Privacy Policy

1. Who we are

The controller responsible for the processing described in this Privacy Policy is:

A trade name alone does not identify a controller, so throughout this policy "NLVentureDesk" refers to HR Hands B.V. NLVentureDesk normally acts as an independent controller for its advisory, immigration-preparation and facilitation activities. We have not appointed a statutory Data Protection Officer; privacy questions can be directed to the contact above.

2. Scope and who this policy covers

This policy applies to personal data we process about:

• visitors to our website;
• people who use our online eligibility check;
• people who subscribe to our checklist, guidance emails or event updates;
• Strategy Session prospects and attendees;
• clients and prospective clients;
• founders participating in our facilitation programme;
• representatives, family members, co-founders and other individuals whose information appears in a client file;
• provider and professional-network contacts; and
• participants at our events.

Where you are introduced to, or work with, an external provider (for example a lawyer, notary, accountant, bank or relocation provider), that provider's own privacy notice governs the personal data it processes as a separate controller. This policy covers our own processing, not theirs.

3. Categories of personal data we process

Depending on how you interact with us, we may process the following categories of personal data. Not all of these apply to every person — website visitors, for example, are covered only by the technical and communication data.

• Identity data: name, date and place of birth, nationality, and passport or identification details.
• Contact data: email address, phone number, postal address and country of residence.
• Immigration data: immigration history, current visa or residence status, residence history, V-number and application information.
• Family data: details of a spouse, partner, children or dependants where relevant to an application.
• Financial data: means-of-support evidence, source-of-funds information, invoices and payment status.
• Professional and business data: CV, qualifications, employment history, company ownership and shareholder information, intellectual property, financial projections, pilots and business plans.
• Government correspondence: communications with the IND, RVO, embassies, consulates and municipalities.
• Compliance and integrity data: information relevant to facilitator suitability, sanctions screening, fraud prevention and identity verification.
• Special-category data (for example health information) and criminal-conviction or offence information, but only where necessary for an immigration application — see section 6.
• Technical data: IP address, browser and device characteristics, log data and cookie data.
• Marketing and communication preferences.

Where you upload documents to us as part of a client file, those documents may contain additional personal data about you and about other people. Please share only what is necessary for the service you have asked us to provide.

4. Where we get your data

We obtain personal data from:

• you directly, when you contact us, subscribe, book, or provide documents;
• your authorised representative, your company or your co-founder;
• public registers such as the KVK, and public professional profiles;
• the IND, RVO, embassies, consulates or other authorities;
• external advisers or providers involved in your matter;
• referral partners; and
• our website and booking systems.

If you provide us with information about other people — for example family members, dependants or co-founders — you should make sure they are aware of this policy and that you are entitled to share their information with us.

5. Purposes and legal bases

We only process personal data where the GDPR gives us a legal basis to do so. The table below sets out the main purposes and the legal basis we rely on for each.

Where we rely on legitimate interests, we balance those interests against your rights and freedoms; you can ask us for more information about that balancing exercise. Consent is not the general basis for our client relationship — most core processing is necessary to take pre-contractual steps or to perform our agreement with you.

6. Sensitive and criminal-history information

Some immigration matters require special-category data (such as health information) or information about criminal convictions or offences. We only process this information where it is genuinely necessary for your application or engagement, and only to the extent required.

• For special-category data, we rely on the condition that processing is necessary for the establishment, exercise or defence of legal claims, and/or on your explicit consent, in accordance with Article 9 GDPR and applicable Dutch law.
• For criminal-conviction or offence information, we process it only where permitted under Article 10 GDPR and the Dutch GDPR Implementation Act (UAVG), for example where it is required as part of an immigration application.

Please do not send us sensitive information unless we have asked for it or it is necessary for your matter.

7. Information you must provide, and optional information

Certain information is necessary to assess eligibility, prepare an application, perform our agreement or satisfy government requirements. If that information is not provided, we may be unable to provide the relevant service or to continue the engagement. Other information, including your marketing preferences, is optional and you can decline to provide it without affecting the service you receive.

8. Who we share your data with

We do not sell your personal data. We share it only where necessary, with the following categories of recipient:

• the IND and RVO;
• Dutch embassies, consulates and diplomatic missions;
• municipalities, the KVK and other government bodies;
• immigration lawyers and other legal advisers;
• notaries, accountants, bookkeepers and tax advisers;
• banks, insurers, business-address providers and relocation providers — only after appropriate involvement of, or permission from, the client;
• technology vendors providing IT hosting, cloud storage, email, CRM, project management, e-signature, scheduling, video-meeting and document-processing services;
• payment processors (for example Stripe);
• regulators, courts, insurers and professional advisers where necessary; and
• a successor entity in the event of a merger, sale or restructuring, subject to appropriate safeguards.

