Privacy Policy

1. Who we are

FindNL operates this platform and is the controller for the personal data described here. All communication between searchers and companies is mediated by the platform: companies never see your email address and you never see theirs. For any privacy question or request, contact us through the contact options published on this site.

2. What we collect

We collect only what is needed to run the service:

• Enquiries and messages — your name, email address, subject and message text when you contact a company, plus the replies in that conversation.
• Account data — email address, name, preferred language and role when you create an account; company registration details (such as KvK number, description and contact email) when you list a company.
• Search queries — the text you search for, stored so we can answer the query and improve result quality.
• Usage analytics — first-party events such as profile views, searches, enquiries and replies. We use no third-party advertising or tracking tools.
• Technical data — your IP address, used briefly for rate limiting and abuse prevention, and the strictly necessary cookies listed in the cookie policy.

3. Why we process it (purposes and legal bases)

We process personal data for the following purposes:

• Delivering your enquiry and the company's reply — with the consent you give on the enquiry form (GDPR art. 6(1)(a)) and, for account holders, to perform our service (art. 6(1)(b)).
• Operating accounts and company listings — performance of a contract (art. 6(1)(b)).
• Interpreting searches, ranking results and translating messages with AI — our legitimate interest in providing a multilingual search service (art. 6(1)(f)); see the next section.
• Security and abuse prevention — rate limiting, CAPTCHA and audit logs, based on our legitimate interest in keeping the platform safe (art. 6(1)(f)).
• Improving the service — first-party analytics and the feedback you choose to give (art. 6(1)(f), and consent where we ask for it).

4. AI processing

Search queries — and message text when translation is needed — are processed by third-party AI providers configured by our administrators. This processing is transient: providers are used to interpret, rank or translate text and are engaged as sub-processors under data-processing agreements. We prefer providers with EU processing options, and provider API keys are stored encrypted.

5. Where your data lives

All data is stored in the European Union: our database, queues and files run on DigitalOcean in Amsterdam (AMS3), the Netherlands. Traffic is encrypted in transit.

6. How long we keep it

Raw search query text is scrubbed after a configurable retention window by a scheduled cleanup job. Conversations are kept for as long as they are needed to provide the messaging service. Account data is kept until you delete your account. Audit logs are kept for accountability.

7. Your rights

Under the GDPR you can:

• Access and portability — request an export of your account, conversations, messages, feedback and search queries.
• Erasure — request deletion of your account; this permanently deletes your conversations, messages and feedback and anonymises your search logs.
• Rectification, restriction and objection — ask us to correct your data or limit how we use it.
• Complain — lodge a complaint with your supervisory authority; in the Netherlands this is the Autoriteit Persoonsgegevens.

8. Guests

You can send an enquiry without creating an account. In that case we process the name and email address you enter on the form, and email you a private magic link that gives access to that single conversation only. The link's token is stored hashed.

9. Changes

We will update this policy as the service evolves and change the date at the top. Substantial changes will be announced on the platform.