Privacy policy
Last updated: June 2026
Who we are
This website is operated by Sirrapa BV (trading as Sirrapa IT), registered with the Dutch Chamber of Commerce under KvK 60336250, VAT NL8538.64.020.B01, based in Tuitjenhorn, the Netherlands. For any question about this policy or your personal data, contact privacy@sirrapa.com.
What this policy covers
This policy covers the personal data we process through this website and through your first contact with us. Data we process while delivering an engagement (an audit, a governance deliverable, or engineering work) is covered by the agreement and data processing agreement for that engagement, summarised below.
What we collect
Through the website we collect only what you give us: your name, email address and message when you contact us or schedule a call, together with standard server logs (such as IP address and browser type) recorded by our hosting provider for security and reliability. If you consent to analytics, we also collect usage data as described below.
Why we use it, and the legal basis
We use your contact details solely to respond to your enquiry and to schedule and hold a call. The legal basis is our legitimate interest in answering enquiries and, where you reach out, taking steps at your request before entering into a contract. Analytics run only on the basis of your consent.
Website analytics
We use Google Analytics, provided by Google, to understand how this site is used, for example which pages are visited, so we can improve it. Analytics run only if you accept analytics in our cookie banner, and you can withdraw that consent at any time. Google acts as our processor for this usage data; we do not use it to identify you personally, and we do not use it for advertising. The legal basis is your consent.
Data you share when you engage Sirrapa IT
When you engage Sirrapa IT for a POC2Prod Blueprint™ audit, a Governance Evidence OS™ deliverable, or engineering work, you may give us access to your code, systems, documents and the personal data they contain. For that work we act as a processor on your documented instructions, under a separate written agreement. Access is least-privilege and time-bound, we do not need production credentials where a staging environment will do, and we use your data only to deliver the engagement. A short data processing agreement is available on request, and your data is returned or deleted within an agreed window (typically 30 days) after delivery. You own and approve every output before it is used.
Who we share data with
We do not sell your data. We rely on a small number of processors to operate this site: Cloudflare (hosting and content delivery), TidyCal (call scheduling), Google Fonts (typeface delivery) and, with your consent, Google Analytics (usage analytics). Each processes data only to provide its service. During an engagement we do not add subprocessors without your consent.
How long we keep it
We retain website correspondence for as long as needed to handle your request and to meet our business and legal record-keeping obligations, and no longer. Server logs and analytics data are kept for a limited period. Engagement data is returned or deleted on the timeline set out in the engagement agreement.
How we protect it
Data is handled and stored encrypted, on a need-to-know basis. A mutual non-disclosure agreement is available on request, and any suspected breach is reported to you promptly.
Your rights
Under the GDPR you may ask us to access, correct, delete or restrict your personal data, and to object to its use, and you may withdraw analytics consent at any time. To exercise any of these rights, email privacy@sirrapa.com. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Changes to this policy
We may update this policy from time to time. The date above indicates the current version.