Privacy statement
This website collects nothing in the background. There are no analytics, no tracking pixels and no advertising cookies on it. If you contact us, we use your details only to answer your question.
What does and does not happen on this site
A short statement, because there is little to state. Here we describe exactly which data you share with us, why we use it and what your rights are.
Last updated: 23 July 2026
Please note, this version is not final yet. This privacy statement has to be reviewed legally before the website goes live. The list of processors (hosting, email, CRM and other suppliers that process data on our behalf) and the matching retention periods also still need to be completed. Until that has happened, you can read this text as a working version and not as a complete legal statement.
Controller
ITproposal is responsible for the processing of personal data that we obtain through this website and through our contact with you. We were founded in the Netherlands in 2019 and work from three offices.
- ITproposal, Zekeringstraat 48, 1014 BT Amsterdam (head office)
- Email: [email protected]
- Telephone: 085 060 9347
- VAT number: NL864747664B01
Our other offices are Kernenergiestraat 19 in Antwerp, Gazidükkan Mahallesi 107. Sk. (Nur Merkez) in Karaman.
This website is static
The site you are looking at consists of fixed pages with text and images. No visitor analytics run on it, no profiles are built and there are no advertising or tracking cookies. You can read the whole site without us knowing that you were here.
There is a form on the quote page. What you fill in there reaches us as a message and is used only to handle your request. Otherwise you call or email us directly. From that moment we do hold data about you, namely the data you share yourself in that form, message or conversation.
What we do not do
- We do not sell your data and we do not rent it out.
- We do not use your contact details for commercial newsletters unless you ask for them yourself.
- We do not take automated decisions about you on the basis of a profile.
Which data, for which purpose, on which legal basis
The GDPR asks for three things per processing activity: what you process, why you do it and on which legal basis that is allowed. Below you find them set out.
| Which data | For which purpose | On which legal basis |
|---|---|---|
| Name and organisation | To address you personally and to know on behalf of which company you are getting in touch. | Legitimate interest: answering a question that you put to us yourself (Article 6(1)(f) GDPR). |
| Email address | To respond to your question in writing and to continue the correspondence about it. | Legitimate interest in handling your question (Article 6(1)(f) GDPR). |
| Telephone number | To call you back when you ask us to, or when a question is hard to answer by email. | Legitimate interest in handling your question (Article 6(1)(f) GDPR). |
| Content of your message or conversation | To understand what you need and to be able to give a substantive answer or piece of advice. | Legitimate interest in handling your question (Article 6(1)(f) GDPR). |
| Data you share during a quotation or intake process | To draw up a proposal and to assess whether our services fit your situation. | Necessary for taking pre-contractual steps at your request (Article 6(1)(b) GDPR). |
| Invoicing and administrative data of clients | To perform an agreement and to comply with our statutory accounting obligations. | Performance of the agreement and legal obligation (Article 6(1)(b) and (c) GDPR). |
Retention periods
The specific retention periods per category have not been set yet. As soon as the legal review is finished, we will fill them in here per type of data. What already applies: we do not keep data longer than is necessary for the purpose for which we received it, and for administrative and invoicing data we follow the statutory periods that apply to them.
What you can ask for and how to do it
The GDPR gives you a number of rights over the data we hold about you. You do not need to fill in a form for that: an email is enough.
- Access. You may ask which personal data we process about you and what we use it for. You will receive a copy of it.
- Rectification. If your data is incorrect or incomplete, we will correct it.
- Erasure. You can ask us to delete your data. We will do that, unless we are legally required to keep it, for example for our accounts.
- Restriction. You can ask us to pause the processing temporarily, for example while we assess a rectification request.
- Objection. If we process data on the basis of a legitimate interest, you can object to that because of your specific situation. We will then stop, unless there are compelling grounds that carry more weight.
- Data portability. Data that you supplied yourself and that we process digitally on the basis of consent or an agreement, we will deliver on request in a common file format to you or to another party.
- Withdrawing consent. If you have given consent for something, you can withdraw it at any time. That has no consequences for the processing that already took place before then.
Submitting a request
Send your request to [email protected] or call 085 060 9347. We respond within the statutory period set by the GDPR. To prevent us from handing data to the wrong person, we may ask you to send your request from the email address we already know, or to verify your identity in another way. We do not ask for a copy of your identity document.
Complaint to the Dutch Data Protection Authority
If you disagree with the way we handle your data, we would prefer to hear that from you first, so that we can resolve it. You also always have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens, via autoriteitpersoonsgegevens.nl. If you live in Belgium, you can turn to the Data Protection Authority (Gegevensbeschermingsautoriteit).
How we protect your data
Information security is our profession, so we apply the same principles to our own administration as we do at our clients.
Technical and organisational measures
We limit access to contact and client data to the colleagues who need it for their work. Our management system is certified to ISO 9001, ISO/IEC 27001 and ISO 14001, and for staffing we are Kiwa NEN 4400-1 certified. ISO/IEC 27001 deals specifically with information security and obliges us to review our own measures periodically.
Processors and third parties
For hosting, email and our client administration, among other things, we use suppliers that process personal data on our behalf. We conclude data processing agreements with those parties. The full list of processors is not yet included in this statement and will be added before the site goes live.
We do not pass your data on to other parties for commercial purposes. Only where a legal obligation compels us to do so can disclosure to, for example, a supervisory authority come into play.
Processing outside the European Economic Area
Besides Amsterdam and Antwerp, we have an office in Karaman (Turkey). Whether and when contact details of website visitors are viewed by colleagues outside the EEA, and which safeguards apply to that, will be set down during the legal review of this statement. So that point too is one of the outstanding items listed above.
Changes to this statement
If our services, our website or the legislation change, we will amend this statement. The date at the top of the page shows when we last did that. There is no version history or archive online: the text you read here is the version that applies.
Contact about privacy
If you have a question about this statement or about your data, email [email protected] or call 085 060 9347. You can also send your question by post to ITproposal, Zekeringstraat 48, 1014 BT Amsterdam.
A question about your data?
Do you want to know what we hold about you, or do you want us to delete it? Send an email or give us a call. You get an answer from a person, not from a form.