Legal
Privacy statement
This statement is being reviewed by our legal adviser and may still change. Questions? Email harsimran@batthconsulting.com.
1. Who we are
This statement explains how Batth Consulting, a Dutch sole proprietorship (eenmanszaak) trading as Batth Studio, based in Hoofddorp, the Netherlands ("we", "us"), handles personal data. We are the controller for the processing described here.
For privacy questions, contact Harsimran (Sim) Batth at harsimran@batthconsulting.com. We have not appointed a data protection officer, because we are not required to.
2. What personal data we process
| Category | Examples | Source |
|---|---|---|
| Email correspondence | Name, email address, the content of your messages and attachments | You |
| Contact details | Name, company, role, email, phone, LinkedIn profile, notes of our conversations | You, or public professional sources |
| Client and invoicing data | Name, company, billing address, KVK and VAT number, invoices, payment details | You or your company |
| Project data | Names and work email addresses of your staff on a project, access logs of shared tools | You or your company |
We do not intentionally collect special categories of personal data, such as health data. Please do not send these to us.
3. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR article 6) |
|---|---|
| Answering your questions and preparing a proposal | Steps before a contract (6(1)(b)), or legitimate interest (6(1)(f)) |
| Delivering our services and managing projects | Performance of a contract (6(1)(b)) |
| Invoicing, bookkeeping and tax records | Legal obligation (6(1)(c)) |
| Keeping in touch with business contacts about relevant services | Legitimate interest (6(1)(f)). You can object at any time. |
| Protecting our legal position in a dispute | Legitimate interest (6(1)(f)) |
Where we rely on legitimate interest, we have weighed it against your interests. You can ask us for that assessment.
4. Who receives your data
We do not sell personal data. We share it only with service providers that process it for us under a data processing agreement, or where the law requires it.
| Recipient | Role | Location |
|---|---|---|
| Website hosting and security: Cloudflare, Inc. | Processor | United States and EU (see section 5) |
| Our email and office software provider | Processor | EU or United States (see section 5) |
| Our accountant | Processor or independent controller | Netherlands |
| Our engineering team in India | Sub-processor, only for client project work where needed | India |
| Tax authority (Belastingdienst), courts and regulators | Recipient where the law requires it | Netherlands |
5. Transfers outside the European Economic Area
We transfer personal data outside the EEA only where needed to deliver our services. In that case we rely on safeguards recognised by the GDPR, such as the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses, with additional measures where needed. For client projects, production personal data stays in EU hosting, and our team in India works with masked or synthetic data. You can ask us for a copy of the safeguards.
6. How long we keep it
| Data | How long |
|---|---|
| Invoices and financial records | 7 years after the end of the financial year (Dutch tax law) |
| Contracts and project correspondence | The duration of the contract plus 5 years |
| Contact details of prospects without a contract | Up to 2 years after our last contact, unless you ask us to delete them sooner |
| Emails not linked to a project or client | Up to 12 months |
7. Security
We use single sign-on and multi-factor authentication, least-privilege access, encrypted devices and EU hosting where possible. If a data breach is likely to put you at risk, we notify the Autoriteit Persoonsgegevens within 72 hours and inform you where required.
8. Your rights
You have the right to:
- see your data and get a copy
- have inaccurate data corrected
- have your data deleted
- restrict how we use your data
- object to processing based on legitimate interest, including business contact
- receive your data in a portable format, where processing is based on a contract
- withdraw consent, where we asked for it
Email harsimran@batthconsulting.com to use any of these rights. We reply within one month and may ask you to confirm your identity.
9. Complaints
Please contact us first. You also have the right to complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
10. Cookies and website data
No tracking. This website sets no cookies of its own and uses no analytics, tracking pixels or advertising tools. That is why there is no cookie banner.
Fonts. All fonts are hosted on our own website. Your browser does not contact Google or any other font service.
Hosting and security. The site is delivered by Cloudflare. To deliver pages and protect the site against attacks, Cloudflare processes technical data such as your IP address and browser type, and may set a strictly necessary security cookie when it detects suspicious traffic.
If we ever add analytics or other cookies that are not strictly necessary, we will ask for your consent first and update this statement.
11. Changes
We may update this statement. The date at the top shows the latest version.
← Back to the homepage