Privacy notice

Who is responsible?

Doenzo (KvK 42162983), Theo Mann-Bouwmeesterlaan 64, 2597 HJ ’s-Gravenhage, is responsible for processing your data. You can reach us at info@doenzo.net.

Business and contact details

What information do we use?

Customer requests include your name, email, postcode, city, selected service and the details you provide about the work and timing.

When you register as a professional, we collect:

• your name and email address;
• your phone number, if you choose to give it;
• your KvK number, and the trade name and place of business that the KvK check returns;
• the trades, regions and languages you choose or enter;
• how you heard about Doenzo, and an invite code if you have one;
• campaign details from the link you used (UTM parameters such as source, medium and campaign) and the host name of the website you came from (not the full address);
• whether you registered while the Pioneer credit campaign was running;
• your choices: agreement to the terms, whether we may call or WhatsApp you, and whether you also want other news about the opening, each with the date and time and the version of the terms and of this privacy notice.

If Doenzo gives you Gold status (see the terms for professionals), we keep that status, when and by which administrator it was given or ended, and the short internal note the administrator writes with it. Customers see only the label "Doenzo Gold"; the note and who made the change are visible to administrators only.

We also store a request reference, creation and update times, handling status, internal notes and a history of changes. The current request flow does not collect payment card details or identity documents.

Why do we use it?

We use customer request details to assess and follow up your request, contact you and keep track of its handling. Basis: steps taken at your request before entering into an agreement, and its performance (Article 6(1)(b) GDPR); the record of how a request was handled is our legitimate interest in being able to account for it (Article 6(1)(f) GDPR). Information entered in free-text fields should be limited to what is needed for the request.

For professional registrations, we use your data for these purposes:

• Assessing your registration and preparing an agreement with you. Basis: steps taken at your request before entering into an agreement (Article 6(1)(b) GDPR).
• Emailing you the date from which customers in Zuid-Holland can place requests; the 90 days of the Pioneer credit also start on that day. Basis: performance of the terms for professionals (Article 6(1)(b) GDPR).
• Checking your KvK number with KvK and preventing fraud and misuse, such as fake or duplicate registrations. Basis: our legitimate interest in working only with registered, active businesses (Article 6(1)(f) GDPR).
• Understanding how professionals find Doenzo, and handling invite codes and the Pioneer credit. Basis: our legitimate interest (Article 6(1)(f) GDPR).
• Calling or WhatsApping you about your registration, and emailing you other news about the opening. Basis: your consent (Article 6(1)(a) GDPR). These are separate choices. You can withdraw your consent at any time; this does not affect contact that already took place.
• Recording your choices with date and time, so that we can show what you agreed to. Basis: our legitimate interest in being able to demonstrate this (Article 6(1)(f) GDPR).
• Running your professional account: your offers, the contact fees, your balance, your credit and any refunds. Basis: performance of the terms for professionals (Article 6(1)(b) GDPR); keeping the financial records is a legal obligation (Article 6(1)(c) GDPR).
• Applying Gold status (no contact fees, the label on your offers) and recording who gave or ended it, when and why. Basis: performance of the terms for professionals (Article 6(1)(b) GDPR); the record is our legitimate interest in being able to account for those decisions (Article 6(1)(f) GDPR).

Terms for professionals

Services and access

We use these services and recipients to run Doenzo:

• Website hosting (Cloudflare): Our hosting provider delivers the web pages and processes technical connection data, such as your IP address. Basis: our legitimate interest in delivering and securing the website (Article 6(1)(f) GDPR).
• GoDaddy: Our domain registrar. If you go to doenzo.net or doenzo.org, GoDaddy forwards you to www.doenzo.net and processes technical connection data, such as your IP address, to do so.
• Supabase: Database and server functions. Requests and registrations are stored and processed there, and administrators sign in through it.
• KvK (Netherlands Chamber of Commerce): We send your KvK number to the KvK API to check that your business is registered and active. This happens as soon as you have entered the 8 digits in the registration form, so that you can see the result, and again when you send the form. We receive the trade name and place of business; we do not store a street address. To limit misuse, the check counts how many checks came from your IP address in the last 10 minutes; that count is kept in working memory only, is never stored, and is gone when the server function restarts.
• Microsoft 365: Email. Messages we send you, and messages you send us, pass through Microsoft 365.
• Resend: E-mail delivery. When you register as a professional, Resend sends you the confirmation of your registration and sends Doenzo a notification with your registration details. Resend, Inc. is a US company; the e-mails are sent from the EU (Ireland). Resend may also process data in the United States, under the EU standard contractual clauses.
• OpenAI (OpenAI Ireland Limited): Only for customer requests: the service, the job description, the town, the preferred days and the indicative amounts go to OpenAI, so that an AI model can suggest a price range and a fee band to our manager. Your name and contact details are not sent. A person always decides. OpenAI may process this in the United States, under the EU standard contractual clauses.
• WhatsApp (WhatsApp Ireland Limited): Only if you agreed to be contacted via WhatsApp: messages about your registration then pass through WhatsApp.
• Google (Google Ireland Limited): Google Analytics, only if you accept cookies on our website; see "Cookies for statistics and ads" below.
• Meta (Meta Platforms Ireland Limited): The Meta Pixel, only if you accept cookies on our website; see "Cookies for statistics and ads" below.
• Customers: When you send an offer as a professional, the customer sees your (trade) name, your town, the languages you speak, whether Doenzo has approved you, your number of completed jobs, your offer and, if you have Gold status, the label "Doenzo Gold". If a customer shares their contact details with you, that customer also sees your phone number and email address.
• Professionals: If you share your contact details as a customer with a professional, that professional receives your name, phone number and email address, so that they can contact you about your job. You choose who you share with, and you can share with more than one professional. You give your address yourself. Basis: steps taken at your request before entering into an agreement (Article 6(1)(b) GDPR).

