Privacy statement
Privacy statement
Version 2.2 | 23 September 2026
This privacy statement explains how De Startup Accountant B.V. processes personal data and protects your privacy, in accordance with the General Data Protection Regulation (GDPR) and Dutch data protection law.
It applies to visitors of our website, to our clients and their contact persons, to individuals whose personal data we process when performing bookkeeping and accounting services for our clients, and to applicants for positions with us.
Who we are
De Startup Accountant B.V. is the controller for the processing described in this statement, except where we act as a processor on behalf of our clients (see “Data we process for our clients” below).
- Office
- Varrolaan 100, 3584 BW Utrecht, the Netherlands
- info@destartupaccountant.nl
- Website
- destartupaccountant.nl
We have not appointed a Data Protection Officer; given the nature and scale of our processing this is not required under Article 37 GDPR. For any privacy question you can use the details above.
The personal data we process and why
We process personal data only where we have a lawful basis to do so. Below we explain this per category of individual.
Visitors to our website
Our website uses only strictly necessary and functional browser storage and, with your consent, privacy-friendly analytics. It does not use advertising or cross-site tracking cookies. We store your cookie choice in your browser, and if you log in to our secure client or investor portal your session is kept in your browser via our authentication provider. With your opt-in consent we use Plausible, a cookieless analytics tool that processes only aggregated data within the EU. Our website is hosted by Netlify, which processes technical data such as IP addresses in server logs for security and availability, and which loads a small script on each page that measures how quickly the page renders. That script stores nothing on your device. We process visitor data on the basis of our legitimate interest (Article 6(1)(f) GDPR) in a secure and functioning website and, for analytics, on the basis of your consent (Article 6(1)(a) GDPR).
People who contact us
If you contact us by email or otherwise, we process your name, contact details and the content of your message in order to handle your enquiry. The basis is our legitimate interest in responding to you and, where relevant, taking steps at your request prior to entering into an agreement (Article 6(1)(b) and (f) GDPR).
Clients and their contact persons
To provide our bookkeeping, accounting and tax-filing services we process personal data of our clients and their contact persons, such as names, job titles, business contact details and correspondence. We process this data to perform our engagement and provide the agreed services (Article 6(1)(b) GDPR), to communicate and administer our business, and to comply with legal obligations such as administrative and tax retention duties and the client due diligence requirements under the Anti-Money Laundering and Anti-Terrorist Financing Act (Wwft) (Article 6(1)(c) GDPR).
Data we process for our clients (as processor)
When we perform bookkeeping and accounting services, we process personal data contained in our clients' administration on their documented instructions, for example data relating to our clients' own employees, customers and suppliers, such as names, contact details, payment and invoicing data, and where relevant salary or bank details. For this processing our client is the controller and we act as a processor within the meaning of the GDPR. It is governed by a separate data processing agreement with each client; this privacy statement does not apply to it, and the client's own privacy policy applies to those individuals.
Job applicants
If you apply for a position with us, we process your contact details, CV, motivation and other information you provide, in order to assess your application and communicate with you. The basis is taking steps prior to a possible employment relationship and our legitimate interest in recruitment (Article 6(1)(f) GDPR). Where we retain your data after the procedure ends, we do so on the basis of your consent (Article 6(1)(a) GDPR). We retain application data for no longer than 4 weeks after the procedure ends, or up to 1 year with your consent.
How we obtain personal data
We obtain personal data directly from you, from our clients including the documents and administration they provide to us, and from publicly available sources such as the Chamber of Commerce register and company websites, where relevant to our services.
International transfers
Personal data are processed within the European Economic Area where possible. Yuki processes data within the Netherlands and the EEA, and Supabase within the EEA (Frankfurt, Germany). Where a service provider such as Microsoft 365 or Netlify processes data outside the EEA, we ensure appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses.
Retention
We retain personal data no longer than necessary for the purposes for which they were collected, or as required by law. We retain administrative and financial records for the statutory period, in principle seven years under Dutch tax law. Client and engagement records are retained for seven years, in line with our agreement and statutory duties. Where the Wwft applies, client due diligence records are retained for five years after the engagement ends. After the retention period the data are deleted or anonymised.
Security
We take appropriate technical and organisational measures to protect personal data against loss and unlawful processing, including access controls, confidentiality obligations and secure systems.
Your rights
Under the GDPR you have the right to access, rectify, erase, restrict or object to the processing of your personal data, the right to data portability, and the right to withdraw consent where processing is based on consent. To exercise these rights, contact us using the details above.
If you are not satisfied with how we handle your data, you may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).
Changes to this statement
We may update this privacy statement from time to time. The current version and its date are shown at the top of this page.
Contact
For questions about this statement or about how we process your personal data, contact us at info@destartupaccountant.nl, De Startup Accountant B.V., Varrolaan 100, 3584 BW Utrecht, the Netherlands.