Privacy policy
Last updated: 10 November 2026
This notice explains personal information used for the VCESR website, direct enquiries, requests to join our team, product demonstrations and sales correspondence. The responsible organization is Valtice Center for Economic and Statistical Research B.V. (VCESR), Nijverheidscentrum 28, 2761 JP Zevenhuizen ZH, Netherlands. KvK: 42180682. Contact: contact@vcesr.com.
Optional analytics and video connections require your consent. You can reject them and use the site. We do not sell personal information or share it for cross-context behavioural advertising.
What we use and why
| Activity and information | Purpose and legal basis |
|---|---|
| Website delivery: IP address, request time, requested resource, browser/device and technical error or security information received by the hosting service. | Deliver the site, diagnose faults and prevent abuse. Our legitimate interests in operating a reliable and secure website, Article 6(1)(f). |
| Enquiries: sender name, email address, organization, message and attachments you choose to send. Sales and support correspondence may contain order or license information. | Answer requests, arrange demonstrations and support products. Steps before a contract or performance of a contract, Article 6(1)(b); otherwise our legitimate interest in responding to correspondence, Article 6(1)(f). |
| Business records: customer and billing details, transaction references and invoices associated with an agreed sale. | Fulfil a contract and meet accounting or tax duties, Articles 6(1)(b) and 6(1)(c). A payment provider, if used at checkout, handles payment credentials under its own notice. |
| Browser preferences: a timestamped consent choice and policy version, Simple mode, animation and colour theme settings. Dilemma notebooks and custom models are stored in your browser. | Remember choices and provide functions you request. Necessary preference storage under applicable cookie rules; legitimate interests in respecting choices. Dilemma does not upload your notebook to VCESR. |
| Optional visit measurement: Google Analytics receives page visits, fixed referral and product or service labels, link actions, enquiry completion events, cookie identifiers and browser/network information when you consent. | Understand how visitors find and use public pages, product links and service enquiry routes. Consent, Article 6(1)(a). Advertising storage, advertising user data and personalized advertising remain denied. |
| Optional YouTube playback: Google / YouTube receives network, browser and viewing information when you allow and start a video. | Play a video you request. Consent, Article 6(1)(a). Google may process information as an independent controller under its own privacy notice. |
Information comes from you, your browser, technical service providers and, for a business transaction, the relevant payment or distribution provider. We do not ask for sensitive information, precise location, government identifiers or private research datasets through this marketing site. Do not include unnecessary sensitive information in an enquiry.
Enquiries about joining the team
The team enquiry form collects your name, email address and professional introduction. We use this information to consider and reply to your request to work with VCESR, based on our legitimate interest in handling these enquiries (Article 6(1)(f)). These fields are needed to send the form; you can also email us directly.
Messages are saved in our Feldsberg CRM, and Resend sends a notification to authorized VCESR staff handling your enquiry. People consider each enquiry individually. The details are used only for this discussion; keeping them for future opportunities requires a separate choice.
If an enquiry does not lead to working together, our retention policy is to delete it within four weeks after the discussion or selection process closes. Records needed for an agreed working relationship or a legal claim are limited to that purpose. You can contact contact@vcesr.com to request access, correction or deletion, or to object to processing. See our providers, international transfers and your privacy rights for more details.
Purchases and product delivery
Stripe confirms payment to our server. We then prepare the purchased entitlement and send the licence and a private installer link through Resend. We record delivery events, such as acceptance, delivery failure and bounce, to resolve support requests. Delivery to a mail server does not establish that a person read the message. We do not use email open or click tracking in these transactional messages. Payment records needed for statutory accounting are retained under those obligations; enquiry information is kept only for its stated purpose and retention period.
Analytics and videos are separate choices
The Google Analytics tag is blocked until you opt in. Rejecting analytics also blocks cookieless measurement pings from our integration. Page addresses sent by our code omit query strings and fragments. We do not send your message content, notebook, form values, email address or a user ID to analytics. We do not run analytics on the team page, purchase access page, the Dilemma application or these policy pages. Purchase tokens and email addresses are not sent to analytics.
Video covers are hosted on our website. Embedded YouTube players connect only after you press the clearly labelled play control. We use YouTube’s privacy-enhanced player domain, which does not make playback anonymous. The direct YouTube link lets you visit the provider separately.
The cookie policy lists browser storage and its duration. Consent can be withdrawn at any time through Privacy settings. Withdrawal stops future optional processing and does not affect processing that was lawful before withdrawal or automatically erase information already received by a provider. You can also request deletion.
