Skip to content

Cookie settings

Choose for each type of cookie whether you give your consent. You can change or withdraw your choice at any time via Cookie settings at the bottom of every page.

Call 06 34241346
Quote request

Privacy notice⁠

This notice explains which personal data P.M. Stadbouw uses, why and for how long, and what rights you have. It applies to visitors to our website, to anyone who contacts us and to our clients.

If this translation differs from the Dutch text, the Dutch text prevails.

Last updated on 28 September 2026

1. Who we are and how to reach us

P.M. Stadbouw is a building and renovation company in Rijswijk (Zuid-Holland). We are a general partnership (vof), registered with the Netherlands Chamber of Commerce (KVK) under number 86025538.

We are the controller for the data covered by this notice. This means: we decide what your data is used for and how, and you can hold us to account for that.

If you have a question about your data, or would like to exercise one of your rights, please contact Pavlo Stadnyk:

2. Why we are allowed to use data

Personal data is information that says something about you as a person, such as your name, your phone number or the address where we are working. The General Data Protection Regulation (GDPR, in Dutch AVG) only allows such data to be used for a valid reason. Such a reason is called a legal basis. We use four:

  • Contract: the data is needed to prepare a quote (offerte) or to carry out a job. This also applies if you ask us for a quote and there is no job yet.
  • Legal obligation: the law requires us to keep data, such as our financial records for the Dutch Tax and Customs Administration (Belastingdienst).
  • Legitimate interest: we have a reasonable interest of our own that outweighs the intrusion on your privacy. Each time we use data on this basis, we state which interest it is.
  • Consent: you give us your consent in advance and separately. You can always withdraw it.

The sections below set out, for each situation, which data we use, for what purpose and on which legal basis.

3. Website and forms

When you visit our website, our hosting provider Netlify processes technical data, such as your IP address. This is needed to display the pages and to secure the site. Legal basis: legitimate interest, namely a website that works and is secure.

Through the contact form we receive your name, email address, phone number and message. Your name, email address and message are required: without them we cannot answer your question. Your phone number is optional.

Through the quote form we receive the subject of your request, your description, any attachments (up to three photos or PDFs), the address, postcode and town of the work, your name, email address and phone number, and how you would prefer to be contacted (phone, WhatsApp or email). If you come from the page of a particular service, that service is also included in the request. We only use it to categorise your request.

Your description, town, name and email address are needed for us to prepare a quote. If you choose phone or WhatsApp, we also need your phone number. The other fields and the attachments are optional. If you leave them empty, we will still help you, but we may ask a few extra questions.

Purpose: to answer your question, prepare a quote, contact you through the channel you choose and, if necessary, arrange a visit. Legal basis: contract, if your question is about a job. For other questions, and if you contact us on behalf of a company, the legal basis is legitimate interest: we want to be able to answer questions and keep in touch with business contacts.

Photos of your home may also show people, a house number or your interior. It is therefore best not to photograph people. We only use attachments for the quote and the job.

With every submission, Netlify also records technical data, such as your IP address, your browser and the page from which you sent the form. All form submissions automatically pass through a spam filter (see section 8). Legal basis: legitimate interest, namely protecting ourselves against spam and misuse of the forms.

4. WhatsApp, phone and email

You can also call, WhatsApp or email us. We use what you tell us or send us to answer your question and to make arrangements with you.

  • Phone: we see your number and, if necessary, note your name and what the call was about.
  • WhatsApp: we receive your number, the name you use in WhatsApp, and the messages, photos and files you send.
  • Email: we receive your email address, your name and your message, with any attachments.

Legal basis: contract, if it concerns a quote or a job. For other questions, and for contact persons at companies, the legal basis is legitimate interest: answering questions and keeping in touch with our contacts.

WhatsApp and email run through services provided by other companies. You can read more about this in section 8.

5. Quote, job and carrying out the work

When we prepare a quote or carry out a job, we process the following data:

  • your name and contact details, and the address of the work location;
  • a description of the work and the arrangements we make;
  • additional work (meerwerk) and omitted work (minderwerk): work that is added or dropped during the job;
  • the schedule;
  • written warnings: for a building structure, the law requires us to warn you in writing about errors we notice in the instructions for the job, the drawings or the materials you supply;
  • photos and drawings of the situation and of the work.

Purpose: to prepare the quote and to plan the work, carry it out and hand it over (opleveren). Legal basis: contract. Without this data we cannot prepare a quote or carry out the work. For contact persons at business clients, the legal basis is legitimate interest: we need to be able to discuss the work with them.

