Privacy policy

Last updated: 10 October 2026.

Nature of Wonder is the trading name of Sacha Post’s sole proprietorship. Our address is Dorpsstraat 265, 1733 AK Nieuwe Niedorp, the Netherlands. We are registered with the Dutch Chamber of Commerce under number 85533165. Sacha Post is responsible for your data. You can reach us via sacha@natureofwonder.nl .

What we use

We use only the data we need:

• Contact. Your name, contact details and message let us answer you and make arrangements.
• Free letters. With your email address and consent, we send the letters and manage your subscription. Choosing the letters at checkout is separate from your purchase. If you subscribe separately, change language or unsubscribe through the website, you confirm it by email. The unsubscribe button in your mail app works straight away.
• Bookings, products and memberships. We keep your name, email address, chosen offer, the terms you accepted, the price and payment status. This lets us fulfil our agreement and keep the required records. We ask for a telephone number where needed. Mollie keeps your payment method details.
• Practical information. If meals are included, email us only the allergy or dietary requirement we need to know about. We do not need a medical, religious or philosophical explanation.
• Feedback and testimonials. Your feedback helps us improve a programme. We publish your experience only with your separate consent. As evidence, we keep the submitted text, your first name and email address, the language, date and form version.
• Calls and recordings. With your consent in advance, we may record and automatically transcribe a Google Meet call. We share this only with people involved in the programme or call. For longer programme development, we keep only notes from which you can no longer reasonably be identified.
• Rewilding and emergency contact. Before departure, you give us the name and telephone number of someone we can reach in an emergency. At departure, you fill in a paper safety form with the health and insurance details needed for safe guidance and that person’s details. Send them the short notice on the form beforehand. We use this information only for safe guidance and a possible emergency.
• Handling and recovery. Protected working records may contain data from a contact or feedback form we accepted, or limited booking or payment information. This lets us finish a request that has stalled. They contain no passwords, full payment details or usable confirmation or download links.
• Website and security. Our records of website requests and security may contain your IP address, the time, requested page, response code and technical browser details. We use them to keep the site working and safe, and to investigate misuse, faults and security incidents.

For a booking, we need your name, email address and necessary booking and payment details. Without them, we cannot complete the booking. The letters, Signal, publishing testimonials and recordings are voluntary.

We use your data to contact you and prepare something at your request, to fulfil our agreement or to meet legal record-keeping duties. We also use data to keep the service reliable and safe and to understand, in totals, how the site, letters and bookings are used; we have a legitimate interest in doing so. Where needed, we ask for your consent for letters, publication, recordings and sensitive information.

A message or dietary requirement may reveal something about your health, religion or beliefs. We do not ask why when practical information is enough. If we want to use such information deliberately for a separate purpose, we ask for your explicit consent. In an acute emergency, we may use necessary information to protect someone’s vital interests.

Do not put medical information or payment details in a general contact or feedback form.

Website and email statistics

To prevent automated form submissions, your browser performs a short calculation when you submit the form. Our own server issues and checks this ALTCHA proof; no outside service is involved. The check requires JavaScript, uses no cookies, and neither reads nor writes data in your browser’s storage. We do not record your interactions or use the check to recognise you. Our legitimate interest is preventing spam and protecting the service. Without JavaScript, you can contact us by email.

We use no cookies for visitor statistics, invisible tracking images or fixed visitor numbers. We do not save data for later use in your browser’s storage. We do not combine browser features to recognise you or follow you across other websites. We use no invisible images in our emails. Amazon SES does not track whether you open a message or click a link. If you follow a link in a letter to our site, we include those website requests only in totals, using its campaign and source labels. We do not link those counts to your email address.

When you visit a page, our server records your IP address, the time, the full web address you asked for, the response, how much data we sent, the page you came from and the technical details your browser sends. Files you download come from signed links served by Amazon CloudFront.

From CloudFront delivery logs, we count successful requests and bytes sent per file and day. These logs expire after three days. On our server, we process private temporary copies and delete them after counting or when the process ends. Each file is represented by an opaque code. Only totals by day, file code and file group enter the optional export to restricted Google BigQuery storage in the Netherlands. These totals contain no visitor identifier. We do not export raw logs, file paths, IP addresses, browser details, referring pages, query strings or signed-link parameters.

On our server, we make totals from records of email delivery. These give us figures for delivery. We do not send recipient email addresses or sender IP addresses to BigQuery.

For selected public pages and links, we make daily totals. We count by published page and route, language in the site address, link purpose, campaign and source labels, type of traffic, type of device, country and amount of data sent for each part of the site. We estimate country from your IP address using address data from the five regional organisations that assign internet addresses. We do not keep IP addresses with these statistics. We group countries with fewer than three requests under “other.” Language comes from the site address (/en/ or the Dutch path); we do not collect your browser language. Older totals may still include accepted downloads per file.

A request may come from a person, a browser loading ahead, a mail program checking links or an automated program visiting pages. The labels “likely human” and “verified agent” are only working categories. They do not prove who used the site or what that person or program intended. We do not make decisions about individuals from these counts.