Who may receive information
We use hosting and security infrastructure (Vercel), Resend for transactional email and website enquiry notifications, Stripe for payments, Feldsberg as our customer and order workspace, email service providers for correspondence, and relevant payment or store providers when you use their services. Website enquiries are stored in our access-controlled Feldsberg CRM before a notification is emailed to our team. We keep the request, contact details, status, assigned person and follow-up history. Purchases link billing and transaction details to the same customer record, with licence and delivery status. We store transaction references rather than card details; Stripe handles payment credentials. Licence signatures contain a pseudonymous holder reference, product entitlement and accepted terms. Private purchase links expire and can be recovered by email. Authorized VCESR personnel and professional advisers may access information when needed for their work and applicable duties. We use appropriate processing agreements where a provider processes data on our behalf.
Google Analytics is provided in Europe through Google Ireland Limited and related Google entities. YouTube is a Google service. See Google’s privacy policy, Vercel’s privacy notice and Google’s information about partner websites.
Resend's message delivery may involve processing in the United States. Its data processing addendum describes processing and transfer terms.
External stores, GitHub and other linked services apply their own notices when you leave our site. A link alone does not authorize us to transmit private project material to that service. We may disclose information when required by law or to establish, exercise or defend a legal claim, subject to applicable safeguards.
How long information is kept
- Consent preferences expire after 180 days, after which we ask again. Display preferences stay in your browser until you change or clear them.
- Dilemma experiments remain on your device until you remove them or clear site storage. Export a notebook first if you want to retain it.
- Analytics cookies set by this integration expire after 60 days and are not extended on each visit. Our operating retention policy for user-level and event-level analytics records is two months. Aggregated reports may persist longer.
- Enquiry and support correspondence is kept while a request, contract or related follow-up requires it. We review inactive correspondence and delete it when it no longer serves that purpose. A continuing dispute or legal obligation may require longer retention.
- Transaction records are retained for applicable statutory periods; Dutch basic business administration generally has a seven-year retention requirement, with longer periods for certain records.
- Technical logs follow the hosting service’s configured operational retention. We retain information longer only where needed for a specific security incident, legal duty or claim.
Processing outside your country
Hosting, email and optional Google services may involve processing outside the Netherlands, European Economic Area or United Kingdom, including in the United States. Where European data protection law requires a transfer safeguard, the applicable arrangement must use an adequacy decision for an eligible recipient or appropriate contractual safeguards, such as the European Commission’s Standard Contractual Clauses and, where applicable, UK transfer terms. A provider’s participation in an adequacy framework is relevant only while its certification and the transfer remain covered.
Contact us for information about the safeguards applicable to your data or a copy of relevant safeguards, with confidential details removed where necessary. The fact that a website has a consent banner does not by itself establish a lawful international transfer.
Your European privacy rights
Subject to the conditions in the GDPR and other applicable law, you can request access, correction, erasure, restriction and a portable copy of your information. You can withdraw consent and object to processing based on legitimate interests, including an unconditional right to object to direct marketing. We do not use this marketing website to make solely automated decisions producing legal or similarly significant effects.
Email contact@vcesr.com with enough detail to identify your request. We verify identity proportionately and ask for additional information only when reasonably needed. We normally respond within one month; a lawful extension will be explained within that period. You can complain to the Dutch Autoriteit Persoonsgegevens or the supervisory authority where you live or work. UK residents can contact the Information Commissioner’s Office.
US state privacy notice and choices
Where a US state privacy law applies to VCESR and your request, you may have rights to know or confirm processing, access, correct, delete and obtain a portable copy of information; opt out of sale, targeted advertising or certain profiling; and limit certain uses of sensitive information. The categories and purposes in the table above describe our current practices. We do not use sensitive information to infer characteristics or offer financial incentives for personal information.
We do not sell personal information or share it for cross-context behavioural advertising, and do not use this site for targeted advertising. Global Privacy Control and Do Not Track signals disable our optional analytics even if a prior browser choice allowed it. See Your privacy choices to reject optional services or exercise a right without creating an account.
We do not discriminate against you for exercising a right. You may use an authorized agent where permitted; we may request evidence of the agent’s authority and proportionate identity verification. We respond within the applicable period, generally 45 days for covered US requests, and explain any permitted extension. If we decline a request, you can appeal by replying with “Privacy appeal”; we explain the outcome within the period required by the applicable state law. You may also contact your state attorney general or relevant privacy authority. These rights depend on statutory coverage and exceptions; this notice does not assert that every state law applies to this company.
Children, security and product-specific information
This business website is not directed to children under 13. We do not knowingly collect their personal information for optional analytics or marketing. If you believe a child provided personal information, contact us so we can investigate and delete it where required. We use access controls and appropriate technical and organizational measures; no internet service can guarantee absolute security.
The Korzarkia game privacy policy separately describes the offline Android game. Feldsberg deployments and commissioned work require an agreed data-processing and operating arrangement. This marketing notice does not replace those arrangements or describe private customer datasets.
Changes and contact
We update this notice when practices change and show the effective date above. Material changes to optional processing require a renewed choice before it starts. Contact contact@vcesr.com or write to VCESR at the postal address above.