Privacy Policy

Last updated: 1 October 2026

We are Eenvoud Media B.V., established at Frederik Hendrikstraat 23, 1052 HJ in Amsterdam. We are a digital agency specialising in custom software, data solutions and AI integrations.

When you visit our website, request a quote or enter into a collaboration with us, we process personal data. In this statement we explain how we do that, why we do it and how we protect your privacy.

Do you have questions? Feel free to email us at hello@eenvoud.nl.

1. Introduction

Eenvoud Media B.V. complies with the General Data Protection Regulation (GDPR). We respect the privacy of all users of our site and ensure that the personal information you provide to us is treated confidentially.

2. What data do we collect and why?

We process personal data for different purposes, depending on the service you use.

A. For our administration and communication

When you become a client, we process contact details (name, email, phone, company details) for:

Preparing quotes and invoicing services.
Relationship management and communication about the progress of projects.
Sending our newsletter (only with your consent).

B. For custom applications & hosting

For the development and hosting of web applications and websites we often act as a Processor.

We store data that you or your end users enter into the applications we manage for you.
We make back-ups to prevent data loss.
We monitor server logs (IP addresses) for security and troubleshooting.

C. For data migrations & business intelligence (BI)

For these services we temporarily gain access to your internal datasets.

This data is used exclusively for the purpose of the assignment (migration, analysis or visualisation).
After completion of a migration or analysis project, temporary copies of datasets are removed from our local systems, unless otherwise agreed for maintenance.

D. For AI integrations

When we set up AI solutions (such as chatbots or analysis tools) for you:

Data is processed via Large Language Models (LLM’s) such as those of Google (Gemini) or OpenAI.
We configure these systems as far as possible to ‘Enterprise’ standards, whereby your data is not used to train these providers’ public AI models, unless explicitly stated otherwise.

E. For online scans

What you enter. A scan consists of multiple-choice questions, sometimes short name fields and one open text field. In such a name field, you can enter the name of a package for a selected system, for example Exact Online. On the final screen, we ask for your name, company name, business email address, optionally your website, how you want to be contacted and whether you want to receive the extended report as a PDF. Your phone number is required if you tick the report box, because we call you to briefly explain the report. Without the report, your phone number is optional, except when you say you want to be contacted by phone. Your answers remain in your browser’s local storage until you submit the scan, so you can continue where you were. The attribution data is stored in your browser’s session storage and disappears when you close the tab. These are not cookies.

Attribution and measurement. We always store our own attribution data: the page you landed on, the referring website and campaign data from the web address, such as utm values. We only store Google advertising click IDs, such as gclid, gbraid and wbraid, with your lead in Pipedrive if you gave consent for advertising measurement in the cookie layer. With that same consent, the Google Ads tag on our website measures that you submitted the form successfully. Google determines whether that submission can be attributed to an earlier ad. We do not currently import won projects from our CRM as conversions in Google Ads. Section 2F explains how we measure which enquiries become projects. For our statistics, we use Plausible, and Google Analytics only with your consent, to count which steps of the scan are reached and which result category comes out. When you submit the scan, the number of your submission and the internal estimate (A, B or C) are sent along, but never your answers or contact details. We give every request this estimate to decide how we follow up; you do not see it. We do not store your IP address with the submission.

Looking up your company. As soon as you leave the company name field, we look up your company so your report and our contact are about the right company. This happens before you submit the form and also if you do not request a report. We send the company name to Anthropic, the maker of the AI model Claude. If you have already entered them, we also send your website and the domain of your business email address, meaning only the part after the @; with a private address such as Gmail, we do not send a domain. We do not send your name, full email address or phone number. Claude searches the internet for the official website, after which we read the homepage ourselves to check that the company name appears on it. If there is one clear company, we fill in the website for you if that field was empty, or ask “Do you mean …?”. If there are several companies, you choose yourself. If you choose “None of these” or “No”, we do not use the result.

What we keep from the lookup. If you submit the form with that company, we store the website and up to 2,500 characters from the homepage with your submission. We also store the search result for a company name for up to 7 days in temporary storage, or 2 hours if the website could not be read, without your name, email address or IP address. To prevent misuse, we count per IP address how often the scan and the search function are used; we store that address only after a one-way calculation with a secret key, and the count disappears no later than one hour after your last request.

After submission. If you requested the report and your company has not yet been identified, Claude looks it up online after submission in the same way, using the company name, your website and the domain of your business email address. We then read the homepage of the website found. From that homepage, we take an image as the cover of your report: the image your company website shares itself, or the largest image on the page. We store that image with your submission and delete it together with the submission. A colleague can remove or replace the image before the report is sent. If you do not request the report, this does not happen after submission, unless you ask us for it later; the lookup while you fill in the form may already have taken place.

