authority or, in Türkiye, with the Personal Data Protection Authority (KVKK)

To exercise any of these rights, use our contact form. We respond within 30 days at the latest.

7. Changes to this policy

We may update this policy from time to time. The date at the top shows the latest version; material changes will be announced on this page.

8. Contact

Questions about this policy or your data: contact form.