If we would like to show a photo of your project on our website or elsewhere, we will first ask for your separate consent. Legal basis: consent. You are not obliged to give it, and you can always withdraw it. We will then remove the photo and no longer use it.

6. Records and invoices

For invoices and payments we process your name and address, the details of the job, the amounts and the payments we receive from you. Without your name and address we cannot issue an invoice. The law requires us to keep these records for 7 years. Legal basis: legal obligation.

If we engage a bookkeeper or accountant, they have access to our records to the extent necessary. The Dutch Tax and Customs Administration can inspect our records during an audit.

7. Data we receive through others

Sometimes we receive data from someone other than you. For example from a tenant or landlord, a neighbour, the manager of an owners’ association (VvE), a contact person on the building site or a building contractor who engages us. This usually concerns your name, phone number, email address and the address where we are working.

We only use this data for the work for which we received it. Legal basis: legitimate interest, namely being able to coordinate the work with the people involved. If we have received your data in this way, we will let you know no later than our first contact with you.

8. Who receives your data

We only share your data with parties we need for our work. Some of these parties are processors: a party that processes data for us, in line with our agreements, and may not use it for its own purposes. Those agreements are set out in a data processing agreement.

  • Netlify, Inc. (United States) hosts our website and receives and stores the form submissions, including the attachments. Netlify is our processor; the agreements are set out in Netlify’s data processing agreement. Netlify itself also engages other parties, such as cloud storage and the spam filter Akismet from Automattic Inc. (United States). Akismet checks all form submissions for spam.
  • Neostrada (Your Hosting B.V., the Netherlands) provides our email (info@pmstadbouw.nl): Neostrada stores our messages and sends them for us. Neostrada is our processor; the agreements are set out in the data processing agreement included in Neostrada’s terms and conditions.
  • WhatsApp Ireland Limited, part of Meta, provides WhatsApp. WhatsApp encrypts the content of messages end-to-end: only the sender and the recipient can read them. WhatsApp does process data about your account and your use of the app, in accordance with WhatsApp’s privacy policy.
  • A bookkeeper or accountant, if we engage one, for our records.

We do not sell your data and do not give it to others for their own advertising.

9. Transfers outside Europe

Our email provider Neostrada is based in the Netherlands, within the European Economic Area (EEA): the countries of the European Union plus Iceland, Liechtenstein and Norway. Netlify, Akismet and WhatsApp (Meta) may also process your data in the United States, outside the EEA. This is only allowed if your data is properly protected there.

For the United States, the European Commission has adopted an adequacy decision for this purpose: the EU-US Data Privacy Framework. Under that decision, US companies that join this framework offer an adequate level of protection. Netlify participates in it. If this framework ceases to apply, the standard contractual clauses of the European Commission apply. These are fixed agreements on data protection, which are included in the data processing agreement with Netlify.

Automattic (Akismet) works on behalf of Netlify. By law, Netlify must make the same data protection agreements with Automattic as we have with Netlify. WhatsApp (Meta) explains in its own privacy policy which safeguard it uses, such as the Data Privacy Framework or the standard contractual clauses. You can check for yourself whether a US company participates in the Data Privacy Framework on the list of participants. If you would like to know more about these safeguards, or would like a copy of the agreements with Netlify, please contact us.

10. How long we keep data

We do not keep data for longer than necessary. We use the following retention periods:

  • Technical data at Netlify: no longer than necessary for the operation and security of the website.
  • Form submissions at Netlify: no longer than the period below that applies to your question, request or job.
  • Questions and requests that do not lead to a job: no later than 12 months after the last contact. We delete photos and other attachments after only 6 months.
  • Quotes that do not lead to a job: 12 months after the date of the quote.
  • Messages via WhatsApp and email, and notes of phone calls: as long as the file they belong to. We delete one-off conversations with no follow-up after 12 months.
  • Jobs, invoices, payments and the rest of our records: 7 years, counted from the end of the financial year. The law requires us to keep our records for 7 years.
  • A limited project file: up to 20 years after the handover for a building structure and up to 10 years for other work.
  • Project photos that we show with your consent: until you withdraw your consent.

In the project file we keep only the job details, the drawings, the materials and specifications chosen, the file we hand over to you for a building structure, written warnings, photos of the work being carried out and messages about defects.

Why so long? By law, you can hold a building contractor liable for defects in a building structure for up to 20 years after the handover, and for up to 10 years for other work. With the file, we can then assess a complaint properly and defend ourselves if necessary. Legal basis: legitimate interest. You can object to this, see section 15.

