Privacy statement

Article 1 - Who is responsible for your data

SocialMediaGroei.nl (established in the Netherlands, Chamber of Commerce number 94577056, reachable at info@socialmediagroei.nl) is the controller within the meaning of the General Data Protection Regulation (GDPR) for the personal data processed through our website, our tools (including the free Social Media Scan), our quote requests and the delivery of our services.

For questions about this privacy statement or about the processing of your data, you can get in touch using the contact details at the bottom of this document.

Article 2 - Our starting point: no collection without a legal basis

Our website collects no personal data from visitors without a legal basis for doing so. Simply visiting our website does not lead to you being identified as a person, apart from the limited technical and analytical data described below. Personal data is only processed at the moment you actively provide it yourself, for example through a form, or when you become a client.

Article 3 - Which personal data we process

Depending on your relationship with SocialMediaGroei.nl, we process the following categories of data:

• Contact and account details: name, company name, email address, phone number, job title and, where applicable, login details for the client portal.
• Data from forms, including the free Social Media Scan and quote requests: the company details, social media profiles, goals and any additional remarks you provide so the scan or quote can be prepared.
• Usage data: data about how you use our website and the client portal, such as the pages visited and clicking behaviour. This is only collected when you give permission for the analytical cookies mentioned in Article 8.
• Payment details: data needed to process payments, such as billing and transaction details. Payment details such as card numbers are processed by our payment processor Stripe; SocialMediaGroei.nl itself does not store full card or account details.
• Data arising from the service, such as data collected through social media accounts or advertising campaigns we manage for the client (for example comments, messages and lead data), to the extent relevant for performing the agreement with the client.

Article 4 - Purposes and legal bases

We process your personal data for the following purposes, each time on the stated basis from Article 6 GDPR:

• Performing the agreement: delivering our subscriptions and services, including managing social media accounts, producing and publishing content and managing advertising campaigns, on the basis of the agreement with you.
• Handling requests: preparing and sending a Social Media Scan or quote in response to your request, on the basis of your request prior to any agreement.
• Commercial follow-up of scan and quote requests: we only contact you about an additional offer or a next step when you have requested a Social Media Scan or a quote yourself. This follow-up takes place on the basis of your request and our legitimate interest in responding to it, or - where required - on the basis of your consent.
• Client communication and administration: sending invoices, reports and service communication, on the basis of the agreement and our statutory (tax) obligations.
• Improving our website and services: analysing anonymised or pseudonymised website use, on the basis of consent (for analytical and marketing cookies) or legitimate interest, as further explained in our cookie policy.
• Compliance with statutory obligations, such as tax retention duties, on the basis of a legal obligation.

Article 5 - Retention periods

We keep personal data no longer than necessary for the purposes for which it was collected:

• Leads and contact requests (including a Social Media Scan or quote request that does not lead to a client relationship): 24 months after the last contact, unless you ask for deletion sooner.
• Client data and invoices: 7 years, because of the tax retention obligation that applies to our administration.
• Job applications: 4 weeks after the procedure has been completed, or 1 year if you give us permission for that.
• Account details of the client portal: up to 6 months after the subscription ends, after which the account and the associated data are deleted.
• Log files of our servers and application: 12 months, for security and resolving faults.
• Usage data from analytics: only when you have given permission, and then in line with the Google Analytics 4 settings explained in our cookie policy, in principle no longer than 14 months.

If a retention period expires while the data is still needed for an ongoing dispute or a statutory obligation, we keep it for as long as that is necessary and no longer.

Article 6 - Who we share your data with

We share personal data only to the extent necessary for the purposes mentioned above, with the following categories of recipients and processors:

• Hosting: Vercel, for hosting and serving our website and application.
• Database: Supabase, for storing client and account data.
• Payments: Stripe, for processing payments, direct debit and payment details.
• Email: Resend, for sending transactional and service-related email.
• Social media publishing tool: a tool with which we schedule and publish content on the agreed platforms on behalf of the client.
• Analytics: Google Analytics 4, which is used as soon as you give permission for it through our cookie banner, for analysing website use. If you do not give permission, this script is not loaded. See our cookie policy for the details.

With the parties mentioned above that act as processors, we have concluded processor agreements containing appropriate arrangements about security and confidentiality.

Article 7 - Transfers outside the EEA

Some of the service providers we engage may process data (partly) on servers outside the European Economic Area (EEA). Where that is the case, we ensure that such a transfer takes place on the basis of an appropriate safeguard, such as an adequacy decision of the European Commission or standard contractual clauses, so your data enjoys an appropriate level of protection outside the EEA as well.

Article 8 - Cookies and similar techniques

For the use of cookies and similar techniques, including functional, analytical and (where applicable) marketing cookies, we refer to our separate cookie policy. There you can read which cookies we use, for which purpose, how long they are kept and how you can withdraw your consent.

Article 9 - Security

We take appropriate technical and organisational measures to protect your personal data against loss or unlawful processing, including encryption of data traffic, restrictions on access to systems based on role, and arrangements with our processors about the level of security. Despite these measures, no party can guarantee 100% security.

Article 10 - Your rights

Under the GDPR you have the following rights regarding your personal data:

• the right of access to the data we process about you;
• the right to rectification of incorrect or incomplete data;
• the right to erasure (the "right to be forgotten"), where applicable;
• the right to restriction of processing;
• the right to data portability;
• the right to object to processing on the basis of legitimate interest or for direct marketing;
• the right to withdraw consent given earlier at any time, without affecting the lawfulness of the processing before the withdrawal.

You can send a request to exercise one of these rights to the contact details at the bottom of this document. We reply within the statutory period of at most one month, which in some circumstances may be extended by two months.

Article 11 - Complaints

Do you have a complaint about the way we process your personal data? Please get in touch with us first, so we can look for a solution together. You also have the right at any time to lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl), the Dutch supervisory authority for data protection.

Article 12 - Changes to this privacy statement

We may change this privacy statement from time to time, for example in response to changes in our services, in the processors we engage or in applicable law. The most current version can always be found on our website, stating the effective date at the top of this document.

Article 13 - Contact

For questions, remarks or requests regarding this privacy statement or the processing of your personal data, you can contact SocialMediaGroei.nl at info@socialmediagroei.nl or by phone. Our full company details, including Chamber of Commerce number, VAT number and registered address: established in the Netherlands, Chamber of Commerce number 94577056, reachable at info@socialmediagroei.nl.