Privacy policy.

Last updated: 6 May 2026

Studio Groei B.V. respects the privacy of its visitors, clients and recipients of quotes and invoices. We handle personal data with care and process it in accordance with the General Data Protection Regulation (GDPR).

1. Who is responsible?

• Name: Studio Groei B.V.
• Address: [FILL IN]
• Chamber of Commerce: [FILL IN]
• Contact: [email protected]

2. What data do we process?

2.1 When you contact us or make a request

When you contact us or book an appointment via our website:

• Name and company name
• Email address
• Phone number (if provided)
• The content of your message or preferred time slot

2.2 For quotes and invoices

When we send you a quote or invoice:

• Contact person and company details
• Address, Chamber of Commerce number and VAT number
• Email address and phone number
• The content of the quote/invoice (description, amounts)
• On acceptance of a quote: digital signature and date
• On payment: payment status (no card details, those are processed by Mollie)

2.3 When you register an account

When you create an account on our site (e.g. to view your projects):

• Email address and password (stored hashed)
• Optional: name, phone number, company name
• Account activity (sign-in history)

2.4 Technical data

When you use our website, we automatically process:

• IP address (anonymised where possible)
• Browser type and version
• Pages visited and time spent
• Referring website

3. Why do we process this data?

• Performance of a contract: to prepare quotes, carry out assignments, send invoices and process payments.
• Legal obligation: to comply with accounting and tax retention requirements.
• Legitimate interest: to improve and secure our website.
• Consent: for optional communications such as news updates (only when you explicitly opt in).

4. Who do we share data with?

We only share data with third parties when this is necessary for our services or a legal obligation. Our main processors:

4.1 Hosting and infrastructure

• Google Cloud Platform (Google Ireland Limited), hosting of our website and applications (Cloud Run), data storage (Firestore, Cloud Storage). Data centres within the EU (europe-west4).
• Firebase Authentication (Google), login and account management.

4.2 Communication

• Resend, sending of transactional emails (quotes, invoices, confirmations).

4.3 Payments

• Mollie B.V., processing of online payments via iDEAL, credit card, Bancontact and bank transfer. Mollie processes payment details itself; we only receive the status (paid/outstanding).

4.4 Code and version control

• GitHub (Microsoft Corporation), source code management for our own applications. Client data is not stored in code.

4.5 Statistics

• Google Analytics 4 & Google Ads (Google Ireland Limited), anonymised visitor statistics to improve the site and to measure conversions from our own ads. We use Google Consent Mode v2: analytics and advertising cookies are only placed after you accept them via the cookie banner. GA4 does not store full IP addresses. You can change your choice at any time via “Cookie preferences” at the bottom of every page.

Data processing agreements have been concluded with all of these parties in accordance with the GDPR. Apart from the parties listed above, we do not share data with third parties without your explicit consent, unless legally required.

5. How long do we keep data?

• Invoices and accounting: 7 years (statutory tax retention obligation).
• Quotes: 7 years if accepted; 2 years if rejected or expired.
• Client contact details: up to 2 years after the last interaction, or for as long as an active relationship exists.
• Account data: until you delete the account. On request, data is deleted within 30 days, unless statutory retention periods require otherwise.
• Server logs: up to 90 days.

6. Cookies

We use a limited number of cookies:

• Functional cookies: necessary for the website to work (such as remembering your login session). No consent required.
• Preference cookies: store your language choice, your theme (dark/light mode) and your cookie choice. No consent required.
• Analytics and advertising cookies (Google Analytics 4 & Google Ads): only placed after you accept them via the cookie banner. They are off by default (Google Consent Mode v2: analytics_storage and ad_storage set to “denied”). We use these to measure visits and the performance of our own Google Ads campaigns; we do not use tracking cookies such as the Facebook Pixel.

You can withdraw or change your consent at any time via the “Cookie preferences” link at the bottom of every page.

7. Your rights

Under the GDPR you have the following rights:

• Access: request which data we process about you.
• Rectification: have incorrect data corrected.
• Erasure: request that your data be deleted (the “right to be forgotten”), insofar as statutory retention periods permit.
• Restriction: ask us to restrict the processing.
• Objection: object to processing based on legitimate interest.
• Data portability: receive your data in a structured, machine-readable format.
• Withdraw consent: withdraw consent you have given at any time.

Send your request to [email protected]. We respond within 30 days. Not satisfied with how we handle your data? You can file a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

8. Security

We take appropriate technical and organisational measures:

• Encryption of data in transit (TLS) and at rest.
• API keys and sensitive tokens stored in Google Cloud Secret Manager, not in our database.
• Access to administration systems only via two-factor authentication.
• Restricted access based on role (admin / user).
• All data within EU data centres (Google Cloud Platform europe-west4, Netherlands).

9. Changes

We may update this privacy statement from time to time. You will always find the most current version on this page. We will actively inform you by email about significant changes.

10. Contact

Do you have questions about this privacy statement or about how we handle your data? Get in touch at [email protected].