Privacy Policy
This policy explains which personal data NetherStart Partners receives through this website and its forms, and from our clients and their representatives: why we use it, who receives it, how long we keep it and what your rights are.
Who we are and how to reach us
NetherStart Partners decides why and how the personal data described on this page is used, which makes us the controller in data protection terms. A question about this policy or about your data can go to the email address, phone number or office address below; the phone is answered during the office hours shown with them.
NetherStart PartnersPrinsengracht 280, 1016 GV Amsterdam, Netherlands
info@starting-a-business-in-the-netherlands.com
+31 20 555 7777
Monday to Friday, 09:00 to 18:00, Amsterdam time
What we collect and why
What you or your company give us, what we use it for, on which legal basis, and what happens if you leave it out.
The personal data we receive, what each item is used for and the legal basis we rely on.
| Purpose | Personal data | Legal basis | Do you have to give it? |
|---|---|---|---|
| Answering your enquiry (the contact form, the enquiry form on the home page, a question by email or phone) | Your name, email address, phone number and company name if you give them, the topic you choose and your message; a reference number when your enquiry starts from a listing on this site | Our legitimate interest in answering you; steps you ask us to take before a contract | Your name, email address and message, or we cannot reply |
| Preparing an engagement (the onboarding questionnaire) | Your contact details, country of residence, preferred reply language and channel, the planned legal form and company names, the activity, the planned capital, the number of owners and directors, whether an owner is a company, whether a director lives in the Netherlands, the services you tick, your timing, your source-of-funds confirmation and your message | Steps you ask us to take before a contract | The fields marked as required, or we cannot prepare a proposal |
| Acting for you as a client | Your identity and contact details, our correspondence, and the documents the agreed service needs | Performance of our contract with you | What the agreed service needs |
| Identifying a client and its ultimate beneficial owner where the anti-money-laundering act (Wwft) applies to a service we provide, our business address service among them | Identity details of the client, its representative and its ultimate beneficial owner, the ownership and control structure, the purpose of the relationship and, where needed, the source of funds | A legal obligation: article 3 of the Wwft requires us to identify and verify the client and its ultimate beneficial owner | Yes: without it we cannot provide that service |
| Invoices and payment requests (the payment page) | Payer name, email address, invoice number, amount, currency and payment method | Performance of our contract with you; the legal duty to keep business records | Yes, so that we can match the payment to the invoice |
| Keeping the forms safe | Your IP address, the signals of Cloudflare's security check, and a short-lived counter for your connection | Our legitimate interest in security and in telling spam from enquiries | Not a choice; kept only for the periods listed below |
| The context sent with a form | The items listed under "Context sent with every form" | Our legitimate interest in answering you and in telling spam from enquiries | No |
| Measuring visits (Google Analytics 4, Microsoft Clarity, Ahrefs Web Analytics) | Pages viewed, device and browser data and an analytics identifier (Google Analytics and Clarity, only after you accept analytics); visit counts without cookies (Ahrefs) | Your consent for Google Analytics and Clarity; our legitimate interest for the count without cookies | No: refusing changes nothing you can do on this site |
| Showing the map on our contact page | Your IP address and browser data, sent to Google only after you click to load the map | Your request, made by that click | No |
We do not sell personal data and do not use it for advertising. Our forms ask for no passport number, BSN (citizen service number) or document scan; documents a service needs are requested after the first contact, through a secure link.
Context sent with every form
Every form on this site (the contact form, the enquiry form on the home page, the onboarding questionnaire and the payment form) sends the technical context of your visit together with what you typed. It helps us answer in the right way and tell spam from real enquiries. Our legal basis is our legitimate interest in both. The context is:
- The IP address of your connection.
- The city-level location derived from it: the network's position, not a street address.
- Your internet provider (network operator).
- Your browser and operating system (user agent).
- Your browser's language.
- The referring page: the page or search that led you here.
- Your path through this site: the pages viewed in this visit.
- Your visit number and the date of your first visit.
- The time spent on the page and your local time.
- Your device type, screen and window size (viewport).
- Whether cookies are present, your cookie consent choice and, after analytics consent, your analytics identifier.
The contents of your cookies are never sent. The context travels inside the enquiry email to our mailbox, and we keep it with that email, for as long as we keep the email. Items 7 and 8 are stored in your own browser (local and session storage) only after you accept analytics, and the form script sets no cookie. Without that consent, the path through this site is only the page you sent the form from, the referring page still arrives, and the visit number, first visit and analytics identifier read "not available".
