Customer Privacy Statement Suijkerbuijk+Co

Customer Privacy Statement
This privacy statement applies to the processing of customers’ personal data by Suijkerbuijk + Co B.V.Suijkerbuijk + Co B.V. considers the protection of your privacy important. We therefore take our responsibility to protect your personal data seriously. For this reason, Suijkerbuijk + Co B.V. has, among other things, drawn up this privacy statement for customers.The purpose of this privacy statement is to be transparent about how Suijkerbuijk + Co B.V. collects, uses and protects your personal data. We also explain how we comply with privacy legislation, including the General Data Protection Regulation (Algemene Verordening Gegevensbescherming, GDPR/AVG). Please read this statement carefully to understand how we handle your personal data.We use personal data only for the purpose for which we obtained it. We provide you with this information by publishing this privacy statement on our website.What is personal data?
The General Data Protection Regulation (Algemene Verordening Gegevensbescherming, GDPR/AVG) defines personal data as any information relating to an identified or identifiable natural person. This means information that either relates directly to a person or can be traced back to that person.
‍
We use personal data only for the purpose for which we obtained it. We provide you with this information by publishing this privacy statement on our website.
‍
What is personal data?
The General Data Protection Regulation (Algemene Verordening Gegevensbescherming, GDPR/AVG) defines personal data as any information relating to an identified or identifiable natural person. This means information that either relates directly to a person or can be traced back to that person.
‍
About us

Suijkerbuijk + Co B.V., having its registered office at Schippersgracht 3 in Amsterdam, is the controller within the meaning of the GDPR/AVG in respect of the data we receive from you because you are our customer.For what purposes do we process personal data? We process your personal data only for carefully defined purposes. Further information about the various purposes is set out below.

1. Performance of our agreement
What does this purpose involve? We process personal data in order to provide our services, for example to maintain your accounts or prepare and file your tax returns. We can provide our services only if we process personal data in doing so. These services include: (day-to-day) communications, processing business accounts and records, preparing annual accounts, filing Dutch personal income tax returns (Inkomstenbelasting), Dutch VAT returns (Omzetbelasting), EC Sales Lists / returns for intra-Community supplies (Intracommunautaire prestaties) and Dutch payroll tax returns (Loonheffingen). The legal basis is the performance of the agreement we have with you (Article 6(1)(b) GDPR/AVG).What personal data do we process for this purpose? This varies depending on the service provided by Suijkerbuijk + Co B.V., but in providing our services we process, among other things:
• NAW-gegevens
• Geslacht / aanhef
• Email adres
• BSN
• BTW-ID
• BTW-nummer
• Geboortedatum
• Startdatum bedrijf
• IBAN van bedrijf
• LH-nummer
• RSIN
• KVK
• Bedrijfsactiviteit
• Taal
• Fiscaal partner (Geboortedatum, BSN)
• Kinderen
• Oude JR
• Oude BTW aangiften
• Jaaroverzicht banken
• Gegevens andere bedrijven die je bezit, maar geen klant zijn
• Jaaropgaven
• Lening overzichten en gerelateerde documenten
• Vermogensdocumenten
• Bonus
• Alimentatie
• Lijfrente
• AOV
• Ziektekosten
• Giften
• Studiekosten
• Dividend
• Overige inkomsten
• Banktransacties
 
2. Maintaining the customer relationship
What does this purpose involve? To maintain our relationship with you as effectively as possible, we also store personal information in the form of notes. This allows us, when preparing your tax returns or when you telephone us, to know the current status and whether there are any relevant particular circumstances. The legal basis is our legitimate interest in maintaining a good customer relationship (Article 6(1)(f) GDPR/AVG).What personal data do we process for this purpose?
• Personal circumstances that you share with us
• Personal characteristics and preferences that you share with us

3. Wettelijke verplichtingen
What does this purpose involve? As an administration and accounting firm (administratiekantoor), we are required to comply with the Dutch Anti-Money Laundering and Anti-Terrorist Financing Act (Wet ter voorkoming van witwassen en financieren van terrorisme, Wwft). For this purpose, we must be able to identify our customers. The legal basis is compliance with a legal obligation (Article 6(1)(c) GDPR/AVG).What personal data do we process for this purpose?
• Proof of identity (passport, identity card, Dutch driving licence)
• Name
• Date of birth

