Privacy Policy
GoodInit B.V. · goodinit.nl
1. Who we are
This privacy policy applies to the processing of personal data via the website goodinit.nl and all related correspondence and services.
| Name | GoodInit B.V. |
| Registered address | Rinus Michelslaan 333, 1061MB, Amsterdam, the Netherlands |
| Chamber of Commerce (KVK) number | 42058108 |
| Statutory director | Mr Dennis R. Schut |
| Privacy contact | privacy@goodinit.nl |
GoodInit B.V. is responsible for the processing of your personal data as described in this policy.
2. What data we process
We only process data that you provide to us yourself, or that is necessary for the website to function. Specifically:
When using the contact form on /contact:
- Your name
- Your email address
- Your organisation
- The content of your message
When requesting an appointment:
An appointment is arranged through the contact form, after which we finalise the scheduling manually by email or phone. Depending on your message, we may process the following data:
- Your name, email address and organisation
- Your role and the number of employees at your organisation (for an introductory conversation)
- A brief description of your question or challenge
- The date and time you propose or that we agree on
Email or LinkedIn correspondence:
The data that you provide yourself in your message.
When visiting the website (technically necessary):
- IP address
- Browser type and version
- Date and time of visit
- Pages visited
- Referring page (referrer)
This technical data is logged by our hosting provider (TransIP) for the purpose of website security and stability.
3. What we use your data for
We use your data exclusively for the purposes for which you provided it to us:
| → | Answering your question or contact request |
| → | Scheduling, preparing and carrying out appointments |
| → | Performing agreements with clients |
| → | Complying with legal obligations (including tax record-keeping requirements) |
| → | Securing the website and detecting misuse |
- Direct marketing or newsletters
- Profiling or automated decision-making
- Selling or renting out to third parties
- Tracking purposes or advertising
4. Legal basis
Under the General Data Protection Regulation (GDPR), we base our processing on the following legal grounds:
| Legal basis (GDPR Art. 6) | When it applies |
|---|---|
| Consent | When you voluntarily provide data via the contact form or when requesting an appointment. You may withdraw your consent at any time – please contact us at privacy@goodinit.nl. |
| Performance of a contract | When you are or become a client of ours, for the performance of the agreed services. |
| Legal obligation | For tax record-keeping and any other applicable statutory retention obligations. |
| Legitimate interest | For securing the website (server logs held by the hosting provider). Your interests have been weighed in this assessment; the processing is limited and not intrusive. |
5. Who we share your data with
We do not share your data with third parties, other than the processors listed below, who provide technical services on our instructions and under our responsibility. A data processing agreement has been concluded with each of these parties, or their standard data processing agreement applies.
| Processor | Purpose | Location |
|---|---|---|
| Microsoft Corporation / Microsoft Ireland Operations | M365 environment: email (Outlook), calendar management, file storage (OneDrive), video calls (Teams) | Processing primarily within the EU (EU Data Boundary). Microsoft has sub-processors outside the EU; transfers are governed by the EU Standard Contractual Clauses and additional safeguards. |
| TransIP B.V. | Web hosting, DNS, email handling | The Netherlands |
GoodInit B.V. may also be legally required to share data with government authorities (for example, the Dutch Tax Administration). In that case, we only provide the data we are legally obliged to provide.
6. How long we retain your data
We do not retain your data for longer than necessary:
| Type of data | Retention period |
|---|---|
| Contact form enquiry with no follow-up | 6 months, then deleted |
| Email correspondence with no follow-up | A maximum of 24 months |
| Client data and invoicing | 7 years (statutory tax record-keeping obligation under Article 52 of the Dutch General Tax Act – Algemene wet inzake rijksbelastingen) |
| Server logs (TransIP) | 30 days |
Once the retention period has expired, the data is deleted or anonymised.
7. Transfers outside the EU
Our hosting provider TransIP processes your data within the Netherlands. Microsoft processes data primarily within the EU (EU Data Boundary), but has sub-processors outside the EU. To the extent that data is transferred outside the EU, the EU Standard Contractual Clauses apply, together with, where relevant, additional technical and organisational measures as described in Microsoft’s documentation.
8. Your rights
Under the GDPR, you have the following rights regarding your personal data:
| Right | What this means |
|---|---|
| Access | You may request to know which personal data we process about you. |
| Rectification | You may have incorrect or incomplete data corrected. |
| Erasure | You may request deletion of your data, insofar as we have no legal obligation to retain it. |
| Restriction | You may have the processing restricted in certain situations. |
| Objection | You may object to processing based on a legitimate interest. |
| Data portability | You may receive your data in a commonly used format, or have it transferred. |
| Withdrawal of consent | You may withdraw previously given consent at any time. |
To exercise any of these rights, please contact us at privacy@goodinit.nl. We respond to your request within four weeks. If there is any doubt about your identity, we may ask for additional verification.
Right to complain. If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
9. How we secure your data
We take appropriate technical and organisational measures to protect your data against loss, unauthorised access and misuse:
- TLS encryption (HTTPS) for all communication with the website and the contact form
- Multi-factor authentication on all administrative accounts and the M365 tenant
- Access to your data is limited to those who need it to carry out their duties – in practice, only the director of GoodInit B.V.
- Regular updates and patches for WordPress, plugins and server software
- Tested back-ups of the website and the M365 environment
- A straightforward incident-response protocol in case something goes wrong
Should a data breach occur despite these measures, we act in accordance with the data breach notification obligation: reporting to the Dutch Data Protection Authority within 72 hours and, if there is a high risk to those concerned, also notifying you directly.
10. Changes to this policy
We may update this privacy policy from time to time, for example following changes to our services, the tools we use, or applicable legislation. The current version is always available at goodinit.nl/privacy. We will announce any material changes on the homepage.
11. Contact
Do you have questions about this privacy policy or about how we handle your personal data?
| privacy@goodinit.nl | |
| Post | GoodInit B.V., Rinus Michelslaan 333, 1061MB, Amsterdam, the Netherlands |
We respond to your question within four weeks.