Privacy notice
Version 2026-09-27 · [DRAFT — to be reviewed by a privacy lawyer before public launch]
Who we are
[Legal entity name], [registered address], registered under [Chamber of Commerce no.] (“SMEbrug”, “we”). We are the controller of the personal data described here. Contact for privacy questions: [privacy email].
What we collect and why
- Business briefs: your name, work email, optional phone, company details and the problem you describe. We use them to prepare a shortlist of providers and contact you about it. Legal basis: your consent and steps at your request before entering into a contract (GDPR Art. 6(1)(a) and (b)).
- Connector applications: your name, work email, location, background, languages, optional LinkedIn profile and a description of your network. We use them to assess your application. Legal basis: consent and pre-contractual steps.
- Delivery partner applications: company and contact details, information about your services, qualifications and certifications, and the names and contact details of your referrals. Legal basis: consent and pre-contractual steps.
- Referrals: if an applicant names you as a referral, we store your name, role, organisation and email only to contact you once about that application, and delete it with the application. Legal basis: legitimate interest in verifying applicants (Art. 6(1)(f)). You can object at any time.
- Security data: to prevent spam and abuse we keep a one-way scrambled code (hash) derived from your IP address for up to one hour. We do not store your IP address itself with your submission. Legal basis: legitimate interest in keeping the service secure (Art. 6(1)(f)).
Cookies
We use only one strictly necessary cookie (euib_session) to protect forms against misuse. It is deleted when you close your browser. We do not use analytics, advertising or tracking cookies, so no cookie banner is needed.
Who we share data with
We share a brief only with the providers and connector involved in preparing your shortlist, and only after telling you. Our hosting provider [Namecheap, Inc. — server location: [region]] processes data on our behalf under a data processing agreement. [List any other processors.] Where data leaves the EU/EEA (for example to a provider in India), we use EU Standard Contractual Clauses.
How long we keep it
Briefs and applications that do not lead to a contract are deleted after [12] months. Data connected to a contract is kept for as long as required by law (for example [7] years for accounting records).
Your rights
You can ask us to access, correct, delete, restrict or transfer your data, object to processing, and withdraw consent at any time (this does not affect processing before withdrawal). Email [privacy email]. You also have the right to complain to your data protection authority, for example the Autoriteit Persoonsgegevens in the Netherlands.
Changes
If we change this notice we will update the version date above.