Privacy notice
Last updated: 5 October 2026
This notice explains what personal data RecyFert Consulting Services B.V. collects through this website, why, and what your rights are.
Who we are
RecyFert Consulting Services B.V. is responsible for your personal data (the "controller" under the EU General Data Protection Regulation, GDPR).
- Address: Keizerstraat 5 D, 2584 BA Den Haag, the Netherlands
- KvK: 99318296
- Email for privacy questions: robert.vanspingelen@recyfert.com
What we collect
When you use the "Book a call" form, we collect:
- your name, company and email address
- the module and licence option you choose
- what you write about your products and preferred days
- the date and time of your request, and the page you sent it from
We do not ask for sensitive data. Please do not send it in the message field.
If you book a time through our Google Calendar booking page, we receive your name, email address, the chosen time and any answers you give in the booking form.
When you become a client, we also process the details needed for the quote, the invoice and the payment, such as your billing address and VAT number.
Why we use it, and on which legal basis
| Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|
| Replying to your request, arranging the scoping call and sending a quote | (b) steps you asked for before entering into a contract |
| Carrying out the contract: building, finalising and archiving your dossier | (b) performance of a contract |
| Invoicing, payment and bookkeeping | (c) legal obligation (Dutch tax law) |
| Following up on a request that did not become a contract, for example one reminder | (f) legitimate interest in following up on business enquiries |
| Counting visits and measuring which pages and buttons work, to improve the website | (f) legitimate interest in understanding how the website is used |
We do not sell your data. We do not use it for automated decisions or profiling. We do not add you to a newsletter.
Who receives your data
We use service providers that process data on our behalf, each under a data processing agreement:
- Lovable (Sweden): website hosting
- Plausible Insights OÜ (Estonia): privacy-friendly website statistics, hosted in the EU. See "Cookies and similar technology".
- Supabase (via Lovable Cloud): stores form requests in a secured database
- Resend (Resend, Inc., USA): sends the notification and confirmation emails. Emails are sent from Resend's EU region (Ireland).
- Mollie B.V. (Netherlands): handles payments when you pay a quote
- Google Workspace (Google Cloud EMEA Limited, Ireland): our email and calendar. If you book a call through our Google Calendar booking page, Google processes your name, email address and the time you choose on our behalf.
If you work with us on a dossier, we also share data with Gilbert RegTech B.V., which provides the Gilbert FPR software where your dossier is built. Gilbert RegTech B.V. is a related company (see "Related companies" on the homepage). With your agreement, we also share data with the notified body you choose.
We share data with authorities only when the law requires it.
Transfers outside the EU
Google, Resend and Supabase are US companies, so some data may be accessed from or processed in the United States. We rely on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses for this.
How long we keep it
- Requests that do not become a contract: 12 months after our last contact, then deleted.
- Client and contract data: for the duration of the contract and as long as needed for the dossier archiving you ordered.
- Invoices and accounting records: 7 years (Dutch tax law, Article 52 of the General Tax Act).
Cookies and similar technology
We use Plausible Analytics to count visits and see which pages and buttons are used. Plausible does not use cookies, does not store your IP address and does not track you across websites. It works with anonymous, aggregated data only: a daily changing code is used to count unique visitors and is deleted after 24 hours. No data is shared with advertisers. The data is stored in the EU.
We do not use advertising or tracking cookies. We store one setting in your browser's local storage: your choice of light or dark theme. It never leaves your device. You can clear it in your browser settings.
Our hosting provider sets one strictly necessary security cookie (__cf_bm) to protect the site against bots. It expires after 30 minutes and is not used for tracking.
Fonts are served from our own website. No data is sent to Google Fonts or other font services.
Your rights
You have the right to:
- see the personal data we hold about you
- have it corrected or deleted
- limit or object to its use
- receive it in a common format (data portability)
Send your request to robert.vanspingelen@recyfert.com. We reply within one month.
If you are not satisfied with how we handle your data, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or the authority in your own EU country.
Security
Form data is sent over an encrypted connection (HTTPS). Only RecyFert staff who need the data can access it.
Changes
We may update this notice. The date at the top shows the latest version.