Privacy statement
Version 1.0, 22 October 2026.
This privacy statement explains which personal data ProcureMatters processes when you visit procurematters.com, request our free guide, ask for advice or a workshop, buy one of our tools or work with us as a client. It also explains why we do that, how long we keep the data and what your rights are. We comply with the General Data Protection Regulation (GDPR) and Dutch law.
In short: we collect as little as possible, we never sell your data, the website uses no cookies or tracking, and the data you enter in our Excel tools never reaches us.
1.Who we are
The controller for the processing described here is ProcureMatters, a trade name of [Legal business name], [Business address], registered with the Netherlands Chamber of Commerce (KvK) under number [KvK number].
For any question about privacy, or to exercise your rights, email contact@procurematters.com. We have not appointed a data protection officer, because the GDPR does not require one for our activities.
2.What we process, why and for how long
The table below lists each situation in which we process personal data, the legal basis under article 6 of the GDPR and how long we keep the data.
| Situation | Data | Purpose and legal basis | Retention |
|---|---|---|---|
| Visiting the website | IP address, browser type, requested page, date and time (server logs of our host) | Delivering the website securely and preventing abuse. Legitimate interest (art. 6(1)(f)). | Kept by our host for a short period for security purposes. We do not use these logs to identify visitors. |
| Requesting the free guide | Email address, language, date and time, and whether you ticked the newsletter box | Giving you the guide and keeping a record of your request. Necessary to do what you asked (art. 6(1)(b)). | Deleted from our form system within 3 months. |
| Newsletter (only if you tick the box or sign up on the news page) | Email address, date of consent, language | Sending the ProcureMatters newsletter, about once a month. Your consent (art. 6(1)(a)), as also required by article 11.7 of the Dutch Telecommunications Act. | Until you unsubscribe. We delete your address within 30 days after that. |
| Contact form (intro call, workshop or demo) | Name, company, email address, what you are interested in and, if you add it, your question | Replying to your request, planning a call and preparing a proposal. Steps at your request before a contract (art. 6(1)(b)). | Deleted within 12 months if the request does not lead to an assignment. |
| Working with us as a client | Names, business contact details and job titles of your contact persons, correspondence, proposals, invoices | Carrying out the assignment and keeping our accounts. Performance of the contract (art. 6(1)(b)) and our legal obligation to keep financial records (art. 6(1)(c)). | Financial records: 7 years, as required by Dutch tax law. Other assignment files: up to 2 years after the assignment ends. |
| Buying a tool | Name, email address, country, order details and, if you enter them, company name and VAT number | Delivering the product, support and licence questions. Performance of the contract (art. 6(1)(b)) and legal obligations (art. 6(1)(c)). | 7 years for financial records, otherwise up to 2 years after your last contact with us. |
| Emailing us | Your email address, name and the content of your message | Answering your question. Legitimate interest (art. 6(1)(f)) or steps before a contract (art. 6(1)(b)). | Up to 2 years after our last contact, unless it becomes part of an assignment. |
You are not obliged to give us any personal data. Without an email address, however, we cannot send you the guide or reply to your request.
3.Purchases through our checkout partner
Our tools are sold through [checkout partner], which acts as the seller of record (merchant of record). It handles payment, invoicing and VAT, and processes your payment details as an independent controller under its own privacy policy. We never see your card or bank details. We receive the order details listed above so we can deliver the product and help you.
4.Data you share with us during an assignment
During an advice assignment you may share files such as ERP exports, supplier lists or process documents. We ask you to remove personal data that is not needed. If these files still contain personal data, for example the names of contact persons at suppliers, we process that data on your behalf as a processor. The data processing terms in article 17 of our general terms then apply.
5.Our Excel tools
Our tools run entirely in Microsoft Excel on your own computer. They contain no macros and send nothing over the internet. We never receive the data you enter in them.
6.Cookies and tracking
This website does not use cookies, analytics, tracking pixels or advertising tools. The fonts are hosted on our own website, so visiting a page does not send data to font services.
7.Who receives your data
We only share personal data where this is necessary for the purposes above. We use these service providers, each bound by a data processing agreement:
- Netlify, Inc. (United States): hosting of the website and storage of form submissions.
- [newsletter provider]: sending the newsletter, only if you subscribed.
- Our email provider: receiving and sending email to and from contact@procurematters.com.
- Our accountant, if we use one, for our financial records.
Our checkout partner [checkout partner] processes purchase data as an independent controller. We may also share data with authorities if we are legally obliged to. We never sell or rent out personal data.
8.Transfers outside the European Economic Area
Some of our service providers, such as Netlify, are based in the United States. Where personal data is transferred outside the European Economic Area, this happens on the basis of the EU–US Data Privacy Framework if the provider is certified under it, or otherwise on the basis of the standard contractual clauses of the European Commission (art. 46 GDPR). You can ask us for more information about these safeguards.
9.Security
We take appropriate technical and organisational measures to protect personal data. All traffic to the website is encrypted (HTTPS), our accounts are protected with strong passwords and two-step login, and we keep exports of personal data on our own devices only as long as needed. If a data breach occurs that poses a risk to you, we report it to the Dutch Data Protection Authority and, where required, to you.
10.Your rights
You have the right to:
- access the personal data we hold about you;
- have incorrect data corrected;
- have your data deleted;
- restrict the processing of your data;
- receive your data in a common, machine-readable format (data portability);
- object to processing based on legitimate interest, and object at any time to direct marketing;
- withdraw your consent at any time, for example by using the unsubscribe link in every newsletter. This does not affect processing that took place before you withdrew it.
Email contact@procurematters.com to exercise your rights. We reply within one month. If we have reasonable doubt about your identity, we may ask for additional information to verify it.
If you are not satisfied with how we handle your data, please tell us first. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), autoriteitpersoonsgegevens.nl, or with the supervisory authority in the EU country where you live or work.
11.Automated decisions
We do not take decisions based solely on automated processing, including profiling, that have legal or similarly significant effects for you.
12.Changes
We may update this privacy statement, for example when we start using a new service. The current version is always on this page, with its date at the top.