Privacy policy
I handle other people's financial records for a living, so I'd rather be straight with you about what happens to yours. This page says what I collect, why, who else sees it, and how to get it back or have it deleted.
Short version: this website sets no cookies and tracks nobody (my client portal sets only the login cookie it needs). It counts visits in a way that builds no profile of you, and I only hold details you type in yourself.
Who is responsible
Csilla's Marketing and Administration, trading as ChillAdmin, based in Rotterdam, the Netherlands.
- KVK 96598980
- BTW NL005219950B48
- Email: hello@chilladmin.eu
I'm the data controller, which means I decide what happens to your details and I'm the one to hold responsible if it goes wrong. I don't have a data protection officer; I'm a one-person business, so you deal directly with me.
What I collect, and why
There are only three ways this website collects anything about you. All three start with you choosing to fill something in.
The newsletter
If you sign up, I collect your email address, plus the time and IP address of the signup, which MailerLite records as proof that you agreed. I use the address to send you one email a month with new articles, upcoming deadlines and what changed in the rules, and to give you access to my calculators (see "The client portal" below). That's it — I don't sell it, rent it, or hand it to anyone selling anything.
The legal basis is your consent. After you sign up, MailerLite sends you an email with a link to confirm; until you click it, you're not on the list and nothing else happens. So if someone types your address, you only get that one email. Every newsletter has a one-click unsubscribe, and unsubscribing takes effect immediately.
The client portal
Signing up for the newsletter also gives you free access to my calculators, checklists and cheat sheets, in the members' area of my client portal (portal.chilladmin.eu). When you confirm your signup, the portal creates your account automatically, with your email address, and your name if you have given it to me (for example in a message). If you set a password, it is stored scrambled, as WordPress does.
The portal then asks MailerLite to send you a welcome email with a personal login link. It works once, within 7 days; after that you log in with a password you set yourself.
- What you type into a calculator is used only to work out the result on your screen. It is not stored.
- The sign-up log: the portal keeps a short record of each account it creates or deletes (the email address and what happened), so I can check it worked. Entries are deleted after 60 days.
- Unused accounts: if the login link is never used, the account is deleted after 30 days.
- When you unsubscribe from the newsletter, or I take you off the list, your portal account is deleted within minutes. The calculators come with the newsletter, so they go with it. If you are a client, your client account stays: it belongs to our agreement, not to the newsletter.
The legal basis is the same consent you gave for the newsletter.
If you are a client, I can give you a portal account myself, without the newsletter. Your email address then goes to MailerLite only so it can send you the same login email; you are not added to the newsletter and don't receive it. When our work together ends, I remove your portal account and take your address out of MailerLite. Our emails stay part of my business records, which Dutch tax law requires me to keep for seven years.
The checklists and other downloads on the portal are for logged-in members only; their addresses don't work for anyone else.
The Hungarian newsletter
If you sign up on my Hungarian page (chilladmin.eu/hu/), or tick the newsletter box in the form there, I collect your email address, the time of the signup and the wording you agreed to. They are saved in a private Google Sheet in my Google account. This list is separate from the English newsletter and is not kept in MailerLite. I use the address to send you one email a month, in Hungarian, and nothing else.
I send those emails myself, so there is no unsubscribe button. Reply to any of them, or email hello@chilladmin.eu, and I delete your address from the sheet within a week. The legal basis is your consent. I don't send a confirmation email first, so please check the address you type.
The knowledge base (Hungarian newsletter)
When you sign up for the Hungarian newsletter, I also give you free access to the knowledge base on my client portal: a members' area of my WordPress website with articles and calculators. I create your account by hand, using the email address you signed up with, and I send you the login details by email. The account holds a username that I choose, a name (the part of your email address before the @), your email address, your password (stored scrambled, as WordPress does) and the access level I give you, "Subscriber". The legal basis is your consent, given when you sign up. When you ask me to delete your address, I delete your account as well.
The contact form
If you send me a message, I collect your name, your email address, the type of business you picked, how you found me (if you chose to say), and what you wrote. I use them to answer you. If your question turns into working together, those details become part of that; if it doesn't, the message is just a message.
Your message is stored in MailerLite, in a list that is separate from the newsletter. The legal basis is your consent. Signing up for the newsletter is a separate tick box on that form, unticked by default — asking me a question does not put you on my mailing list. If you do tick it, your email address is also added to the newsletter list, as if you had used the newsletter form.
Booking a free call
The "book a call" button hands you over to Microsoft Bookings, which shows my actual calendar. Whatever you type there — usually your name, email and the slot you picked — goes to Microsoft, and then to me. Microsoft's own privacy terms apply to that step alongside mine.
Once a call has taken place, the appointment in my calendar (your name, email address, the date and time) is part of my business records. Dutch tax law requires me to keep those for seven years, so for that part the legal basis is a legal obligation, not your consent, and I can't delete it earlier even if you ask. I use it for nothing else. A booking that is cancelled before the call doesn't count as a business record.
