Privacy statement

1. Who we are

The controller is TDBIT. Privacy questions can be asked through the contact page of this website.

2. What data we process

Contact details you enter yourself: name, company name, email address, phone number and contact preference.
Business details for a preview: your current website, town, industry and public information about your business, such as your Google Business Profile and reviews.
The content of your message and our further correspondence.
Source data: which campaign or link brought you to us (UTM parameters or a reference code).
Technical data: IP address and browser details in server logs, for security and abuse prevention.
Statistics and advertising data, only if you consent (see the cookie policy).
For clients: invoicing and payment details and data needed to build and deliver your website.

3. Purposes and legal bases

Answering your request and building a preview: steps taken at your request prior to a contract (Art. 6(1)(b) GDPR).
Building and delivering websites and invoicing: performance of the contract (b) and legal obligations such as tax record-keeping (c).
Approaching businesses with a proposal based on public business information: our legitimate interest in offering our services (f). You can always object; we will then stop contacting you.
Security, fraud and spam prevention: legitimate interest (f).
Statistics and ad measurement: only with your consent (a), which you can withdraw at any time.

4. Outreach based on public data

We research local businesses using publicly available information, such as their own website, the Google business listing (via Google Maps and Outscraper), the Chamber of Commerce trade register and reviews, so we can make a targeted proposal: a free preview of a new website. We use business contact details for this. We use AI services to analyse and draft text (see section 5).

The first message we send you always contains:

who we are;
why you receive it: we would like to show you a preview of a new website for your business;
where we got your details, for example Google Maps, your own website or a public source, and that we use them only for this;
that you can always ask for access, erasure or object;
the link to this privacy statement;
a clear way to opt out.

Every later message contains our sender details, the link to this privacy statement and, for as long as it is a first approach, a way to opt out. We honour an opt-out or objection immediately and permanently: we only keep what is needed to make sure we do not contact you again.

We never sell your data. We only share it with service providers who help us, with whom we have a data processing agreement where required:

Vercel Inc.: hosting this website and its forms (US (EU-US Data Privacy Framework)).
Cloudflare, Inc.: network and tunnel service that passes traffic securely to our own server (US (global network)).
Anthropic PBC: AI analysis and text generation: public business information and the content of messages we reply to are sent in the request to the AI model (US).
Outscraper: supplies public business data, for example from Google Maps.
Google: supplies public business data (Google Maps and Places) (EU / US (EU-US Data Privacy Framework)).
Meta Platforms Ireland Ltd.: WhatsApp, Messenger and Instagram, only if you write to us through those channels or we message you there with your consent or at your request (EU / US (EU-US Data Privacy Framework)).

The LeadForge software and its database run on TDBIT's own hardware in the Netherlands. No processor is involved for that.

Data processed outside the EU is protected by appropriate safeguards, such as the EU-US Data Privacy Framework or standard contractual clauses.

6. How long we keep data

Requests and previews without an order: up to 12 months after the last contact.
Client data and correspondence: for the duration of the contract and 2 years after.
Invoices and accounts: 7 years, as required by Dutch tax law.
An objection to outreach: as long as needed to honour it.
Server logs: up to 90 days.
Statistics: up to 14 months.

7. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection. You can withdraw consent at any time, for example through the cookie settings at the bottom of every page. Contact us through the contact page with your request; we respond within one month.

Unhappy with how we handle your data? Let us know first and we will look for a solution together. You can also lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

8. Security

We take appropriate technical and organisational measures: encrypted connections (HTTPS), limited access to data, up-to-date software and backups.

9. Client websites

For websites we build and host for clients, the client is responsible for its visitors' data and we act as processor. We sign a data processing agreement on request.

10. Changes

We update this statement when our practices change. The date at the top shows when that last happened.