If the English and Dutch texts differ, the Dutch text applies.
1. Who processes your data
STS Strategy (trade names Emigratieplan and ResidencyPlanner) is the controller of the personal data that I process. In article 2 I explain exactly which data that is and which data I do not see.
- Chamber of Commerce (KvK) number: 99794845
- Email for privacy questions: kevin@emigratieplan.nl
My business address can be requested from the KvK trade register (kvk.nl) or by email.
I have no legal obligation to appoint a Data Protection Officer.
2. Which data I process and which I do not
Your financial input is calculated, not stored.
The financial data you enter in the Tool (income, assets, pension, property, household composition, scenario settings) go to my calculation function with every calculation. It runs at Vercel in the EU (Dublin), works out the result and sends it back to your browser. The calculation function does not store your input or the result: not in a database, not in a file and not in a log. While you fill in the Tool, a few separate data items also go to the same function, such as your year of birth, the countries you choose and separate amounts such as a WOZ value (the Dutch property tax value), for example to work out your state pension (AOW) age. I cannot see that data. After the calculation, your input and your result exist only in your browser tab. You can export your scenarios locally to a JSON file, to keep them yourself or to share them with your adviser.
I record that you accepted the disclaimer, not what you filled in. Before you start in the Tool, and with every click on "Calculate my outcome", you confirm that the Tool gives no tax advice. I record that agreement, with the time and a fingerprint of your input. Your answers cannot be recovered from that fingerprint.
What I do process:
| Category | Examples | Purpose |
|---|---|---|
| Account data | Email address, first name | Logging in, access to the Tool, communication |
| Purchase data | Which package you bought (Compare, Explore or Decide), order ID, purchase date, affiliate code where applicable | Granting access, licence management, administration |
| Payment data | Purchase amount, invoice details | Administration via Stripe, tax retention obligation |
| Session and technical data | IP address, browser type, login moments | Security, troubleshooting, fraud prevention |
| Proof of your agreement to the disclaimer | One line for each agreement and each click on "Calculate my outcome": your user ID, the time, whether it was about the start, a calculation, or your confirmation at purchase that you are buying one version with a fixed reference year, which version of the disclaimer text you saw (a fingerprint of that text, and the language), which version of the Tool calculated, and, for a calculation, a fingerprint (SHA-256) of your input. No answers, no amounts, no IP address | Showing that you accepted the disclaimer and, if you later show me your saved file yourself, that the Tool calculated with exactly that input |
| Reviews | Score, title, text, first name, package, email address, your consent to publication | Publishing a review and checking that you are a customer |
| Withdrawal declaration | Name, order number, email address, date and time | Recording and confirming your withdrawal |
| Access log | Email address, Stripe references, event and time | Showing that access was granted and withdrawn |
| Cookies and local storage | See the Cookie statement | Functional |
| Usage statistics | Page visited, referring site, country, browser, type of device. No cookies, no IP address, no profile | Seeing which topics are read |
| Mailing data | Email address, first name, last name, subscription status, package bought | Newsletter, product emails, welcome series |
What I do not see:
- Your financial input. It only passes through my calculation function for the calculation, and is not stored there.
- Your scenarios and calculations. Of a calculation I only keep the fingerprint above.
- Your reports and Output.
I do not ask for a BSN (Dutch citizen service number), passport details or health information. Do not enter them either.
3. What I use data for and on what legal basis
| Purpose | Legal basis |
|---|---|
| Delivering the Tool, account access | Performance of a contract (Art. 6(1)(b) GDPR) |
| Payment and invoicing | Performance of a contract and legal obligation |
| Security and troubleshooting | Legitimate interest (Art. 6(1)(f) GDPR) |
| Proof of your agreement to the disclaimer | Legitimate interest (Art. 6(1)(f) GDPR): being able to show that you knew the Tool gives no tax advice |
| Transactional email (login, confirmations, support) | Performance of a contract |
| Welcome email and a series of five emails with the decision guides after purchase; you can unsubscribe at any time through the link in every email | Legitimate interest (Art. 11.7(3) of the Dutch Telecommunications Act, own customers) |
| Publishing a review and checking that you are a customer | Consent (Art. 6(1)(a) GDPR) |
| Recording and confirming your withdrawal | Legal obligation |
| Showing when you got access and when it ended | Performance of a contract and legal obligation (tax retention obligation) |
| Newsletter | Consent (Art. 6(1)(a) GDPR) |
| Usage statistics of the website (cookie-free, aggregated) | Legitimate interest (Art. 6(1)(f) GDPR) |
| Conversion measurement of advertisements (Meta pixel) | Consent through the cookie banner (Art. 6(1)(a) GDPR); without consent the pixel is not loaded |
You can withdraw your consent for email at any time through the unsubscribe link in every email. No consent is needed for the usage statistics, because nothing is placed on or read from your device. If you still want to object to that processing, you can do so via kevin@emigratieplan.nl.
