Privacy policy

Who is responsible

Plainly Dutch is run by Denislav Milenov Angelov, kv. Devnya 3, entrance A, floor 5, apt. 15, 9160 Devnya, Bulgaria (BULSTAT 181596598), who is the controller of the personal data described here. For anything on this page, write to [email protected].

What we collect when you ask for advice

When you send a request we store:

• your name and e-mail address;
• your telephone number and postcode, if you give them;
• for a tax or moving request, your answers to that form's questions — for example the tax year, or where you are moving from;
• the page you sent it from and any campaign parameters in its address;
• your IP address and browser, at the moment you sent it.

A mortgage request asks for nothing beyond your contact details. Dutch law treats passing on more — your income, say — as acting as a mortgage intermediary, and the adviser will ask you those questions directly.

Your name, e-mail address, telephone number and answers are encrypted in our database. We also keep a one-way fingerprint of your e-mail address, so that a duplicate request can be recognised without decrypting anything.

Reading the site or using a calculator stores nothing about you in our database; the calculators do not save what you type. Like any web server, ours keeps technical logs — IP address, page, time — to keep the site secure and to find faults. They are deleted after 14 days.

What we do with it

We pass your request to the advisers named next to the consent checkbox on the form you filled in, and to nobody else. At most three advisers receive one request, and for some requests only one. An adviser does not see your contact details until the request has actually been passed to them. If an adviser declines, the request may be offered to the next adviser named on the form, and that is recorded too.

Once an adviser has your request, they hold their own copy and are responsible for it themselves, under their own privacy policy. Tell them directly if you want them to delete it.

Alongside your request we keep a record of your consent: the exact wording you were shown, its version, the names of the advisers listed, the time, your IP address and your browser. That record cannot be changed afterwards, because it is the evidence of what you agreed to. The one exception is the erasure described below, which removes the IP address and browser from it too.

The legal basis

Your consent, given by ticking the box on the form. Without that tick the request is refused and nothing is stored. Keeping the site secure — for example spotting repeated automated submissions — is our legitimate interest.

Who else processes it for us

These companies run parts of the site for us, under data processing agreements, and may only use your data to do that:

• Hetzner Online GmbH (Germany) hosts the site and the database, on a server in Finland.
• Google Ireland Limited (Google Workspace) runs our mailbox and sends the e-mails that pass your request to the advisers, so those e-mails, and any e-mail you send us, are stored there. Google may process them outside the EU; its parent is an American company certified under the EU–US Data Privacy Framework.
• Cloudflare, Inc. delivers the site and protects it against attacks, which means it sees your IP address. It also counts visits for us with Cloudflare Web Analytics, which sets no cookies and does not identify you: we see how many people read which page, not who they are. Cloudflare is an American company certified under the EU–US Data Privacy Framework.

We do not sell data, we do not build advertising profiles, and we do not pass your details to anyone who was not named on the form.

How long we keep it

12 months from the day you sent the request. After that, a job that runs every night erases your name, e-mail address, telephone number, answers, full postcode, IP address and browser — from the request and from the consent record. What remains identifies nobody: the kind of request, the region and the first four digits of the postcode, the dates, and which advisers received it, which we need for our own invoicing.

The e-mails we send ourselves about a new request contain no contact details, so no copy outlives this period in a mailbox.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, ask us to erase it now rather than after 12 months, object to how we use it, or withdraw your consent. Write to [email protected] and we will answer within one month. Withdrawing consent does not undo an introduction that has already been made — you would need to tell that adviser directly.

You can complain to the data protection authority where you live — in the Netherlands the Autoriteit Persoonsgegevens — or to the authority where we are established, the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни).

Cookies

The site sets two cookies that forms need to work: a session cookie, and a security token that stops other sites from submitting forms in your name. Both expire two hours after your last visit. We use no advertising, tracking or analytics cookies; the visitor statistics described above work without them.

Changes

When what the site does with your data changes, this page changes first. The date at the top says when that last happened.