Painted Afternoon Hospitality
Privacy & cookie statement
Last updated: 4 August 2026
The short version
- We collect as little as possible. There is no contact form, no newsletter, no login.
- If you email or call us, we keep what you send so we can answer you and plan your event.
- Visitor statistics only run if you press Accept. Nothing is measured before that.
- We never use advertising or tracking cookies, and we never sell your data.
1. Who is responsible for your data
Painted Afternoon Hospitality, run by Meridan Tapert, is the controller of the personal data described here.
- Chamber of Commerce (KvK): 42115705
- Email: meridan@paintedafternoon.nl
- Phone: +1 (302) 883-1024
2. What we collect and why
When you contact us
If you email, call or message us about an event, we keep your name, contact details and whatever you tell us about the booking. We use it to answer you, quote the work and deliver it. Legal basis: performing a contract or taking steps before one (GDPR art. 6(1)(b)). Where a request never turns into a booking, the basis is our legitimate interest in answering enquiries (art. 6(1)(f)).
How long: correspondence that leads to invoiced work is kept for seven years, because Dutch tax law requires it. Enquiries that go nowhere are deleted within two years.
Visitor statistics
With your consent we use Google Analytics 4 through Firebase to count visits and see which pages get read. That records the pages you open, roughly where you are (derived from a shortened IP address), your device and browser type, and the site that sent you here. We do not use it to identify you, and it is switched off until you press Accept. Legal basis: your consent (art. 6(1)(a)), which you can withdraw at any moment.
How long: Google keeps the event data for 14 months.
Server logs
This site runs on Firebase Hosting. Like any web server it logs requests, including your IP address, to keep the site available and secure. Legal basis: our legitimate interest in a working, secure website (art. 6(1)(f)). These logs are short-lived and we do not use them to profile visitors.
Fonts and scripts from other providers
The page loads its typeface from Google Fonts and its styling framework from the Tailwind CDN. Your browser contacts those servers directly, so they see your IP address and browser details. This happens for everyone, including visitors who decline statistics, because the page cannot render without it. If you would rather not have that, these files can be hosted on our own domain instead — a change we are happy to make on request.
3. Cookies and local storage
Two of these are set by the site itself and are needed for it to behave properly. The rest only appear after you accept statistics.
| Name | Type | Purpose | Kept for |
|---|---|---|---|
| pa_cookie_consent_v2 | Local storage · necessary | Remembers your cookie choice so we stop asking | 6 months |
| theme | Local storage · necessary | Remembers whether you chose light or dark mode | Until you clear it |
| _ga | Cookie · statistics | Tells one visitor apart from another (Google Analytics) | 2 years |
| _ga_<ID> | Cookie · statistics | Keeps track of the current visit (Google Analytics) | 2 years |
The site uses Google Consent Mode, which means the Google tags are told your answer before they do anything. Decline, and no statistics cookies are placed at all.
You can change your mind whenever you like through , also linked at the bottom of every page. Withdrawing is as easy as giving consent, and it does not affect anything measured before you withdrew.
4. Who else sees your data
We do not sell or trade personal data. It is shared only with the suppliers that make the site and the business work:
- Google Ireland Ltd. — Firebase Hosting and Google Analytics, acting as our processor.
- Our email provider — for the messages you send us.
- Our bookkeeper and the Dutch tax authority — for invoiced work, where the law requires it.
Google may process data outside the European Economic Area, including in the United States. Those transfers rely on the EU–US Data Privacy Framework and, where needed, the European Commission's standard contractual clauses.
5. Your rights
Under the GDPR you can ask us to:
- show you a copy of the data we hold about you;
- correct anything that is wrong;
- delete your data;
- limit how we use it, or object to us using it;
- hand it over in a portable format;
- withdraw consent you gave earlier.
Email meridan@paintedafternoon.nl and we will respond within one month. We may ask you to confirm who you are first, so we do not hand your details to someone else.
If you are unhappy with how we handled it, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
6. Security, children and changes
The site is served over HTTPS and access to our accounts is protected. No system is perfect, but we take reasonable steps to keep your details safe.
This site is not aimed at children under 16 and we do not knowingly collect their data. If you believe we have, email us and we will delete it.
When this statement changes, the date at the top changes with it. If the change affects what we do with data you already gave us, we will ask again rather than assume.