Creating the report. An AI model, Claude from Anthropic, writes a draft of your report. For this, it receives your name, company name, your answers, including what you wrote in the open fields, the scan result and the text from your company homepage. It does not receive your email address or phone number. The scan result itself comes from fixed rules, not from the AI model. An Eenvoud specialist reads every report, adjusts it where needed and approves it before we send it to you by email with the PDF. We create the PDF file when sending it and do not store it on our server.

Anthropic as recipient. For looking up your company and preparing the draft report, Anthropic processes this data for us as a processor. Because we are established in the EEA, this is Anthropic Ireland, Limited. The data processing agreement is part of their commercial terms. Anthropic also processes data in the United States; the European Commission’s standard contractual clauses included in the data processing agreement apply to that transfer. Anthropic stores what we send and what Claude returns for 30 days and then deletes it, unless their security systems mark it as possible misuse or the law requires longer retention. Anthropic does not use this data to train its AI models.

Pipedrive and notification. Every submitted scan is added as a lead in our CRM, Pipedrive. It contains your name, email address, phone number if you provided it, company name, website, answers, result, contact preference, attribution data and advertising click IDs if you gave consent for advertising measurement. The retention period in Pipedrive is 2 years after the last contact. For every submission, we receive an email notification at hello@eenvoud.nl with the submission. That notification is sent through Mailgun, and we delete it after 180 days.

The legal basis. For the report and follow-up, the legal basis is our legitimate interest in following up requests from companies, Article 6(1)(f) GDPR. For looking up your company, the legal basis is our legitimate interest in making sure your report and our contact are about the right company.

Retention of scans. We automatically delete a scan submission, including the draft report and cover image, 180 days after completion. We delete the notification to hello@eenvoud.nl after 180 days. We make daily backups of the website and store them for 14 days; a deleted submission therefore disappears from the backups no later than 14 days later. The retention periods are also listed in section 5.

F. Measuring which enquiries become projects

What we measure. If you consent to statistics, we also use Google Analytics to measure which enquiries through our website later become projects. This applies to our contact forms, the request forms in pop-up windows and our online scans. It shows us which pages and campaigns contribute to enquiries and projects.

What we link. When you submit an enquiry, we link its reference number to a pseudonymous Google Analytics identifier, your consent choice, the form used and the source, medium and campaign of your visit. We keep this link in a restricted part of our website for up to 180 days after your submission. After that, we no longer use it and our scheduled cleanup removes it. It disappears from the backups no later than 14 days after that.

What Google receives. If your enquiry becomes a project within those 180 days, we tell Google Analytics that the project was won, with the time, the value and currency, the form used, the origin data and technical identifiers to link the measurement and prevent double counting. We do not send your name, email address, phone number, company name or answers. Pseudonymous identifiers are not anonymous data. The recipient is Google Ireland Limited; section 8 explains processing outside the EEA. We do not use this callback for tailored ads and do not import it as a conversion in Google Ads.

Your choice. Without consent to statistics, we store no link and send nothing to Google. If you withdraw your consent to statistics through Cookie settings at the bottom of every page, we delete the links for the enquiries you made from that browser. After that, we send nothing more to Google for those enquiries, including any callback still waiting for a retry. A callback already sent to Google is not recalled by this. Did you make an enquiry on another device or in another browser? Email hello@eenvoud.nl and we will delete the link for that enquiry manually. Withdrawing does not change how we handle your enquiry.

3. Legal bases for processing

We process your data on the basis of the following legal bases under the GDPR:

Performance of the contract: In order to deliver the requested services (development, hosting, consultancy).
Legal obligation: For example for our tax returns and record-keeping obligation.
Legitimate interest: For securing our systems, keeping visitor statistics and improving our services.
Consent: for sending newsletters and for Google cookies for statistics, advertising measurement and tailored ads. Your consent to statistics also covers linking your website enquiry to its later outcome, as described in section 2F. You can withdraw this consent at any time.

4. Security

We take the protection of your data seriously and take appropriate measures to prevent misuse, loss, unauthorised access, unwanted disclosure and unauthorised modification.

Encryption: All data traffic runs over SSL connections (HTTPS).
Access control: Access to databases and servers is limited to essential personnel and secured with Multi-Factor Authentication (MFA).
Cloud Security: We use reputable cloud providers with high security standards (ISO 27001).

5. Retention period

We do not keep your data longer than strictly necessary to achieve the purposes for which your data is collected.

Client data: We retain these for up to 7 years after the end of the relationship (statutory fiscal retention obligation).
Project data: Back-ups and project files are retained for as long as the service agreement runs. After termination, they are destroyed or handed over within 3 months.
Online scans: We automatically delete scan submissions, including the draft report and cover image, 180 days after completion. We delete the notification to hello@eenvoud.nl after 180 days. We do not store the PDF file on our server. We store leads in Pipedrive for 2 years after the last contact. We store website backups for 14 days. Shorter retention periods for looking up your company are described in section 2E.
Enquiry measurement: The link between a website enquiry and its pseudonymous Google Analytics identifier remains usable for up to 180 days. After that, a scheduled cleanup removes it. To prevent double counting, we separately keep the internal deal number from our CRM and the time of the measurement attempt, without the Analytics identifier, contact details or form content. We also delete that record after no more than 180 days. We store website backups for 14 days.

