Security measures

The technical and organisational measures (article 32 GDPR). Part of our Trust Center. This is a translation of the Dutch original, which is binding.

Starting point

We're a small office and we only write down here what we actually do. No certification logos that aren't there; concrete measures instead, public, so you can hold us to them.

Access

Two-factor authentication on all business accounts; unique passwords from a password manager, never shared or reused. In client systems we work with our own account wherever possible, with only the permissions the work requires — no shared passwords. Access is limited to whoever does the work: when a collaboration ends (with a client or with someone on our team), access is revoked immediately.

Technology

All connections are encrypted (HTTPS/TLS); work devices have disk encryption. The website collects as little as possible: the contact form only asks what's needed for the conversation, and our own visitor counter works without cookies and without IP addresses. Your administration stays in your own systems (your accounting software, your mailbox, your calendar) — we don't store it again somewhere else.

Organisation

Everyone who works with client data is bound to confidentiality. We use a short, fixed list of suppliers (see the subprocessor list) and add nothing to it without data processing agreements. Retention periods: as in the privacy statement (in Dutch) — sign-up data at most one year after the last contact, client data for as long as the collaboration runs plus the statutory retention period.

If something goes wrong (data breaches)

1. We stop the breach and record what happened.
2. We notify the affected client(s): without unreasonable delay, at the latest within 48 hours of discovery.
3. If a report to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) is required, we provide the client with all information for it (the statutory deadline is 72 hours).
4. Afterwards: remove the cause and add the measure that would have prevented it to this overview.

Seen something suspicious? Report it to [email protected] — even if you're not sure.