Privacy Policy

1. Who are we and how can you reach us?

Verkoperslening B.V. is the data controller for the processing of your personal data within the meaning of the General Data Protection Regulation (GDPR).

2. No cookies, trackers or analytics scripts

We make a conscious choice not to track your online behaviour. The following elements are explicitly absent from our website:

• No tracking cookies. We do not place cookies that record or remember your browsing behaviour
• No Google Analytics, Matomo or similar statistics tools
• No Facebook Pixel, Google Ads or other advertising networks
• No retargeting or advertising profiling based on your visit
• No heatmap or session recording tools (such as Hotjar or Microsoft Clarity)
• No embedded social media scripts from Twitter/X, LinkedIn, Instagram or similar platforms
• No A/B testing tools or third-party personalisation scripts

Technical exception: Google Fonts

Our website uses fonts via the Google Fonts CDN. This technically transmits your IP address to Google's servers. This is solely for loading the fonts and has no marketing purpose. Google processes this IP address in accordance with its own privacy policy.

3. What personal data do we process?

We process only personal data that you actively and consciously enter via our registration forms. We do not collect data via cookies, tracking pixels or other passive methods.

4. Retention periods

We retain personal data no longer than strictly necessary for the purposes for which it was collected, and in accordance with applicable statutory retention periods.

After the retention period expires, personal data is securely and permanently deleted or anonymised in such a way that it can no longer be traced to a natural person.

5. To whom do we disclose your data?

We never sell your personal data to third parties. We do not share your data with advertisers, data brokers or commercial third parties. Disclosure to third parties only occurs in the following situations:

• Independent credit assessor: for the buyer's BKR credit check, only with your explicit consent
• Notary. for drawing up the loan agreement and registering the 2nd right of mortgage. The notary is an independent data controller
• FormSubmit (email processor): solely for technically forwarding contact forms. FormSubmit does not store submitted data
• Tax authorities and government agencies: only if legally obliged to do so
• Courts or supervisory authorities: if legally required or pursuant to a court order

6. Transfer outside the EEA

We strive to process your personal data solely within the European Economic Area (EEA). If processors outside the EEA are used, this is done solely on the basis of Standard Contractual Clauses (SCCs) approved by the European Commission, or on the basis of an adequacy decision.

7. Security of your personal data

We take the security of your data seriously and implement appropriate technical and organisational measures:

• HTTPS / TLS encryption: all connections use a secure encrypted connection
• Password security: passwords are stored as bcrypt hashes; we never store readable passwords in our back-end systems
• Access restriction: access to customer data is strictly limited to authorised employees on a need-to-know basis
• Form processing: submitted form data is forwarded immediately and not stored long-term on our web server
• Regular security audits. systems, access rights and software are periodically reviewed and updated
• Data breach procedure: in the event of a (suspected) data breach we follow an internal procedure and report to the Dutch DPA within 72 hours if legally required

8. Your rights as a data subject

•••. We will respond in principle within 4 weken." data-en="Under the GDPR, you have the following rights. You can submit a request via •••. We will in principle respond within 4 weeks.">Under the GDPR, you have the following rights. You can submit a request via

• Right of access (Art. 15 GDPR): you have the right to obtain access to the personal data we process about you and to receive a copy
• Right to rectification (Art. 16 GDPR): you have the right to have inaccurate or incomplete personal data corrected
• Right to erasure / right to be forgotten (Art. 17 GDPR): you have the right to have your personal data deleted, unless a statutory retention obligation or legitimate interest applies
• Right to restriction of processing (Art. 18 GDPR): you have the right to have the processing of your data temporarily suspended
• Right to data portability (Art. 20 GDPR): you have the right to receive your data in a machine-readable format and transfer it to another controller
• Right to object (Art. 21 GDPR): you have the right to object to processing based on a legitimate interest
• Right to withdraw consent: to the extent processing is based on your consent, you have the right to withdraw it at any time
• Right not to be subject to automated decision-making (Art. 22 GDPR). we do not use automated decision-making or profiling with legal effects

If you have a complaint, you have the right to lodge it with the Dutch Data Protection Authority (www.autoriteitpersoonsgegevens.nl) or the supervisory authority in your own EU member state.

9. Cookies and local storage

We do not use tracking or marketing cookies. Our website uses only functional local storage (localStorage) in your browser for:

• Language preference: your chosen language (NL or EN) is stored locally so you do not need to select it again on each visit
• Rate cache. the most recently retrieved ECB interest rate is stored locally for up to 24 hours to avoid unnecessary API requests
• These data never leave your browser. They are not sent to our servers

10. Changes to this privacy policy

We reserve the right to amend this privacy policy at any time. The most current version is always available on this page. For material changes, we notify clients with an active file by email at least 30 days before the change takes effect.