We count weekly sign-ups, confirmed subscriptions, language changes and unsubscribes, including how people unsubscribe and the number of unsubscribes per letter. On our server, we compare email addresses in sign-up, consent, subscription and booking records. This tells us how long confirmation takes, how often someone books again and how long after subscribing they first book. We count language changes from a separate record without an email address. We do not count replies to letters. Only totals from these comparisons go to the optional BigQuery export.

If we enable Google Search Console, we get daily figures for each page: clicks, appearances in search results, the share of appearances that led to a click and average position. We do not request or keep search queries.

If we turn on the export to Google BigQuery, totals, checks on them and brief details about each export go to a restricted storage area in the Netherlands. These include totals for bookings, revenue and payment methods. A small total can still point to one booking, so we treat these figures as personal data. We do not send IP addresses, full web addresses, referring pages, browser details, email addresses or payment details to BigQuery. Some of these details are also in the encrypted backups and daily audit email described below.

We also estimate how many different internet connections visited on a day. For this we use a secret that changes daily and is then deleted; it never leaves our server. We keep such a count only when it is large enough to protect small groups. It does not count people or devices.

Who receives data

We share only what is needed:

• our website and the mailing lists we manage ourselves are hosted by openbsd.amsterdam within the European Union;
• Amazon SES delivers messages to customers and to us, including the daily audit email;
• Google Workspace stores our correspondence, calendar and contact details, notifications, audit emails and any Meet recordings and transcripts;
• if we turn on the export, Google BigQuery receives these totals and checks, with brief details about each export;
• Amazon Web Services stores recordings for members and the podcast and delivers them when you listen or download;
• Mollie processes payments and keeps data it needs for legal duties, security and preventing fraud;
• our accountant and the Dutch Tax Administration get financial records where the law requires it;
• our backup program sends encrypted copies to the openbsd.amsterdam backup server in the Netherlands and attempts a second encrypted copy with AWS (Amazon Web Services) in Stockholm, Sweden. Only we hold the key;
• a venue or caterer gets only headcounts and practical dietary requirements, without names where possible;
• guides get only the information they need for their role;
• you choose whether to join a Signal group. Other members see your profile and may see your telephone number, depending on your settings and their address books;
• Garmin/MapShare may show the group’s recent position during Rewilding to people with the private link and access code. We disable the link when we leave the wilderness and keep no separate copy of the location data ourselves;
• api.video shows videos on a few pages. When a video comes into view, your browser loads its player. api.video receives your IP address and browser details and records when its player loads and when you play a video;
• in an emergency, emergency services, a doctor, insurer or your emergency contact get only the information needed then.

We do not sell your data. We do not use it to build a profile of you or make automatic decisions about you.

You can ask us for a copy of your data.

Retention

• We keep financial records for seven years. We remove other agreement data when we no longer need it to fulfil the agreement or handle a possible dispute.
• Your data stays on the active letters list until you unsubscribe. We keep evidence of consent and unsubscription only as long as needed to manage your subscription and show that we follow the rules.
• We keep your consent for a published testimonial, photo or recording while we use the material. If you withdraw consent, we remove the material from channels we control. We cannot recall letters already sent or printed material.
• We remove allergy and dietary details within thirty days after the programme.
• We destroy the paper Rewilding form and your emergency contact’s details on the return journey. We do not scan or back them up. We may keep only necessary information about a real incident for as long as we need to handle it.
• We remove raw Meet recordings and transcripts within eighteen months. We may keep notes from which you truly cannot be identified for longer.
• A temporary Signal group for a programme may stay open as a voluntary alumni group for up to eighteen months. You may leave earlier at any time.
• On the live server, we start new files each day for records of website requests, email delivery and how the site is working. We keep website request records for up to about eight days, and email delivery records and our record of accepted requests for no more than seven days. We may keep separate bot and error records for up to thirty days. Raw website request records are left out of backups; encrypted backups may contain our record of accepted requests and bot and error records. We may keep a separate incident report longer while handling the incident. We remove temporary information used to sort requests after making the totals. We may keep totals longer to compare them and plan.
• The daily audit email may contain a readable copy of working records from the previous 24 hours. We keep audit emails and notifications in Google Workspace only while needed to deliver or recover something, stay in touch or handle a possible dispute.
• On the openbsd.amsterdam backup server, the program removes copies after 30 days once it has checked that each is complete and unchanged. If a check or deletion fails, a copy may stay longer. The second copy is protected from deletion for 30 days. AWS is set to expire it after 31 days, but an encrypted version may remain longer. We use backups only to restore data. After a restore, we delete again any data we had previously removed.

Your rights

You can ask to see, correct, erase, limit the use of or transfer your data. You can object if we use data because of a legitimate interest. You can also withdraw consent; that applies to future use. We still have to keep some data because of a legal duty, agreement or dispute.

Send your request via sacha@natureofwonder.nl . We may ask you to confirm who you are. You can also complain to the Dutch Data Protection Authority.

We protect your data by limiting access and using encrypted connections and backups. Only authorised administrators can access files used to run the service. If this policy changes in an important way, we update the date and tell affected people where required.