GDPR

I. Introduction

The General Data Protection Regulation (GDPR) applies to our business, as we offer goods and services to users located in the Netherlands. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) is the national supervisory body responsible for monitoring, guiding and enforcing the GDPR within the Netherlands. The Netherlands has implemented national legislation to give effect to the GDPR in line with European Union requirements.

II. Scope

GDPR rules apply to:

Any data controller or processor established within the Netherlands;
Any organisation located outside the European Union offering goods or services to persons residing in the Netherlands, or monitoring the behaviour of persons located in the Netherlands.

Regardless of where data processing takes place, the GDPR applies whenever personal data of persons located in the Netherlands is processed.

It covers both automated processing and non‑automated processing forming part of a filing system.

Activities of a purely personal or household nature fall outside its scope.

III. Data Processing Principles

Lawfulness, fairness and transparency: Any processing must be based on a clear legal basis and carried out transparently.

Purpose limitation: Data may only be used for specified and legitimate purposes.

Data minimization: Only strictly necessary data shall be collected.

Accuracy: Personal data must be accurate and kept up‑to‑date.

Storage limitation: Data shall only be retained for the period strictly required, after which it shall be deleted or anonymised.

Integrity and confidentiality: Appropriate technical and organisational measures shall be implemented to prevent data breach, alteration or loss.

IV. Rights of data subjects

Under the GDPR, natural persons have the following rights:

Right to be informed and right of access;
Right to rectification;
Right to erasure (“right to be forgotten”);
Right to restriction of processing;
Right to data portability;
Right to object.

For children under 16 years of age, processing of their personal data requires consent from a parent or legal guardian. Information shall be provided to minors in clear, easily‑understandable language.

V. Obligations of the processor

Processors shall:

Strictly follow the written instructions issued by the controller;
Implement appropriate security measures;
Assist the controller in fulfilling its obligations, in particular responding to requests submitted by data subjects;
Notify the controller without undue delay upon discovering a personal data breach. The controller shall notify the Autoriteit Persoonsgegevens where required by GDPR.

Controllers shall maintain records of processing activities and conduct a Data Protection Impact Assessment (DPIA) for high‑risk processing operations. Where legally required, a Data Protection Officer (DPO) shall be appointed.

VI. International Data Transfers

Where personal data is transferred from the EU / Netherlands to a third‑country (outside the European Economic Area), the controller must guarantee an adequate level of data protection. Valid mechanisms include:

An adequacy decision adopted by the European Commission;
Execution of the European Commission‑approved Standard Contractual Clauses (SCCs).

Following the invalidation of the Privacy Shield framework in July 2020, transfers to the United States shall rely upon the updated Standard Contractual Clauses adopted June 4, 2021 or other legally valid transfer mechanisms.

VII. Monitoring and enforcement

The Autoriteit Persoonsgegevens holds broad enforcement powers, including:

Issuing warnings and formal notices;
Restricting or prohibiting certain processing activities;
Imposing administrative fines up to €20 million or 4 % of global annual turnover, whichever is higher.

The GDPR‑aligned framework in the Netherlands safeguards individual data subject rights, strengthens organisational compliance and builds trust in digital services.