Information about providers in our professional network will not be shared without prior permission except where sharing is required, permitted, or reasonably necessary to deliver the services.

9. Our role: controller and processor

For our direct advisory, application-preparation and facilitation services, we generally determine why and how personal data is processed and therefore act as an independent controller. External professionals (such as lawyers, notaries and accountants) act as separate controllers for the services they provide. Technology vendors that process personal data solely on our instructions act as processors under appropriate data-processing terms.

10. International transfers

Our clients are international, and some of the technology providers we use may process personal data outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we rely on an appropriate safeguard, such as a European Commission adequacy decision or the EU Standard Contractual Clauses, together with any additional measures that may be required.

You can request more information about the safeguards that apply to a particular transfer by contacting us at [email protected].

11. How long we keep your data

We keep personal data only for as long as we need it for the purposes described in this policy, and then delete or anonymise it. The periods below are indicative and are reviewed periodically; specific statutory obligations may require longer retention.

Given the sensitivity of immigration dossiers, we do not keep records indefinitely "for future reference".

12. How we protect your data

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration or disclosure. These measures are reviewed in light of the nature of the information, the risks involved in processing it, and the services we use. No system can be guaranteed to be completely secure.

13. Your rights

Subject to the conditions and exceptions in the GDPR, you have the right to:

• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data erased, where applicable;
• restrict our processing of your data;
• object to processing, including profiling, based on our legitimate interests;
• receive certain data in a portable format, where applicable;
• withdraw consent at any time, without affecting processing carried out before withdrawal;
• object to direct marketing at any time; and
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

To exercise any of these rights, contact us at [email protected]. We may need to verify your identity before responding, and we will respond within the period required by law. If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

14. Preliminary eligibility tools

Our website may provide preliminary, rules-based eligibility indications. These results are informational only, are not immigration decisions, and are not used by us to make solely automated decisions producing legal or similarly significant effects. A human assessment is always required before we accept a client or recommend a route.

15. Marketing communications

Where you ask for our Startup Visa checklist, or opt in to guidance emails or event updates, we use your name and email to send you those materials. We offer these as separate choices, so that you can receive the checklist without also signing up for unrelated marketing:

• delivery of the checklist you requested;
• occasional Dutch Startup Visa guidance; and
• founder-event updates.

You can unsubscribe from marketing at any time using the link in any marketing email, or by contacting us. Unsubscribing does not affect service-related communications about a booking or engagement. If you unsubscribe, we may keep a minimal suppression record so that we can honour your opt-out.

16. Cookies and consent

We use cookies and similar technologies. Cookies that are strictly necessary for the site to function are always active. Non-essential cookies — analytics and advertising — are set only where you have given consent, which you can give, refuse or change at any time using the cookie banner or the Cookie Settings control. Our third-party services are:

• Cloudflare Turnstile (necessary — bot protection). When you interact with a form, Turnstile may collect information about your device and connection (such as IP address and interaction signals) to distinguish humans from bots. We rely on our legitimate interest in securing our forms. Cloudflare states it does not use Turnstile data to build advertising profiles or to track you across sites. See the Cloudflare Turnstile Privacy Policy.
• Google Analytics (analytics — consent). Helps us understand how visitors use the site. It runs with Google Consent Mode: analytics storage is denied by default and enabled only with your consent. See the Google Privacy Policy.
• Reddit Pixel (advertising — consent). Measures the effectiveness of our advertising by recording actions such as page views and form submissions. It runs only where you have accepted advertising cookies. See the Reddit Privacy Policy.
• Resend (email delivery — necessary/contract). When you submit a form, your name and email are processed by our email provider, Resend, to send you the requested emails and notify our team. See the Resend Privacy Policy.
• Zeeg (booking — necessary/contract). Our Strategy Session bookings use the Zeeg scheduling widget, which processes the details you enter to schedule your session. See the Zeeg Privacy Policy.

17. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated where appropriate. The date at the top of this page shows when it was last updated. Continued use of the site does not, by itself, amount to consent to new processing where consent is required.

Contact us

For any question about this Privacy Policy or your personal data, contact:

HR Hands B.V. (NLVentureDesk) — [email protected]
Rietwijkerstraat 42-3, 1059 XB Amsterdam, Netherlands