October 2026
Privacy Policy
This privacy policy explains what personal data Dutch Croissant, a sole proprietorship registered in the Netherlands, processes, why, and what rights you have. We are the controller within the meaning of the GDPR / Dutch AVG.
1. What we process
Depending on how you work with us, we process:
- Contact details: name, email address, phone number and company name
- Project and briefing information you share with us
- Correspondence, including quotes and invoices
- Website usage data from privacy-friendly analytics
2. Why we process it
We process data only for clear purposes, each with a lawful basis under Article 6 AVG:
We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.
- To perform an agreement (Art. 6(1)(b)), carrying out services, invoicing, support
- Legitimate interest (Art. 6(1)(f)), portfolio, business records and simple, privacy-friendly analytics
- Consent (Art. 6(1)(a)), optional marketing emails, which you can withdraw at any time
3. Sharing
We do not sell personal data. We share it only with processors needed to run the studio, each bound by a processing agreement (verwerkersovereenkomst):
Some of these processors, including Cloudflare's global edge network, operate from servers outside the EEA; where data crosses borders it is protected by the European Commission's Standard Contractual Clauses or an equivalent recognised safeguard.
- Hosting and infrastructure (Cloudflare)
- Email and communication services
- Accounting software and tax administration
- File storage and delivery services for project files
4. Retention
Contact and project data are kept while the engagement runs and for a reasonable period afterwards for legitimate business purposes (no longer than needed).
Invoices and tax records are kept for 7 years as required by Dutch tax law.
6. Your rights
Under the AVG you have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest.
To exercise a right, email hello@dutchcroissant.com. We respond within one month. You may also file a complaint with the Autoriteit Persoonsgegevens (Dutch data protection authority).
7. Security
We protect personal data with the measures described in our Security Policy, access control, encryption in transit and at rest, and regular backups.
8. Contact
Privacy questions: hello@dutchcroissant.com.