1. Who is responsible for your data
DutchKey is the data controller for the personal data described in this statement.
| Trading name | DutchKey |
| Legal entity | legal entity name |
| Registered address | street, postcode, city |
| Chamber of Commerce (KVK) | KVK number |
| VAT number | BTW-id |
| hello@dutchkey.nl |
Replace every highlighted field above with your real registered details. A Dutch business website is legally required to state its identity and Chamber of Commerce number, and a privacy statement without a named controller does not meet GDPR requirements.
2. What personal data we collect
When you request quotes from buying agents
- Name
- Email address
- Phone number, if you choose to provide it
- Target area in the Netherlands
- Purchase timeline and indicative budget range
- Mortgage status, as a general category rather than financial figures
- Number of quotes you wish to receive
- Any free-text information you add yourself
When you request contact from a mortgage advisor
- Name, email address, and phone number
- City or region
- Preferred language and preferred contact method
We deliberately do not collect financial details on that form. No income, no mortgage amount, no budget. Those belong in a confidential conversation with a licensed advisor.
Automatically collected data
Our hosting provider processes standard technical data such as IP address, browser type, and pages requested, in order to deliver the website and protect it from abuse.
We do not knowingly collect special categories of personal data, and we do not direct our services at children.
3. Why we process it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Passing your details to buying agents or mortgage advisors so they can contact you | Your consent (Article 6(1)(a) GDPR) |
| Contacting you about your request and answering your questions | Consent, and our legitimate interest in responding |
| Keeping records of consent given and requests handled | Legal obligation and legitimate interest |
| Securing the website and preventing abuse or spam | Legitimate interest (Article 6(1)(f) GDPR) |
| Administration, invoicing, and statutory record keeping | Legal obligation (Article 6(1)(c) GDPR) |
We do not sell personal data, and we do not use your data for automated decision-making or profiling.
5. How long we keep your data
| Data | Retention period |
|---|---|
| Request details and correspondence | Up to 24 months after your last contact with us, unless you ask us to delete them sooner |
| Record of the consent you gave | Up to 5 years, so we can demonstrate compliance if challenged |
| Invoices and accounting records | 7 years, as required by Dutch tax law |
| Technical server logs | Short-term, as set by our hosting provider |
6. How we protect your data
- The website is served over an encrypted HTTPS connection
- Access to submitted requests is limited to people who need it to handle your request
- Accounts used to access your data are protected with strong authentication
- Providers are selected on the basis of their security measures and bound by processing agreements
No system is perfectly secure. If a data breach occurs that poses a risk to your rights, we will notify the Dutch Data Protection Authority and, where required, you directly.
8. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you
- Rectify data that is inaccurate or incomplete
- Erase your data, where no legal obligation requires us to keep it
- Restrict processing while a dispute or correction is pending
- Object to processing based on our legitimate interests
- Data portability, receiving your data in a structured, machine-readable format
- Withdraw consent at any time
Email hello@dutchkey.nl to exercise any of these rights. We respond within one month, and will tell you if we need longer. We may ask you to confirm your identity so that we do not disclose data to the wrong person.
9. Withdrawing consent
You can withdraw your consent at any time, and doing so is free.
Bear in mind one practical limit: once your details have already been sent to an agent or advisor, we cannot retract them on your behalf. We will stop processing your data and confirm this to you, and you can contact those parties directly to ask them to delete what they hold. Withdrawal does not affect processing that took place lawfully before you withdrew.
10. Complaints
If you are unhappy with how we handle your data, contact us first at hello@dutchkey.nl so we can try to put it right.
You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or with the supervisory authority in your country of residence.
11. Changes to this statement
We may update this statement when our services, providers, or legal obligations change. The date at the top shows when it was last revised. Significant changes affecting how we use data you already gave us will be communicated to you directly where feasible.
12. Contact
Questions about this statement or about your data:
- Email: hello@dutchkey.nl
- Postal address: street, postcode, city
We have not appointed a data protection officer, as we are not required to do so. Privacy questions are handled by name or role.