Our database and server functions (Supabase) are in the EU, in Ireland. Our contract is with Supabase Pte. Ltd. in Singapore; if Supabase processes data outside the EU, the EU standard contractual clauses apply. Our hosting provider Cloudflare is a US company and delivers the website through a worldwide network, so also from countries outside the EU. Cloudflare is certified under the EU-US Data Privacy Framework, which covers transfers to the United States. If that certification lapses, the EU standard contractual clauses apply. GoDaddy, where our domain names are registered, is also a US company and is certified under the EU-US Data Privacy Framework. KvK processes your KvK number in the Netherlands. Our email (Microsoft 365) is stored in the EU. OpenAI may process details of customer requests (not of professional registrations) in the United States, under the EU standard contractual clauses. If you agreed to be contacted via WhatsApp, WhatsApp may also process your messages in the United States, under the EU-US Data Privacy Framework. If you accept cookies on our website, Google and Meta may process data about your visit in the United States, under the EU-US Data Privacy Framework. If you want to know more about these safeguards, or want a copy, email us at info@doenzo.net.

The management service checks the signed-in administrator against an access list. Requests and internal notes are not shown publicly.

Browser storage, visitor statistics, fonts and email

The service pages can save your language preference in your browser. Hosting or sign-in services may use their own technical storage. Automatic e-mails for customer requests are currently off. When you register as a professional, you automatically receive a confirmation by e-mail (see Resend above).

We count visits to our website with Cloudflare Web Analytics, on every page except the error page. It works without cookies, stores nothing in your browser and does not follow you across other websites. Cloudflare does not use your IP address or browser details to recognise you. We only see totals: which pages are viewed, which website visitors come from, from which country, with what kind of device and browser, and how fast the pages load. Basis: our legitimate interest in understanding how the website is used and improving it (Article 6(1)(f) GDPR).

The pages for professionals (registration and the terms for professionals) do not use analytics cookies or advertising pixels. If you arrive through a link with campaign details (UTM) or from another website, the registration page keeps those campaign details and the name of that website in your browser’s session storage until you close the tab, so they can be sent with your registration.

Fonts are loaded from our own website. No connection is made to Google Fonts.

Cookies for statistics and ads

Only if you accept cookies in the cookie notice on our website do we use these services on the service pages and the information pages (never on the pages for professionals):

• Google Analytics (Google Ireland Limited): counts visits and page views and shows how visitors use the website and where they come from. Cookies: _ga and _ga_… (13 months).
• Meta Pixel (Meta Platforms Ireland Limited): measures whether an ad on Facebook or Instagram leads to a sent request, and lets Meta show our ads to people like the visitors of our website. Cookies: _fbp and, if you come through an ad, _fbc (90 days).

When you send a request, these services only learn that a request was sent (and Google Analytics which service it is for); we do not send your name, email address, phone number, postcode or description. Google and Meta also receive technical data about your visit, such as your IP address, your browser and the page you are viewing. They may process data in the United States, under the EU-US Data Privacy Framework. Meta is jointly responsible with us for collecting and passing on these data through the pixel; Google and Meta are themselves responsible for what they then do with the data. Basis: your consent (Article 6(1)(a) GDPR).

Without your consent these services are not loaded and no cookies are placed; the website works just the same. We keep your choice for 12 months in your browser’s local storage, so that we do not ask on every page. You can withdraw your consent at any time through "Cookie settings" at the bottom of the page; we then delete the cookies of these services from our website. If you see no cookie notice and no "Cookie settings", we use none of these services.

How long do we keep data?

We keep personal data no longer than needed for the purposes above, unless the law requires us to keep it longer.

• A professional registration that does not lead to an account: deleted at the latest 12 months after the last contact; only your email address and your choices (consents) are then kept for 2 more years as proof.
• A professional account: kept while it exists, and for 2 years after that (for questions, complaints and disputes).
• The result of the KvK check, campaign details (UTM), the website you came from, how you heard about Doenzo and your invite code: kept as long as the registration or account they belong to.
• Your choices (consents) with date and time: kept while the consent applies, and for 2 years after that as proof.
• Contact fees, balance and invoices: 7 years (legal retention duty).
• Customer requests: 2 years after the request is completed.
• Email: 2 years after the last message.

Your privacy rights

You can ask for access to your personal data, and for correction or deletion. You can also ask us to restrict its use or to transfer it, and you can object to its use. Where we rely on your consent, you can withdraw it at any time. Email us at info@doenzo.net.

You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Submit a privacy complaint to the Autoriteit Persoonsgegevens