Legal · GDPR

Privacy Policy

RenDealsLast updated: …

Placeholders: Complete every … field before publishing. This policy is drafted for a company established in the Netherlands and reflects the EU General Data Protection Regulation (GDPR) and the Dutch implementation act (UAVG). Because your data flows, sub-processors, and retention periods depend on how you actually operate, have a Dutch lawyer or privacy adviser review it before it goes live.

This Privacy Policy explains how RenDeals collects, uses, shares, and protects your personal data, and the rights you have under the GDPR. It applies to your use of the RenDeals website and platform (the "Platform").

Contents

Data controller
Data we collect
Purposes & legal bases
Sharing & processors
International transfers
Retention
Security
Data breaches
Cookies
Your rights
How to exercise rights
Children
Changes
Contact & complaints

01Data controller

The data controller responsible for your personal data is …, a company established in the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number …, with registered address at …. For any privacy matter, contact us at ….

Data Protection Officer (DPO): …

02Data we collect

Category	Examples
Identity & contact	Name, company name, job title, e-mail, phone number, business address
Account data	Username, password (stored hashed), account preferences
Transaction & listing data	Project details, interests, messages, documents you upload
Billing data	Billing details, invoices, VAT/tax number (as needed for fees)
Technical data	IP address, device and browser type, log records, cookie identifiers
Usage data	Pages viewed, features used, interactions on the Platform

We collect data you provide directly (e.g. when registering, listing a project, or contacting us) and data collected automatically as you use the Platform. We do not intentionally collect special categories of data (such as health or biometric data) through the Platform.

03Purposes & legal bases

Under Article 6 of the GDPR, we process personal data on the following legal bases:

Providing the service — creating accounts, enabling listings and communication between Users. (Performance of a contract, Art. 6(1)(b).)
Billing and fees — invoicing, collecting fees, meeting accounting obligations. (Contract / legal obligation, Art. 6(1)(b),(c).)
Security and fraud prevention — protecting the Platform and its Users. (Legitimate interests, Art. 6(1)(f).)
Legal compliance — meeting statutory duties and responding to lawful requests. (Legal obligation, Art. 6(1)(c).)
Communication & support — responding to enquiries, sending service messages. (Contract / legitimate interests.)
Marketing — sending commercial messages where permitted. (Consent, Art. 6(1)(a), or the soft opt-in for existing customers; you may withdraw consent at any time.)

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may ask us for more information about this balancing at any time.

We may share personal data with:

Other Users — where you choose to share information as part of a listing, enquiry, or transaction;
Processors — service providers acting on our documented instructions under a data-processing agreement, including our hosting provider …, and providers of payment, analytics, and communication services;
Professional advisers — lawyers, accountants, and auditors;
Authorities — where required by law or to protect our rights.

We do not sell your personal data.

05International transfers

Your personal data is primarily hosted within the European Economic Area (EEA) …. Transfers of personal data within the EEA are not subject to additional transfer restrictions under the GDPR.

If we ever transfer personal data to a country outside the EEA — for example to a sub-processor located abroad — we will do so only where an adequate level of protection is ensured, on the basis of an EU adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs), together with any supplementary measures required. …

06Retention

We keep personal data only for as long as necessary for the purposes described above and to meet legal, tax, and accounting obligations, after which it is deleted or anonymised. …

07Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse — including access controls, encryption in transit and at rest where appropriate, multi-factor authentication for administrative access, and regular review of our security practices. No system is completely secure, but we work to protect your data in line with the GDPR.

08Data breaches

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) without undue delay and, where feasible, within 72 hours of becoming aware of it. Where the breach is likely to result in a high risk to you, we will also inform you directly, in accordance with Articles 33 and 34 of the GDPR.

09Cookies

We use cookies and similar technologies to operate the Platform, remember your preferences, and analyse usage. Under the Dutch Telecommunications Act (Telecommunicatiewet) and the GDPR, we place non-essential cookies (such as analytics or marketing cookies) only with your consent. Our cookie banner lets you accept or reject non-essential cookies, with the "reject" option shown as clearly as the "accept" option, and you can change your choice at any time. …

10Your rights

Under the GDPR, you have the right to:

Access — obtain confirmation of whether we process your data and a copy of it;
Rectification — have inaccurate or incomplete data corrected;
Erasure — have your data deleted ("right to be forgotten") where the conditions apply;
Restriction — ask us to limit processing in certain circumstances;
Data portability — receive your data in a structured, machine-readable format and have it transmitted to another controller;
Object — object to processing based on legitimate interests, and to direct marketing at any time;
Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing;
Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

11How to exercise your rights

You can submit a request by writing to …. We will respond within one month, which may be extended by up to two further months for complex or numerous requests, in which case we will let you know. There is normally no charge for exercising your rights.

12Children

The Platform is a business-to-business service intended for professionals and is not directed at children. Under the Dutch UAVG, the age of digital consent is 16. We do not knowingly collect personal data from anyone under that age.

13Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated version on the Platform and revise the "last updated" date above.

14Contact & complaints

For any question about this policy or your personal data, contact … at … or ….

If you are not satisfied with our response, you have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (AP), at autoriteitpersoonsgegevens.nl, or with the supervisory authority in your own EU/EEA country of residence.