Privacy | Transitions Lab

Last updated 17 September 2026

By Marcel Kempers

Who we are

Transitions Lab is an independent research team based in Delft, the Netherlands. This page describes what happens to your data when you use the website at transitionslab.org or send us a message through it. If a study we run for a client involves your data separately, that engagement will have its own terms.

For any question about this policy, or to exercise any of the rights below, write to us via the contact page. Postal address on request.

What we collect

The Lab's website is deliberately light-touch. There are three categories of data we may handle, and none of them without you triggering it.

Analytics, only if you consent. If you accept cookies on the banner, we load a privacy-respecting analytics script served by our hosting provider, Vercel. It tells us which pages are read and how many people read them, so we can decide what to write next. It does not identify you, does not follow you across other sites, and does not use advertising cookies. If you reject, none of it loads. You can revisit that decision any time via the Cookie preferences link in the footer.

Contact form submissions. When you write to us using the contact form, your message, name and email address are relayed to us by a third-party service (FormSubmit) and land in our inbox. We use them to reply to you and to keep an ordinary record of correspondence. Nothing more.

Server logs. Our host, Vercel, keeps short-term server logs for security and reliability (rough things like time of request and IP address). We do not query, download or combine those logs with anything else.

We do not run advertising trackers, do not sell any data, do not share correspondence with third parties, and do not rent our mailing list because we do not have one.

Legal basis, in GDPR terms

We rely on:

Consent, for the analytics script (opt-in, revocable, never pre-ticked).
Legitimate interest, for reading and replying to messages you send us, and for our host's short-term security logs.
Contract, if you are engaging the Lab professionally and we agree separate terms in writing.

How long we keep things

Analytics: aggregate views only, retained by Vercel per their default retention. No individual visitor is identifiable in them.
Contact-form messages: kept while a conversation is active and for a reasonable follow-up window afterwards, then archived or deleted on request.
Server logs: kept by Vercel per their own policy; we do not extend or copy them.

Your rights

Under GDPR you can ask us to:

Access what we hold about you.
Correct anything that is wrong.
Delete anything we no longer need.
Portability: a copy of what you sent us.
Object to further use of your data.
Withdraw consent for analytics at any time via the footer link (the same as rejecting on the banner).

Write to us via the contact page and we will respond within a reasonable time. If you are unhappy with our response, you can complain to the Dutch data protection authority (Autoriteit Persoonsgegevens).

Third parties we rely on

Vercel hosts the site and serves the analytics script. Their privacy statement covers their side of that arrangement.
FormSubmit relays contact-form submissions to our email inbox. Their privacy statement covers their side.

We picked these because they do the specific job we needed and stay out of the way otherwise. If we ever change host or form provider, we will update this page and re-request consent where the framework requires it.

Changes to this policy

If the substance of what we do changes, the Last updated date at the top of this page will change and, where the change affects consent, the banner will re-appear so you can decide again. Everything else is a minor edit and will not.

See also our terms of use and cookie policy. To reach us about anything on this page, contact us.