4. Who I share data with
I never sell your data. I only share it with service providers who help me deliver the Tool.
| Party | Purpose | Location |
|---|---|---|
| Stripe | Payment processing (checkout and payment) | Ireland (EU) and US |
| Supabase | Authentication, account management, database (access, chosen countries, the proof of your agreement to the disclaimer, and the published reviews that the homepage fetches at every visit) | EU (Ireland) |
| Vercel | Hosting of the website and the Tool, and the calculation function that makes your calculation (without storing your input) | EU (the calculation function in Dublin); Vercel Inc. is based in the US |
| Vercel Web Analytics | Cookie-free usage statistics of the website | Vercel Inc., US |
| Resend | Sending the login links (magic link) | US |
| Brevo | Transactional email, newsletter, marketing automation (with your email address, first name, last name and the package you bought) and the sign-up form on the website | France (EU) |
| Groq | Translation of your review into English (title and text, without name or email address) | US |
| Meta (Meta Platforms Ireland Limited) | Conversion measurement of advertisements, only after consent in the cookie banner; see the Cookie statement | Ireland (EU) and US |
Where a data processing agreement applies, I have concluded one. For the payment flow, Stripe acts as payment processor; its own privacy terms apply alongside mine.
You can request the current list of suppliers via kevin@emigratieplan.nl.
5. Transfers outside the European Economic Area
Most of my processing stays within the EEA. In a number of cases data are transferred outside the EEA:
- Stripe has entities in the US. Transfers take place under the Standard Contractual Clauses (SCCs) of the European Commission and, where applicable, the EU-US Data Privacy Framework.
- Resend, which sends the login links, involves a transfer to the US. That takes place under the Standard Contractual Clauses of the European Commission.
- Groq, which translates reviews, involves a transfer to the US. That takes place under the Standard Contractual Clauses.
- Vercel. Vercel Inc. is based in the US. The website, the Tool and the calculation function run in the EU (the calculation function in Dublin). The statistics of Vercel Web Analytics contain no data that could identify you. Insofar as there is a transfer, the same regime applies.
- Meta. Only if you give consent in the cookie banner. Insofar as Meta passes data on to the US, this takes place on the basis of the Standard Contractual Clauses and the EU-US Data Privacy Framework.
You can request a copy of the safeguards used via kevin@emigratieplan.nl.
6. How long I keep data
| Category | Period |
|---|---|
| Account data (email address, package, chosen countries) | As long as you have access to the version you bought, or until you ask for deletion earlier |
| Order, invoice and payment administration | 7 years (the tax retention obligation, Art. 52(4) of the Dutch General Tax Act, Algemene wet inzake rijksbelastingen) |
| Proof of your agreement to the disclaimer | 5 years after your last agreement or calculation (the limitation period for a claim for damages, Art. 3:310 of the Dutch Civil Code). A request for deletion does not affect this proof while that period runs (Art. 17(3)(e) GDPR) |
| Newsletter data | Until you unsubscribe, after that a limited suppression list |
| Reviews | As long as the review is on the site; your email address up to one year after publication |
| Withdrawal declaration | 7 years, with the purchase administration |
| Access log | 7 years |
| Technical logs | Maximum 12 months |
| Cookie data | See the Cookie statement |
| Usage statistics | Aggregated, available for 30 days at Vercel. I also keep monthly totals for my own trend analysis |
I do not keep your scenarios and Input. The calculation function processes them only while a calculation lasts; after that they are only in your browser tab, or in a file you save yourself.
You can ask for your account data to be deleted earlier. I will do that, unless I am legally required to keep data longer.
7. Your rights
You have the right to:
- Access to your data
- Correction of incorrect data
- Deletion in the cases the law allows
- Restriction of processing
- Portability of data
- Objection to certain processing
- Withdrawal of consent
- Complaint to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl)
You submit a request via kevin@emigratieplan.nl. I respond within one month. I may ask you to confirm your identity.
A request for deletion does not affect the proof of your agreement to the disclaimer while the 5-year retention period runs: that proof is needed to support or defend a legal claim (Art. 17(3)(e) GDPR). You can inspect it.
8. Automated decision-making and profiling
The Tool makes automated calculations based on your Input. My calculation function makes those calculations, and it does not keep your Input. I make no decisions about you. The Tool does not fall under automated decision-making as meant in Article 22 GDPR.
9. Security
I take appropriate technical and organisational measures to protect your data:
- Encryption of data in transit (TLS).
- Access control through magic link authentication.
- Periodic security reviews.
Because I do not keep your financial input, it is only on your own device. That is where most of the security risk for that data lies.
In the event of a data breach that poses a high risk to your rights and freedoms, I inform you as soon as possible and report it to the Dutch Data Protection Authority within 72 hours.
10. Changes
I may change this privacy statement. The latest version is always on my website. For material changes I inform you by email.