De Compliance Afdeling (hereinafter, De Compliance Afdeling / we / us) provides an effective compliance programme. In that capacity, we process personal data. We process most personal data on behalf of our customers, for example when a customer uses our risk assessment. This privacy statement describes how we process the personal data of our business contacts.
Who is responsible for processing personal data?
In most cases, we process personal data on behalf of our customers because this is necessary to perform the agreement. As defined in the General Data Protection Regulation (GDPR), De Compliance Afdeling is the processor and the customer is the controller in these cases.
In other cases, where personal data is processed through our website www.decomplianceafdeling.nl, De Compliance Afdeling is the controller as defined in the GDPR.
When does De Compliance Afdeling collect and process your personal data?
De Compliance Afdeling collects and processes personal data in situations including the following:
- When you purchase products and/or services directly from us.
- When your employer uses our compliance programme and has provided us with your personal data for the purchase of products or services.
- When you complete a contact or demo form on our marketing website. We then process the information you provide (such as your name, company name, email address and telephone number) and store it in our CRM system (Pipedrive) to handle your request.
- When you contact us directly, for example through our website, by email or by telephone, because you are interested in our services or have questions.
- When your personal data is forwarded to us by a third party.
- When, as part of our compliance programme, we receive personal data relating to login details, error messages, data traffic or contact details from you or a third party.
Which personal data does De Compliance Afdeling process?
De Compliance Afdeling may process the following personal data about you:
- Contact details: first name and/or surname, address, telephone number, email address.
- Other personal data: information you provide yourself, such as date of birth, gender, employer or employment circumstances.
- Website use and communications: information about how you use the website and whether you open or forward our messages, including data collected through cookies and similar technologies. More information is available in our cookie policy.
- Form data: information you enter on contact and demo forms on our marketing website, including your name, company name, email address, telephone number and message or package selection.
- Interaction data: login details, error messages, data traffic, information about purchases of products and services, interactions with our sales department and third parties, and participation in market research.
- IT security: information about abnormal use of your compliance programme may be monitored. Where applicable, De Compliance Afdeling may receive and use personal data in accordance with the detailed descriptions of the respective services, taking account of the associated security measures.
For which purposes do we process your personal data?
De Compliance Afdeling processes your personal data only where we have a lawful basis to do so. Examples of lawful bases and purposes include:
| Lawful basis | Processing purposes (including) |
|---|---|
| Entering into or performing the agreement | To deliver services correctly in accordance with the agreement. |
| Consent | Marketing – to promote De Compliance Afdeling's services and share news or offers with you. |
| Legitimate interest | To prevent fraud and criminal activity – to protect our organisation, customers and society against crime and its consequences. |
| Legal obligation | To respond to binding requests from authorities or regulators. |
How do we protect your personal data?
We take various security measures to protect your personal data, such as encryption and authentication tools. We do this to protect and maintain the security, integrity and availability of your personal data.
How long do we retain your personal data?
In accordance with Article 17 of the GDPR, we retain your personal data no longer than necessary for the purposes for which it was collected or otherwise processed. We delete personal data automatically or at our customers' request. De Compliance Afdeling has developed internal deletion procedures to ensure that all your personal data is deleted in accordance with the principle of data minimisation and Article 17 of the GDPR.
We apply the following principles to deleting personal data:
- Use for performance of an agreement: to meet contractual obligations, we may retain collected personal data for as long as the contract remains in force. Depending on the nature and scope of the contract, personal data is deleted seven years after the contract ends.
- Use for marketing purposes: personal data collected for marketing purposes is retained unless you tell us that you want it deleted.
Who do we give international access to your personal data?
De Compliance Afdeling prefers to process personal data within the European Economic Area (EEA).
If personal data is processed in countries outside the EEA or countries without an adequacy decision, De Compliance Afdeling uses European Union standard contractual clauses, including appropriate technical and organisational measures, to ensure that your personal data is processed with the same level of protection as under European data protection rules.
Which third parties do we work with?
In some cases, De Compliance Afdeling uses third parties to provide services. De Compliance Afdeling takes privacy very seriously and selects these suppliers carefully. For example, we assess whether a supplier takes sufficient technical and organisational measures to protect personal data.
We also establish whether a supplier is a processor or controller under the GDPR. Where De Compliance Afdeling exchanges personal data with a processor, a data processing agreement is in place.