4. Analytics and the development of our website, products and services
‍We also process data that you provide to us indirectly. Our website uses cookies for functional, analytics and marketing purposes. Functional cookies are necessary for the use of the website. This concerns the following data:
• Location data
• IP address or app IDs
• Internet browser and device type
• Website language
 
Data from analytics and marketing cookies is not linked to other data. Please refer to our cookie statement for more information about cookies. For more information about cookies, please refer to our cookie statement. The legal basis is consent, which you give by accepting our cookie terms in the cookie banner on the website (Article 6(1)(a) GDPR/AVG), or, in the case of functional cookies, our legitimate interest in a properly functioning website (Article 6(1)(f) GDPR/AVG).

5. For marketing purposes
What does this purpose involve? We use your email address for marketing purposes. If you do not want us to use your email address for this purpose, you can email info@suijkerbuijk-co.nl or unsubscribe from the newsletter using the unsubscribe button at the bottom of the newsletter.
What personal data do we process for this purpose?
• Email address

The legal basis is our legitimate interest in conducting an effective marketing campaign (Article 6(1)(f) GDPR/AVG).
‍
Your rights
You have the right to be properly informed about what we do with your data and why we need it. We provide this information through this privacy statement. In addition to the right to receive transparent information, you have the following rights:
• Right of access (if you want to know what data we collect about you);
•
• Right to rectification (we will correct any data that is no longer accurate);
• Right to erasure / right to be forgotten (in certain cases you may ask us to delete your data);
• Right to restriction of processing (in certain cases you may ask us to restrict the processing of your data);
• Right to data portability (if you wish, we can transmit your data to another party or provide you with a copy of your data);
• Right to object (in certain cases you may object to our use of your data).
‍
If you wish to exercise any of your rights, you can contact us by emailing info@suijkerbuijk-co.nl. We will always respond to your request within one month.

With whom do we share data and where do we store it?
In certain cases, we disclose your data to third parties, for example processors that assist us in processing your personal data. However, we will never sell your data to other parties.

Processors that assist us in processing your personal data may use your data only on our instructions and for the purpose of providing the relevant services to us.

They may not use or disclose your data independently.We use various applications to process certain data. To safeguard your privacy, we select our suppliers carefully and these applications are subject to strict requirements.

Where data is processed outside the EU, we work only with parties that provide an adequate level of protection in accordance with European rules. If we process your data outside the EU, including through our external service providers, we ensure that your personal data is adequately protected. For example, suppliers may be established in countries in respect of which the European Commission has adopted an adequacy decision.

How long do we retain your data?
We retain your data for as long as necessary for the purpose for which we use it and/or for as long as we are legally required to retain it. The precise retention period varies, from several months to many years, for example where this is necessary for our accounting records.

In any event, we retain your data for as long as your account remains active, unless you ask us to delete data or your account by emailing info@suijkerbuijk-co.nl. You can always view and/or amend part of your personal data in your own account.

How do we protect your data?
Under Article 32 GDPR/AVG, we are required to take appropriate technical and organisational measures to prevent the loss of personal data or unlawful processing. We protect your personal data through physical, administrative, organisational and technical measures. One example of a technical measure taken to protect your personal data is that all systems in which Suijkerbuijk + Co B.V. processes your personal data are protected by two-factor authentication.

All employees of Suijkerbuijk + Co B.V. have also signed a confidentiality undertaking. We therefore maintain an appropriate level of protection. We review and adjust this level of protection periodically where necessary.

Our organisation is structured so that we make every effort to prevent personal data breaches (datalekken). If a personal data breach occurs, we will act in accordance with Articles 33 and 34 GDPR/AVG. This means that we will notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and affected data subjects where a personal data breach is likely to result in a (high) risk.

Contact and complaints
If you have any questions about this privacy statement or wish to exercise your rights as a data subject, you can contact us at info@suijkerbuijk-co.nl.

If you have a complaint, for example about how we use your data or how we respond to privacy-related questions, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Amsterdam, October 2025