Privacy Policy
Hollands Duurzaam | Version: October 2026
Hollands Duurzaam respects your privacy and handles your personal data with care. In this privacy policy we explain which data we process, why, with whom we share it and how long we keep it. This policy follows the General Data Protection Regulation (GDPR, in Dutch: AVG). The Dutch version is the original; if the two differ, the Dutch version prevails.
1. Data controller
The controller of your personal data is:
2. Which data do we process?
We only process the data we need to handle your request and carry out the assignment:
- Contact details: name, email address, phone number and, for business clients, the company name
- Address details: street, house number, postcode and town of the property and, if different, your billing address
- Content of your request: reason for the request, preferred date and any particulars
- Property data from the survey: year of construction, dimensions, insulation, glazing and installations, with photos of the property and the installations
- Documents you provide: for example drawings, invoices, quotes, quality declarations or an existing energy label
- Correspondence: emails, WhatsApp messages and notes of phone calls about your assignment
- Payment details: invoice number, amount and the account you pay from
- Origin of your request: when you send a form, we include the channel through which you reached the site (for example Google or an advertisement) and whether you use a phone, tablet or computer
- Website use, with cookie consent: pages visited, visit duration, browser type and a shortened IP address, through the services in section 7
- Website use, without cookie consent: if you have not given consent, the website does not place or read cookies. Your browser does send a cookieless signal to Google (including which page was viewed, the time, the browser type and your cookie choice), without a persistent identifier that would recognise you on a later visit. Google only uses these signals to estimate visitor numbers and requests.
We never ask for your citizen service number (BSN) or other special categories of personal data. If a photo happens to show personal items, we leave it out of the file.
3. Why do we process your data?
- To prepare a quote and schedule the survey
- To carry out the survey, calculate the energy label and register it in EP-Online
- To keep the survey file, so the label can be checked during an inspection or audit
- To send invoices and handle payments
- To answer your questions and keep in touch about your assignment
- To ask afterwards whether you would like to write a review
- To meet legal obligations, such as the duty to keep the survey file and the tax retention obligation
- To improve the website and measure which advertisements lead to requests (only with consent through the cookie banner, or with the cookieless signals from section 2)
4. Legal basis
We process your personal data on the following legal grounds (Article 6 GDPR):
- Performance of a contract: for the quote, the survey, the energy label, the improvement advice and the invoice
- Legal obligation: for registration in EP-Online, keeping the survey file and the tax records
- Legitimate interest: for the review request afterwards, measuring where requests come from, blocking spam and securing our systems. You can always object to this.
- Consent: for analytics and advertising cookies. You can withdraw this consent at any time (see section 7).
5. How long do we keep your data?
We do not keep your personal data longer than necessary. After that, we delete it.
- Requests and questions that do not lead to an assignment: no later than 1 year after the last contact
- Energy label survey file (survey data, photos, documents provided and the correspondence about the assignment): 11 years after registration of the label. The file must be kept for as long as the label is valid (10 years); we add 1 year as a margin
- Invoices and accounting records: 7 years (statutory tax retention obligation)
- Registered energy label: is listed in the public EP-Online database of RVO; RVO determines that retention period
- Statistics in Google Analytics: 14 months
- Cookies: the lifetime of each cookie is listed in section 7
6. With whom do we share your data?
We only share your data when this is necessary for our service or required by law. We never sell your data.
Parties that also process the data under their own responsibility:
- RVO (EP-Online): registration of the energy label (required by law)
- Our certification body and the organisation we are affiliated with as energy advisor: they may inspect the survey file during a spot check or audit
- Our bookkeeper or accountant: for the accounts
Parties that process data on our behalf (processors):
- Microsoft (Microsoft 365): email, calendar and storage of the project folders
- Strato (Germany): hosting of the website, the request forms, the client portal and our work server
- Mollie: processing of the iDEAL payment for the improvement advice
- Anthropic (Claude): AI tool that helps us work out the survey, check the file and draft messages. The assessment and the label calculation are always done by the energy advisor.
- WhatsApp (Meta): if you contact us through WhatsApp or we send you a confirmation that way
Agreements on security and confidentiality apply to these processors (a data processing agreement or the processing terms of the service).
Only with your cookie consent: Google (Analytics and Ads), Meta (Facebook and Instagram) and Microsoft Advertising (Bing). See section 7.
Land Registry and public map sources: to check the address and the year of construction, we look up the property in the BAG (Dutch address and building register) and on aerial photos. Only the address is used, never your name or contact details.
Data outside the European Union
Some parties (Google, Meta, Microsoft and Anthropic) may process data in the United States. This only happens with the safeguards the GDPR requires: the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission.
7. Cookies
On your first visit, the cookie banner asks whether you accept cookies. If you click "Decline" or make no choice, we only use functional storage.
- Functional (no consent needed): we remember your cookie choice in your browser's storage and, during your visit, the page through which you arrived (for the origin of your request)
- Analytics, only after "Accept": Google Analytics, to see how visitors use the site. Cookie lifetime up to 2 years.
- Advertising, only after "Accept": Google Ads, the Meta pixel (Facebook and Instagram) and Microsoft Advertising (Bing). With these we measure which advertisements lead to a request, and these parties can later show you our advertisements. Cookie lifetime 3 to 13 months.
Change cookie choice: this shows the cookie banner again. If you accepted earlier and also want to remove the cookies already placed, delete the cookies for hollandsduurzaam.nl in your browser.
8. Security
We take appropriate technical and organisational measures to protect your personal data against loss, unauthorised access, disclosure and alteration. The website and the client portal only work over an encrypted connection (HTTPS), access to the project folders is limited to those working on your assignment, and our backups are encrypted. Should a data breach occur, we will report it to the Dutch Data Protection Authority and to you where required.
9. Automated decisions
We do not make decisions about you that are taken by a computer alone. The improvement advice form automatically checks whether your existing label is recent enough; if it does not qualify, you can always contact us.
10. Your rights
Under the GDPR you have the following rights:
- Right of access: you can ask which data we process about you
- Right to rectification: you can have incorrect data corrected
- Right to erasure ("right to be forgotten"): you can ask us to delete your data, unless a legal retention obligation (such as the survey file or tax records) prevents this
- Right to restriction: you can ask us to temporarily restrict the processing
- Right to data portability: you can request your data in a common digital format
- Right to object: you can object to processing based on legitimate interest, such as the review request
- Right to withdraw consent: where processing is based on consent, such as for cookies
Send your request to kantoor@hollandsduurzaam.nl. We respond within one month and may ask you to show that the data concern you. There is no charge.
11. Complaints to the Dutch Data Protection Authority
Do you have a complaint about how we handle your personal data? We would like to discuss it with you first. If we cannot resolve it together, you have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via www.autoriteitpersoonsgegevens.nl.
12. Changes
We may update this privacy policy. The most recent version is always on this page. We will let you know about significant changes.