Some of the third parties De Compliance Afdeling works with are:
Website (decomplianceafdeling.nl)
- Scaleway (website hosting)
- Pipedrive (CRM; processing contact and demo requests)
- Google (reCAPTCHA to protect forms; where applicable, Google Tag Manager for tag management)
- Plausible Analytics (aggregated, cookieless website statistics)
- Microsoft Clarity (interaction analysis and session recordings, only with consent)
How can you access your personal data and change your privacy preferences?
You can contact us to find out which personal data we process about you. We will be happy to help and explain how and why we process personal data.
You cannot ask us for information about third parties' use of your personal data. To access this information or ask questions about its use, contact the relevant third party directly.
What are your privacy rights?
Under the GDPR, you have a number of rights as an individual. The following section explains your rights as defined in the GDPR. Depending on the type and scope of your request, we may ask you to submit it in writing.
Right of access (Article 15 GDPR)
You can always ask us which personal data we process about you. This information includes the categories of data we process, the purposes of processing, the source of the personal data (if we did not receive it directly from you) and, where applicable, the recipients to whom we have forwarded your personal data.
Contact us if you would like access to your personal data processed by De Compliance Afdeling.
Right to rectification (Article 16 GDPR)
You can ask us to correct your personal data. We want the personal data we process to be accurate.
Contact us if you would like to change your personal data.
Information about your choices (consent)
We allow you to indicate whether we may use / process your personal data for commercial approaches (offers). You can request an overview of your previous choices that we have recorded. We will then give you the opportunity to change those choices.
Contact us if you would like to receive this overview.
Right to erasure of your personal data (Article 17 GDPR)
You can submit a request to delete your personal data. We can comply with this request only if certain statutory requirements are met. In accordance with Article 17 of the GDPR, this may be the case if:
- your personal data is no longer necessary for the purpose for which it was obtained or processed;
- you withdraw the consent on which processing was based and there is no other lawful basis for processing;
- you object to processing your personal data and there is no other legitimate reason for processing it, or you object to processing your personal data for direct marketing;
- the personal data has been processed unlawfully;
- processing is not necessary to comply with a legal obligation requiring us to process your personal data;
- processing is not necessary to establish / exercise legal claims or to defend against legal claims;
- processing is not necessary in connection with statutory retention periods.
Right to block your data / restrict processing (Article 18 GDPR)
You can ask us to restrict / block processing of your personal data if:
- you contest the accuracy of your personal data – this applies only for the period we need to verify its accuracy;
- processing is unlawful, but you do not want the personal data erased and request restriction of its use instead;
- we no longer need your personal data, but you need it to establish, exercise or defend legal claims;
- you have objected to processing, but a decision has not yet been made on whether our legitimate grounds override your reasons.
Right to data portability (Article 20 GDPR)
At your request, where technically possible, we will forward certain personal data to another controller, or you can receive it from us on a portable data medium. This right applies only where processing is based on your consent or is required to perform a contract.
Right to object (Article 21 GDPR)
You may object at any time to processing of your personal data on grounds relating to your particular situation, provided that processing is based on your consent or our legitimate interest or that of a third party. In that case, we will no longer process your personal data. This does not apply if we can demonstrate compelling, defensible grounds for processing that override your interests, or if we need your personal data to establish, exercise or defend legal claims.
Timeframes for meeting your individual rights
In general, we will make every effort to comply with your request within 30 days. However, this period may be extended for reasons relating to the specific rights of the data subject / depending on the grounds underlying a particular individual right, or because of the complexity of your request.
Limitations on providing information concerning your rights
If you send us a request to exercise your rights, we will let you know as soon as possible whether, and to what extent, we can comply. In some cases, we may refuse the request, for example if you ask us to erase personal data we still need for tax or other legal requirements. If this happens, we will always explain why we cannot comply with your request in full or in part.
Complaint to the Dutch Data Protection Authority
If you wish to complain about the use of your personal data, you can contact us. We take your comments, objections and rights concerning the processing of personal data seriously. However, if you believe your comment or objection has not been handled properly, you have the right to complain to the Dutch Data Protection Authority.
Contact us:
For questions about our use of your personal data, how we handle it or this privacy statement, you can contact the responsible Data Protection Officer (DPO) at:
Email address: privacy@decomplianceafdeling.com
Telephone number: +31 (0)6 30488534 (weekdays between 09:00 and 17:00)
Postal address:
De Compliance Afdeling
FAO the DPO
Burgemeester Oudlaan 50
3062 PA
Rotterdam
Changes to the privacy statement
De Compliance Afdeling reserves the right to amend this privacy statement (last updated 23 August 2026). If substantial changes are made that affect the processing of your personal data, we will notify you through a notice on our website.