DRAFT — lawyer review required Status: Publishable draft, not yet live Last updated: 14 september 2026
Internal notes are marked ▸. Content follows the information duty described by the Autoriteit Persoonsgegevens: who we are, what data, why, who we share with, retention, rights, whether data is required and what happens if not provided, automated decisions. Source: https://www.autoriteitpersoonsgegevens.nl/nl/zelf-doen/gebruik-uw-privacyrechten/recht-op-informatie
[Company name] We are the controller for the personal data described here.
When you send an invoice request:
| Data | Why |
|---|---|
| Name (or company name) | To address the invoice |
| Email address | To send you the invoice |
| Address and country | Legally required on the invoice; country decides the VAT |
| Private or business | Decides the VAT treatment |
| VAT number (optional, businesses) | Only needed for reverse-charge VAT within the EU |
| Amount | The price on the invoice |
| A note to Rolf (optional) | Read only by Rolf; it is not printed on the invoice. Kept with your invoice request |
| Payment details (handled by Stripe) | To take your payment. Card or bank details go to Stripe directly; we only receive the payment status, reference, date and amount |
| Technical data (IP address, time of submission) | Security and fraud prevention ▸ ⚠ confirm hosting logs |
We don't use tracking cookies or advertising tools. ▸ ⚠ keep true: no analytics without a consent banner.
Name, email, address and country are needed to issue a legally valid invoice. Without them we can't send one. The VAT number is optional; without a valid one, Dutch VAT is charged (EU businesses).
Only with service providers that help us run this page, under a processing agreement: hosting [provider], email delivery [provider], invoicing/bookkeeping software [provider]; and our accountant. Payments are handled by Stripe, which processes payment data on our behalf and is also an independent controller for its own purposes, such as fraud prevention and legal compliance (see Stripe's privacy policy). If you give an EU VAT number we check it in the European Commission's VIES system. We never sell your data.
▸ Source Stripe role: https://stripe.com/legal/privacy-center#is-stripe-acting-as-a-data-controller-or-a-data-processor ▸ ⚠ If any provider stores data outside the EEA (e.g. US email services, Stripe's US group), add transfer basis (adequacy decision / SCCs).
Invoices and the data on them: 7 years, because Dutch tax law requires it. Source: https://www.belastingdienst.nl/wps/wcm/connect/bldcontentnl/belastingdienst/zakelijk/btw/administratie_bijhouden/facturen_maken/uw_facturen_bewaren Form submissions that were not paid (checkout cancelled or abandoned): deleted within [30] days. ▸ ⚠ decide.
The VAT on your invoice is calculated automatically from your answers. This has no legal effect beyond the correct tax on your invoice; you can always contact us about it. No profiling.
You can ask to see, correct or delete your data, restrict or object to its use, or receive it in a portable format. Invoices we must keep for tax purposes can't be deleted before the legal period ends. Email [email]; we reply within one month.
You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): https://www.autoriteitpersoonsgegevens.nl
We'll post any changes here with a new date.