Who else sees your details
I use as few outside services as I can. MailerLite, Microsoft and Plausible handle your details under data processing agreements with me. The one exception is the Hungarian newsletter list, which sits in a personal Google account that has no such agreement, as explained below the table.
| Service | What it handles | Where |
|---|---|---|
| MailerLite Limited (Dublin, Ireland) | The newsletter list, the contact form, and the portal login email (also for clients outside the newsletter) | Stored in the EU |
| MagyarHosting (my hosting provider) | The website, the client portal and its accounts, and standard server logs | Company based in Hungary (EU) |
| Google Ireland Limited (personal account) | The Hungarian newsletter list, in a private Google Sheet | Stored by Google, which may process data outside the EU |
| Microsoft | Booking a free call, and my email | EU, with some support access elsewhere |
| Plausible Insights OÜ (Estonia) | Counting visits to the site, without cookies | Stored in the EU |
Nobody else. No advertising networks, no data brokers, no "partners".
About Google: I keep the Hungarian list in a Google Sheet that only I can open, in my own Google account. That account is covered by Google's terms for personal accounts, not by a data processing agreement. The list is small, it holds only email addresses with the time and wording of your consent, and I use it for nothing else. If you would rather not be on it, don't sign up there, or ask me to delete your address at any time.
I may have to share something if the law requires it — a court order, or a tax authority with a legal right to ask. That has never happened, and I'd tell you if it did unless I were forbidden to.
About the typefaces
The site's fonts are served from this website's own server, so your browser doesn't contact Google or any other outside service to show them.
How long I keep it
- Newsletter: until you unsubscribe. After that MailerLite keeps a record that your address unsubscribed, so you don't get added again by accident.
- Client portal account (English newsletter): until you unsubscribe, then deleted within minutes; after 30 days if the login link is never used. The sign-up log: 60 days.
- Hungarian newsletter and knowledge base account: until you ask me to delete them, which I do within a week. Nothing is kept about you afterwards.
- Contact messages: while we're still talking, and for up to two years after, in case you come back with a follow-up. Then I delete them.
- Visit statistics: as totals, in Plausible, for as long as they are useful to me. They don't contain anything that identifies you.
- Bookings: a call that took place stays in my calendar for seven years, as part of the business records Dutch tax law requires me to keep. A booking cancelled before the call is deleted within two years.
If you become a client, your bookkeeping records are a different matter: Dutch law requires me to keep a business administration for seven years, and I can't delete those earlier even if you ask. That's set out in the agreement we'd sign, not here.
Cookies and tracking
This website sets no cookies and stores nothing on your device: no cookies, no local storage, no session storage. It has no tracking pixels and no advertising tags.
I do count visits, with a privacy-friendly service called Plausible. When a
page loads, Plausible receives the page address, the page you came from (including the tags on an
ad link, such as utm_source), your browser and device type, and your rough location down to country.
It also notes a few actions: that the booking button was clicked, or that a message or newsletter
signup was sent, with the answer to "How did you find me?" if you gave one. Never what you wrote.
That is enough for me to see which articles get read and which ads bring people here. It does not
keep your IP address, does not recognise you from one day to the next, does not follow you to other
websites and builds no profile of you. Because nothing is stored on your device and nothing
identifies you, this needs no cookie banner. My reason for doing it is to learn what is useful and
what my advertising costs me (a legitimate interest).
If you would rather not be counted, a browser with tracker blocking switched on stops it, and the site works the same.
If I ever add anything that does need your consent, this page and the cookie policy change first, and it will ask before it runs, not after.
The client portal (portal.chilladmin.eu) is a separate address. When you log in there, WordPress sets the login cookie it needs to keep you logged in, and nothing else: no tracking and no analytics. See the cookie policy.
My hosting provider keeps standard server logs, including IP addresses, for security and to keep the site running. I don't use those logs to build any picture of you.
What you can ask me to do
Under the GDPR you can ask me to:
- tell you what I hold about you, and give you a copy;
- correct it if it's wrong;
- delete it;
- stop using it, or limit what I do with it;
- hand it over in a portable file, so you can take it elsewhere;
- withdraw your consent, at any time, without giving a reason.
Email me and I'll sort it out within a month, usually much sooner. I won't charge you and I won't ask why. If you're not happy with how I handled it, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority in whichever EU country you live in.
Data outside the EU
Most of your details are stored in the EU. Microsoft's support staff can sometimes see data from outside the EU when fixing a problem, which is covered by the standard clauses in their contract with me. The exception is the Hungarian newsletter list: it sits in Google Sheets, where Google decides which data centre holds it, and Google's terms for personal accounts apply to it.
Security
The site is served over HTTPS. Access to MailerLite and my Microsoft account is protected with strong, unique passwords and two-factor authentication, and my Google account with a passkey. I'm a one-person business — nobody else has access to your details, because there is nobody else.
If something did go wrong and your details were exposed in a way that put you at risk, I'd report it to the Autoriteit Persoonsgegevens within 72 hours and tell you directly.
Changes to this page
If I change how any of this works, I'll update this page and change the date below. If the change is significant and I have your email address, I'll tell you rather than hoping you re-read it.
Last updated: 28 October 2026.