Privacy.

Oliver Higgins, operating as higgi, based in Amsterdam, the Netherlands, is the data controller for this website and the services offered through it. For anything in this statement, including a request about your data, the contact is oliver@higgihq.com, and it reaches a person, usually within one business day.

Four things, and only when you choose to give them.

When you send the form on the contact page, it captures what you fill in there: your name and your email, plus your phone number, your website and your message if you enter them. Those go to the workspace where the enquiry is kept as a row, and a notification carrying your name, your email, your phone number if given, and the first part of your message goes to the two messaging services that alert Oliver. When you book a call, the scheduling embed on the contact page captures your name, your email, the time you picked, and anything you type into its notes field. When you write to higgi, it captures your message and your email so a reply can be sent. When you join the Opservatory waitlist, it captures your email and the optional note you type, so an invite can be sent when a place opens.

To keep the waitlist form from being abused, the IP address it was sent from is held for one hour and then expires by itself. Nothing else is done with it.

The public pages set no advertising or analytics cookies. There are no tracking pixels and no profiling. Pages are counted, without cookies and without anything being stored on your device.

Each use rests on a ground under the GDPR (AVG):

• To hold the call you booked and to reply about it: performance of, or steps toward, an agreement at your request (Art. 6(1)(b)), and our legitimate interest in answering you (Art. 6(1)(f)).
• To keep the service working and secure, prevent abuse, and meet legal duties such as bookkeeping: legitimate interest and legal obligation (Art. 6(1)(f) and (c)).
• Anything beyond the above happens only with your consent (Art. 6(1)(a)), which you can withdraw at any time.

Your data is never sold, rented, or handed to a third party for marketing. To run the service, higgi uses a small set of processors, each bound by a processing agreement, and each chosen with an EU/EEA region as the intent:

• EU-region website hosting.
• A scheduling provider that handles the booking and the calendar invite.
• An email-delivery provider to send the reply and confirmation.
• A workspace tool where a booking, or a message sent through the contact form, is recorded as a row, so the request does not get lost.
• Two messaging services that alert Oliver about a new booking or a new message. The alert carries your name, your email, the time you picked or your phone number if given, and the first part of what you wrote.
• A managed database that holds the waitlist entries.
• A rate-limiting service that briefly holds the sending IP address so the forms cannot be flooded.

The site runs in an EU region. The notification to Oliver runs through two messaging services whose companies are outside the EU, so that step is a transfer and it rests on an appropriate safeguard such as EU Standard Contractual Clauses; the same holds for the workspace tool that records the booking. Booking a call runs through a scheduling provider under its own processing agreement; where that involves a transfer outside the EU/EEA, it rests on an appropriate safeguard such as EU Standard Contractual Clauses. The same applies to the database that holds the waitlist and to the rate-limiting service that briefly holds an IP address: both run under their own processing agreement, and the intent is an EU region. Any change to this is noted here first.

The public pages set no cookies of our own, so there is no consent banner for anything we place. One strictly necessary sign-in cookie exists only inside the private client area, and only if you have a login there. The one exception is the scheduling calendar on the contact page: it is loaded from a third party and can place its own cookies as soon as that page opens. The full detail is on the cookie statement.

Kept while your request is active and for a short follow-up window after, then removed. A waitlist entry is different, and it is stated plainly here rather than implied: it stays until you ask for it to go, because the whole point is an invite that may be months away. There is no automatic clean-up on it today. One email removes it. Records kept for a legal duty (such as an invoice) are held for as long as that duty requires and no longer.

Under the GDPR (AVG) you can ask what is held about you, have it corrected, have it deleted, restrict or object to its use, and receive a copy in a portable form. Where a use rests on consent, you can withdraw it at any time. One email to oliver@higgihq.com handles it, no forms, no friction. You also have the right to complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).