11. How we protect your data

We take appropriate technical and organisational measures to protect your data against loss, theft and unauthorised use. For example:

  • The website and the forms use a secure connection (https).
  • Access to your data is limited to those who need it for your question, quote or job.
  • We do not keep form submissions for longer than the periods in section 10.

If something does go wrong with your data (a data breach), we report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) where necessary. If this puts you at high risk, we will let you know as soon as possible.

12. Cookies and storage in your browser

A cookie is a small file that a website stores in your browser. Our website currently places one cookie: pm_toestemming. It stores your choice from the cookie banner, with the date and the version of the banner. The cookie remains for 12 months. After that, or if the banner changes, we ask for your choice again.

We only place cookies for statistics and marketing if you consent to this in the cookie banner. With statistics cookies we measure how visitors use the site. With marketing cookies we measure whether our advertisements work and tailor advertisements to your visit to our site. Without your consent, we also do not load any scripts from such services. Legal basis: consent.

At present we do not use such cookies. If we start using a service for statistics or marketing, this section will state which service it is, who provides it, what we use it for and how long the cookies remain. We do not embed maps or videos from other parties, and the font comes from our own website.

You can change or withdraw your choice at any time, and just as easily as giving consent. Choose Cookie settings at the bottom of any page. There you can see what you have chosen for each type of cookie and switch a type on or off. If you choose Necessary only, all consent is withdrawn at once. You can also delete cookies yourself in your browser settings. We will then ask for your choice again on your next visit.

If your browser sends the Global Privacy Control signal, Marketing is switched off. Only if you switch Marketing on yourself in the cookie settings do you give consent for it.

In addition, your browser stores, for each page you visit, the position you had reached on that page. This happens in sessionStorage, temporary storage in your browser. If you go back to a previous page, you return to the same position. This data is not sent to us or to anyone else and disappears when you close the tab.

The pm_toestemming cookie and this temporary storage are needed to make the site work as you request: remembering your choice and returning you to the right position. That is why, under the Dutch Telecommunications Act (Telecommunicatiewet), no consent is needed for them.

If you click a link to WhatsApp, you go to a service provided by WhatsApp (Meta). The rules of WhatsApp apply there.

13. What we do not do

  • We do not use your data for newsletters or advertising.
  • We do not take decisions about you that are made solely by a computer. Only the spam filter on our forms works automatically: it sets aside messages that look like spam. If you do not hear from us after sending a request, please call us or message us on WhatsApp.
  • We do not create a profile of you. Profiling means using a computer to assess personal characteristics, such as your preferences or behaviour.

14. Your rights

You have the following rights regarding your data:

  • Access: you have the right to know what data we hold about you and what we do with it.
  • Rectification: if your data is incorrect, we will correct it.
  • Erasure: you can ask us to delete your data.
  • Restriction: you can ask us to stop using your data temporarily, for example while we check whether it is correct.
  • Portability: you can ask for data that you gave us yourself for a quote or job, or with your consent, in a commonly used digital file, or have it sent on to someone else.
  • Objection: you can object to use on the basis of legitimate interest. You can read more about this in section 15.
  • Withdrawing consent: if you have given us consent, you can always withdraw it. What we did with your data before you withdrew it remains permitted.

Would you like to exercise a right? Call, WhatsApp or email us using the details in section 1. We will respond as quickly as possible and in any case within one month. If your request is complex, or if we receive many requests, it may take two months longer. We will then let you know within the first month.

A request costs you nothing. Only if we have doubts about whether the request really comes from you will we ask for additional information.

Sometimes we cannot delete data straight away. This applies to the records we are required by law to keep, and to data we need in a dispute or claim, such as the project file.

15. Your right to object

If we use your data on the basis of legitimate interest, you can object to this at any time on grounds relating to your personal situation. This applies, among other things, to your data as a contact person at a company, to the technical data from your visit to our website, to the spam check on the forms, to data we receive through others and to the project file that we keep for longer.

If you object, we will stop that use. The only exceptions are if we have compelling reasons that outweigh your interests, rights and freedoms, or if we need the data in a dispute or claim. In that case we will explain to you why.

16. Making a complaint

Are you unhappy with how we handle your data? Feel free to let us know first, and we will look for a solution together. You may also make a complaint directly to the supervisory authority, the Dutch Data Protection Authority.

17. Changes to this notice

We update this notice when our work, our website or the law changes, for example the rules for transfers to the United States. The top of this page shows when the notice was last updated. So please check from time to time whether anything has changed.