Privacy notice

Who is responsible?

DUID. is the advisory practice of Danny Bouwman in Oss, registered with the Dutch Chamber of Commerce under 42157467. Trade names: DUID. and DUID. Eerst begrijpen. Dan verbeteren..

Registered address: Harnas 41, 5346 WR Oss. No visitors received.

Privacy questions: contact@duid.nu.

Which information is processed?

Depending on the contact or project, this may include your name, email address, phone number, role and organisation; correspondence and appointments; proposal, contract, project, invoice and payment details, including account holder, IBAN, amount and payment reference.

Video calls involve contact details and the image, audio and screen content you share. Education advice may involve education, work experience, development questions and preferences you choose to disclose. The hosting provider processes technical information for security and operation, such as IP address, time, browser and device details.

Do not send a citizen service number, identity document, medical information or other people’s records with an initial enquiry. Before a project, we agree on what information is necessary and how to exchange it safely.

When DUID. analyses or cleans personal data for a client, responsibilities are determined beforehand. Where DUID. acts as a processor, it follows the client’s instructions under a separate data processing agreement.

Information usually comes directly from you. A business client may provide contact or project details. Where DUID. is the controller, it informs the people concerned about the source and use. For education advice arranged by an employer, feedback is agreed in advance; personal conversation content is not automatically shared with the employer.

Purposes and legal bases

Contact, appointments and proposals: answering enquiries and preparing a possible project. For an agreement with you, this is preparation or performance of that agreement. For contact on behalf of an organisation, the basis is the legitimate interest in answering business enquiries and arranging appointments.

Advice: carrying out the agreed process, information or education advice. The basis is your agreement or, for a business contact person, the legitimate interest in carrying out the business project.

Administration and invoicing: settling project fees and meeting statutory tax and administrative obligations, based on the agreement and legal obligations.

Security and limited website analysis: maintaining a secure, working and usable website. Legitimate interest is the intended basis for limited analysis. Necessity, privacy impact and consent requirements must match the actual setup. Technical operation and settings are checked on publication.

You are not obliged to provide information. Without information necessary for an enquiry, proposal or project, DUID. may be unable to handle it. Consent for any separate processing that requires it is requested separately.

Retention periods

DUID. keeps information for as long as necessary. The following maximum periods apply to its own active administration. The 12-month periods are DUID.’s policy choices, not general statutory obligations. Tax retention requirements take precedence where necessary.

Enquiries without a project: up to 12 months after the last substantive contact. Unaccepted proposals: up to 12 months after rejection or expiry, except documents belonging to the tax administration.

Working files and education advice: up to 12 months after completion or agreed follow-up. Unnecessary copies and intermediate files are removed sooner. Only necessary tax records are retained separately for longer.

Invoices and tax administration: generally 7 years. For a completed financial year, the period starts at year-end. Information that remains current for longer, such as an ongoing contract, has a later starting point. Statutory exceptions, such as immovable property or the One Stop Shop scheme, require 10 years.

Data processed for a client: returned or deleted at the end of the service in accordance with the processing agreement and the client’s choice, unless statutory retention applies. DUID.’s own file retention period does not automatically apply.

Website analysis: 90 days for raw Matomo visit data and 24 months for aggregated reports. DUID. periodically checks that configured deletion is performed. Hosting logs: mijn.host states a maximum of 12 months for technical and security logs where necessary. This is a provider policy, not a legal obligation to retain every log that long.

A specific complaint, dispute or legal obligation may require longer retention of only the necessary information. The reason and review date are recorded; this does not justify retaining an entire file indefinitely.

Deletion includes separate copies, email attachments and deleted-item folders. Deleted iCloud files are normally recoverable for 30 days; DUID. permanently deletes them immediately where possible. Published mijn.host terms specify backup rotation of up to 90 days. Recovery copies are not a working archive; previous deletions must be reapplied after restoration.

Service providers and international processing

DUID. uses mijn.host for business email, hosting and its own Matomo installation. Business files are stored on its own laptop and synchronised with Apple iCloud Drive. Business folders are not shared with other users; within DUID., only Danny Bouwman has access. This does not exclude technical processing by the service providers.

Gekko is used for accounting and necessary customer, invoice and administrative information, not substantive advisory conversations or complete project files. Gekko states that processing terms, including customer data, are in its user agreement and privacy statement rather than a separate processing contract. Precise roles, transfers and deletion arrangements still require clarification.

Gekko describes deletion of contacts and projects; archiving is not deletion. Its user agreement mentions at least ten years of availability, not a general ten-year tax retention obligation. Actual deletion of linked administrative records and backups must align with the periods above.

Payments use a Rabobank business account. The bank also processes payment data for its own statutory responsibilities as an independent controller. A connection between the bank and Gekko has not been assumed to exist.

The video-call service is agreed before an online appointment. Its provider processes information necessary for the connection. DUID. does not routinely record or automatically transcribe calls. Any recording requires separate agreements, prior information and an appropriate legal basis. This notice is updated where necessary when additional services are introduced.

Other disclosure only takes place where necessary and lawful for the project or a legal obligation. Personal data is not sold. Appropriate processing terms are required for providers acting as processors. mijn.host publishes a data processing agreement and a list of its service providers.

Apple’s privacy policy describes international processing and European standard contractual clauses for transfers. Their concrete applicability to the business files and iCloud account still needs checking. DUID. therefore does not claim that all information stays within the European Economic Area or that a business data processing agreement with Apple has been confirmed.

Other suppliers are also assessed for processing outside the European Economic Area and applicable safeguards. A European server location alone does not establish who can access data. Relevant transfer information is added before the processing concerned.

Gekko privacy statement · mijn.host processing agreement · Apple privacy policy · Rabobank privacy statement

Cookies and website analysis

On duid.nu, DUID. uses limited website analysis through its own Matomo installation at mijn.host, via analytics.duid.nu. Analysis is disabled in private previews and local tests. It measures, for example, which sections are reached, whether a section remains continuously in the central area of the active window for 5 or 15 seconds, and which links or experience examples are used. This does not establish whether someone reads or understands the text. Hidden tabs do not count towards these time thresholds.

The website disables analytical cookies and respects Do Not Track and the opt-out below. URL query parameters and external referrers are not transmitted. Intended server settings mask three bytes of IP addresses before storage, delete raw visit data after 90 days and aggregated reports after 24 months. The operation of these server settings has not yet been technically confirmed.

Matomo initially processes visit data to create reports; viewing only aggregates does not automatically anonymise the underlying records. DUID. does not use session recordings or advertising profiles and does not transmit analysis data to Matomo Cloud.

Your opt-out is stored only in your browser and contains no visitor identifier. Display language and appearance preferences are also stored locally to remember your choice, without a visitor identifier. LinkedIn links open an external website with its own privacy statement.

Your rights

You can request access, correction, deletion, restriction or transfer of personal data, or object to processing. Email contact@duid.nu. Additional identification may be requested to protect the data. Applicable rights depend on the processing. You may also complain to the Dutch Data Protection Authority, Autoriteit Persoonsgegevens.

You normally receive a response within one month. For a complex request, this may be extended by up to two months; the reason is communicated within the first month. Where processing is based on consent, you may withdraw it at any time. This does not affect the lawfulness of earlier processing.

Contact the Dutch Data Protection Authority

Security and changes

DUID. takes appropriate technical and organisational measures to protect personal information. This notice is updated when the website, services or providers change. The current version date is shown above.