Privacy & cookies
Last updated: 16 October 2026 · Version 2026-10-16-v1
Who is responsible?
Spencer Waldron, trading as Cenrox, is the controller of the personal data described here. Cenrox is a sole proprietorship based in the Netherlands.
Haarlemmermeerstraat 41, 1058 JP Amsterdam, Netherlands
Privacy contact: spencer@cenrox.com
What we collect and why
- Enquiries: your name, company, email and message, and your job title and phone number if you choose to provide them. We use these to respond, discuss your requirements and manage the conversation in our private CRM. The basis is our legitimate interest in handling business enquiries, or taking steps at your request before entering a contract where applicable. You can object to processing based on legitimate interests.
- Free resources: your name and email to deliver the requested Presentation Canvas and resolve delivery problems. Our basis is our legitimate interest in fulfilling your request and providing the resource you asked for. Gift requests are categorised separately from client enquiries.
- Optional email marketing: only if you tick the separate box and then confirm by email. We record the wording/version, source form, request time and confirmation. The basis is consent. An unticked box, an enquiry, or a gift request does not subscribe you.
- Security: limited technical information, such as request logs and short-lived hashed IP rate-limit identifiers, to protect the site and prevent spam. Our basis is legitimate interests in securing our services. Form consent records do not include your full IP address.
Name, email and the relevant enquiry details are required to handle your request. Phone and job title are optional. Please avoid including sensitive personal information or other people’s confidential information in messages.
Your choice about marketing
You can use either form without opting in. Confirmation links expire after 48 hours and require a deliberate confirmation on our website. Every marketing email must identify Cenrox, include our business postal address and provide an unsubscribe link. Unsubscribing needs no account or password. It stops future marketing; it does not stop delivery of a resource you specifically request or a response about your enquiry. Withdrawing consent does not affect processing that was lawful before withdrawal.
Who processes data
We use OpenAI Sites to host this website and its private CRM, Cloudflare infrastructure for hosting, security and database services, and Resend to deliver emails. Replies and enquiry alerts also pass through our Google Workspace email service. These services process information needed to provide their functions. Access to the CRM is restricted to the authorised Cenrox owner. We do not sell your personal data or share it for third-party advertising.
Providers may process information outside the European Economic Area, including in the United States. Their applicable data-processing agreements and transfer terms describe safeguards such as European Commission standard contractual clauses and, where applicable, adequacy decisions. An EU sending region does not mean all processing takes place in the EU. Contact us for information about applicable safeguards.
Provider information: OpenAI, Cloudflare, Resend, Google Workspace.
How long we keep it
- Contact-form CRM records: up to 12 months from receipt or the most recent saved update.
- Gift request and delivery records in our database: up to 90 days.
- Unconfirmed marketing requests: confirmation tokens expire after 48 hours, then the pending request is removed.
- Confirmed subscription records: up to two years from confirmation, unless you withdraw earlier. A new opt-in is needed after expiry.
- After unsubscribing: identifiable subscription details are removed within 90 days. A minimal hashed suppression identifier is kept while we operate marketing to prevent accidental re-enrolment without fresh confirmed consent.
- Minimal consent/withdrawal evidence, including hashed email identifiers: up to three years to demonstrate consent and handle complaints.
Database cleanup runs on the next form or CRM use after a retention period expires and can also be run from our private privacy panel. Provider backups, delivery/security logs and mailbox copies have separate retention mechanisms; deletion requests are reviewed across those systems as well. Necessary client, tax or legal records are handled separately and may have statutory retention periods. Deleting a CRM record does not delete separate accounting records.
Your rights
Depending on the basis and circumstances, you can request access, correction, deletion, restriction, portability, or object to processing. You can withdraw marketing consent at any time. Email spencer@cenrox.com. We may verify your identity proportionately before releasing or deleting data. We normally respond within one month; where the law permits an extension, we will explain it. You may complain to the Dutch Autoriteit Persoonsgegevens or your local supervisory authority.
Cookies and tracking
These forms do not install advertising pixels, analytics scripts or marketing cookies. Hosting and security providers may use cookies needed for security or authentication. The CRM uses ChatGPT sign-in. We have not added open/click tracking to these enquiry, gift or confirmation flows. If optional analytics or advertising tools are added later, we will review consent requirements before enabling them.
Other information
The forms are intended for professional enquiries and adult learners. We do not use form data for automated decisions with legal or similarly significant effects. We may update this notice; the version and date above identify the wording currently in use.