Who receives your data
These companies process data for us, or receive it when you use one of the features listed, and the last column says when. We pass personal data to nobody else, except to an authority when the law obliges us to.
Every company that receives personal data through this site, what it does for us and when it receives it.
| Recipient | What it does for us | What it receives | When |
|---|---|---|---|
| Cloudflare | Hosts this site, runs the form handlers and the security check (Turnstile), provides short-term storage and routes email sent to our address | The technical data of every request (IP address, browser, page), form submissions in transit and the security check's signals | Every visit and every form |
| Resend | Delivers each form notification to our mailbox | The content of the form and the context sent with it | Every form you send |
| Our email provider | Hosts the mailbox where messages to our address are read | Everything sent to our email address | Every message |
| Google (Google Analytics 4) | Visit statistics | Before you accept analytics, signals without cookies that a page was viewed; after you accept, pages viewed, device and browser data and an analytics identifier | As described under "Analytics and cookies" |
| Microsoft (Clarity) | Shows how pages are used (clicks, scrolling, pages viewed), with what you type masked | The same usage data and an identifier | Only after you accept analytics |
| Ahrefs (Web Analytics) | Counts visits without cookies | The technical data every page request carries | Every visit, with no cookie |
| Google (Maps) | Shows the map on our contact page | Your IP address and browser data | Only after you click to load the map |
| Stripe | Card payment of an invoice | The payer's name and email address, the invoice number and the amount; card details are entered on Stripe's page, never on this site | When you pay an invoice by card |
| NOWPayments | Crypto payment of an invoice | The payer's details, the invoice number and the amount | When you pay an invoice in crypto |
| Public authorities | Nothing for us: they receive data only when the law obliges us to provide it | What that law requires, for example records the tax authority asks for | Only then |
While online payment is switched off, a payment request reaches us by email only, and neither Stripe nor NOWPayments receives anything.
Analytics and cookies
The Google Analytics 4 tag is on every page with every consent signal set to refused. Until you choose "Accept analytics", it sets and reads no cookie and sends Google only signals without cookies that a page was viewed; after you accept, it sets its cookies. Microsoft Clarity loads only after you accept, and masks what you type into forms.
Ahrefs Web Analytics counts visits without cookies. Our fonts are served from this site, and the map on our contact page is requested from Google only when you click to load it. You can change your choice at any time with "Cookie settings" in the footer; each cookie and its lifetime are listed in our cookie policy. What a form sends is set out above.
Transfers outside the European Economic Area
Some of the companies in the table above may process data outside the European Economic Area. Such a transfer takes place only under a safeguard that the General Data Protection Regulation recognises. You can ask us which safeguard applies to each recipient, and for a copy of it, at the email address above.
How long we keep your data and how we protect it
How long each kind of data stays with us, and what ends it:
- Enquiry, onboarding and payment-request emails, with their context: while we need them to answer you.
- An enquiry that could not be delivered: held in Cloudflare's storage for 7 days, then deleted automatically.
- A copy of an onboarding questionnaire: 30 days in Cloudflare's storage, then deleted automatically.
- Form counters for your connection: 10 minutes, or 1 hour where the backup spam check runs.
- Invoices, payments and client files: seven years, under article 52 of the General State Taxes Act.
- Identification records under the Wwft: for the period that act sets after the relationship ends.
- Analytics data: for the retention period set in Google Analytics and Clarity, then deleted.
How we protect it
- Every page is served over HTTPS.
- Every form has a hidden spam trap, Cloudflare's security check and a rate limit.
- No form on this site accepts a file upload.
- No form asks for a passport number, a BSN or a document scan.
- Card details are entered on Stripe's page, never on this site.
Your rights and how to use them
Under the General Data Protection Regulation (GDPR), you can:
- See the personal data we hold about you, and receive a copy.
- Have data about you corrected if it is wrong.
- Have your data erased.
- Have the use of your data restricted.
- Object to a use based on our legitimate interest.
- Receive the data you gave us in a portable format.
- Withdraw your consent at any time ("Cookie settings" for analytics); earlier use stays lawful.
- Complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
To use any of these rights, write to info@starting-a-business-in-the-netherlands.com. We may ask you to confirm who you are before we act on a request. A right can be limited where the law obliges us to keep a record, such as the seven-year business records and the identification records listed above.
Changes to this policy
The date under the title changes with every change to this policy. A change to what we collect, or to who receives it, is made on this page before it takes effect on the site.