Privacy

• Identity and contact details, including name, job title, organization, business address, telephone number and email address.
• Client and project information, including enquiries, proposals, contracts, correspondence, meeting notes, project files, reports, evaluations and deliverables.
• Financial and administrative information, including invoice details, bank or payment information, payment status, VAT details and transaction records.
• Supplier and professional contact details.
• Website and technical information, if applicable, including IP address, browser or device information, log data, cookie preferences and information submitted through a contact form.
• Marketing preferences and records of consent or objections, where relevant.
• Information that you choose to provide in connection with an assignment.

I do not normally need identifiable hotel or restaurant guest data, employee files, reservation details, CCTV images, allergy information or other sensitive information for consultancy work. Please do not provide such information unless it is necessary and we have agreed appropriate safeguards. Where possible, use anonymized or aggregated information.

I usually obtain personal data directly from you through email, telephone calls, meetings, contracts, invoices, my website or the performance of an assignment. I may also receive business contact details from your employer or organization, a referral, a public professional source, or a client that involves you in a project. When required, I will provide the relevant privacy information within the applicable statutory period.

• Responding to enquiries, preparing proposals and taking pre-contractual steps: necessary to take steps at your request before entering into a contract and, where relevant, my legitimate interest in developing professional relationships.
• Performing consultancy assignments: necessary for the performance of a contract or for my legitimate interest in managing a client engagement where the contract is with your organization.
• Project and relationship management: my legitimate interest in communicating, documenting decisions, delivering work and maintaining professional relationships.
• Invoicing, payments, bookkeeping and tax administration: necessary to perform the contract and comply with legal obligations.
• Establishing, exercising or defending legal claims and preventing misuse: my legitimate interest in protecting my business and enforcing agreements.
• Business-to-business marketing: my legitimate interest in informing relevant professional contacts about related services, unless consent is required or you object.
• Optional marketing or non-essential cookies: consent, where applicable. You may withdraw consent at any time without affecting earlier lawful processing.
• Complying with lawful requests: necessary to meet a legal obligation.

Where I rely on legitimate interests, I balance those interests against your privacy rights and reasonable expectations.

I share personal data only where needed for the purposes described above. Recipients may include:

• My accountant, bookkeeper, bank and payment service providers.
• Email, cloud-storage, calendar, video-meeting, CRM, invoicing, document-signing, website and hosting providers.
• Professional advisers, insurers, debt-collection providers or legal representatives where necessary.
• Subcontractors or collaborating consultants where agreed for an assignment and subject to appropriate confidentiality and data-protection obligations.
• The client organization and its authorized contacts in connection with the assignment.
• The Belastingdienst, courts, regulators, police or other competent authorities where disclosure is legally required.
• A purchaser or adviser involved in a possible transfer or restructuring of the business, subject to appropriate confidentiality safeguards.

Where a service provider processes personal data on my behalf, I use appropriate contractual and security arrangements.

Some digital service providers may process personal data outside the European Economic Area. Where this occurs, I use an approved transfer mechanism, such as an adequacy decision or the European Commission’s standard contractual clauses, together with supplementary safeguards where required. You may contact me for information about the safeguards relevant to your data.

• Tax and accounting records: normally seven years after the end of the relevant financial year, or longer where a different statutory period applies.
• Contracts, project files and important correspondence: up to seven years after the assignment ends, taking account of legal limitation periods, insurance requirements and the need to establish or defend claims.
• Unsuccessful proposals and general enquiries: normally up to two years after the last substantive contact, unless a longer period is justified or you ask me to delete the information sooner.
• Business contact and relationship-management data: while the relationship remains active and thereafter for as long as reasonably relevant, subject to periodic review and any objection.
• Marketing consent and objection records: for as long as needed to demonstrate and respect your preference.

I delete or anonymize personal data when it is no longer needed, unless I must retain it by law or for a valid legal claim.

I take appropriate technical and organizational measures to protect personal data, including access restrictions, strong unique passwords, multi-factor authentication where available, secure and updated devices, reputable cloud services, backups, confidentiality arrangements and procedures for handling incidents. No method of storage or transmission is completely secure, but I review safeguards considering the risks.

During some assignments, I may process personal data solely on a client’s documented instructions. In that situation, the client is normally the controller, and I act as its processor. The client is responsible for providing the applicable privacy information and handling requests from data subjects. The process will be governed by a data processing agreement where required.

Depending on the circumstances, you may have the right to request access to your personal data, correction, deletion, restriction, data portability, or to object to processing based on legitimate interests or direct marketing. Where processing is based on consent, you may withdraw that consent at any time. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, where the GDPR applies.

To exercise a right, email brigite@d-oliveira.nl. Please describe your request clearly. I may ask for information needed to verify your identity, but do not send a copy of your identity document unless specifically requested through a secure method. I normally respond within one month. This period may be extended by up to two further months for complex or multiple requests, in which case I will inform you within the first month. A legal exception may limit a right; if so, I will explain the reason where permitted.

If you have a concern, please contact me first at brigite@d-oliveira.nl so I can try to resolve it. You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

The website may use strictly necessary cookies for security and basic functionality. Analytics, preference or marketing cookies are used only where permitted and, when required, after consent. The cookie banner or cookie notice explains the cookies, providers, purposes and storage periods in use.

My services are directed to businesses and professional adults. I do not knowingly collect personal data from children. If you believe a child has provided personal data to me, please contact me so I can assess and, where appropriate, delete it.

I may update this privacy statement when my services, systems or legal obligations change. The current version will be made available on my website or provided on request. The date at the top shows when it was last updated.

D’Oliveira
Email: brigite@d-oliveira.nl
Website: www.d-oliveira.nl