6. Sharing with third parties (Processors & Sub-processors)

Eenvoud Media B.V. does not sell your data to third parties. We only share data where necessary for the performance of our agreement or to comply with a legal obligation. With companies that process your data on our instructions, we conclude a data processing agreement.

Key partners we work with are:

Hosting & Cloud Infrastructure:
- Google Cloud Platform / AWS / DigitalOcean: For hosting custom applications, databases and back-ups. Where possible, data is stored within the EEA (European Economic Area).
AI Providers:
- Google (Vertex AI/Gemini) / OpenAI: For processing data within our AI integrations.
- Anthropic (Claude): For looking up companies and preparing draft reports for online scans. The processor is Anthropic Ireland, Limited, because we are established in the EEA. Transfers to the United States are based on standard contractual clauses.
Office tools & Communication:
- Google Workspace: For email, calendar and file storage.
- Moneybird: For accounting and invoicing.
- Brevo: For newsletters.
- Pipedrive: For recording and following up leads from contact forms, request forms and online scans in our CRM.
- Mailgun: For sending email from this website, such as the report of an online scan and the notification to us.
- Project management tools: (E.g. Jira/Linear) for managing tasks around your project.
Analytics:
- Plausible Analytics (EU): For visitor statistics on our own website. Plausible sets no cookies, does not track you across websites and does not store your IP address.
- Google Ireland Limited: For Google Analytics 4, Google Ads and measuring which enquiries become projects (section 2F), only after your consent through the cookie layer. Google also processes data in the United States. See section 8 for the details.

7. Your rights

You have the right to access, correct or delete your personal data. You also have the right to withdraw any consent you have given for the data processing or to object to the processing of your personal data by Eenvoud Media B.V., and you have the right to data portability.

You can send a request for access, correction, deletion or data transfer to hello@eenvoud.nl. To be sure that the request was made by you, we may ask for proof of identity. We will respond to your request as quickly as possible, but within four weeks.

8. Cookies

Our own visitor statistics run through Plausible Analytics (EU). This works without cookies. We see which pages are visited, which referring website someone arrives from and what kind of device they use. Your IP address is used to tell individual visits apart, but it is not stored: it passes through a one-way calculation with a key that changes every day. The basis for this is our legitimate interest in knowing how our site is used.

For Google Analytics 4 and Google Ads, we first ask for your consent through the cookie layer. Until you make a choice, or if you reject everything, we load nothing from Google: no script, no cookie and no request to Google. Google Tag Manager only loads after you choose statistics, advertising measurement or tailored ads, and only for that purpose. Google Analytics is set up without Google Signals and with a 14-month retention period for event data. Google Analytics only uses your visit for advertising if you choose tailored ads.

With Google Analytics 4 and Google Ads, Google receives visited pages, the referring website, device and browser type and a general location based on IP address. With Ads, Google also receives whether a form has been submitted and reads the click ID (gclid) from the web address. We do not send names, email addresses or form content. The recipient is Google Ireland Limited. Google also processes data in the United States; Google LLC is certified under the EU-US Data Privacy Framework.

If you also choose tailored ads, Google uses your visit to eenvoud.nl to show you our ads on other websites (remarketing). For this, Google places cookies, including on its own domain doubleclick.net. Without that choice, we do not use your visit for tailored ads.

These cookies may appear on eenvoud.nl:

Cookie	Set by	Purpose	Retention
eenvoud_consent	Eenvoud Media B.V.	remembering your choice in the cookie layer, so we do not ask every time	6 months
_ga and _ga_*	Google	counting visits and viewed pages in Google Analytics 4	2 years
_gcl_au	Google	measuring whether a visit through an advertisement leads to contact	90 days
IDE (on doubleclick.net)	Google	showing tailored ads on other websites (remarketing)	13 months
WordPress login cookies (administrators only)	WordPress	keeping you signed in as an administrator	depends on your login session

You can change or withdraw your consent at any time through the “Cookie settings” link at the bottom of every page. If you withdraw your consent, measurement stops. If you withdraw your consent to statistics, we also delete the links for enquiries you made from this browser and send nothing more to Google for them (section 2F). Google cookies that we can remove are removed immediately. Cookies that we cannot remove expire automatically.

If you log in as an administrator of this website, WordPress places functional cookies to keep you signed in. These are necessary for logging in itself and do not apply to ordinary visitors.

9. Changes

The world of software and data changes fast. We reserve the right to amend this privacy statement. Changes will be published on this website. It is advisable to consult this statement regularly, so that you are aware of these changes.

Contact details:

Eenvoud Media B.V.
Frederik Hendrikstraat 23
1052 HJ Amsterdam

hello@eenvoud.nl