CREDS cares greatly about your privacy. We process only the data we need to provide and improve our services, and we handle everything we collect about you and your use of our services with care. We do not sell your data and we do not share it with third parties for commercial purposes. This policy applies to the CREDS website and to the services we provide. Last updated: 11 October 2026.
CREDS B.V. is the controller for the personal data described here. You can reach us at Vleutensevaart 100, 3532 AD Utrecht, the Netherlands, by email at info@creds.nl, or by telephone on +31 30 700 9736. If you want to exercise any of the rights described below, email us and we will respond within one month. We have not appointed a data protection officer, because we are not required to.
We process personal data for three purposes, each with its own legal basis under Article 6 of the GDPR.
When you engage us, we process the contact and project data needed to carry out the work and to invoice it. The basis is performance of a contract, and for some records a legal obligation such as tax retention.
When you contact us through the website, by email or by telephone, we process what you send us in order to reply and, where it leads somewhere, to prepare a proposal. The basis is our legitimate interest in responding to people who approach us, or steps taken at your request before entering a contract.
We measure website usage with self-hosted analytics, but only if you agree to it. The basis is your consent, which you can withdraw at any time.
We use Matomo, an analytics tool we host ourselves at stats.creds.nl on our own infrastructure. Your visit data is not sent to Google Analytics or any other third-party analytics service, and it is not combined with data from other websites. We use it to count visits and see which pages are read, not to build a profile of you or follow you across the internet. Analytics only runs if you accept it in the cookie banner, and nothing is requested from our analytics server before you choose. You can change your mind at any time by clearing this site's data in your browser, which brings the banner back.
Essential storage keeps the site working: your language choice and your answer to the cookie banner are kept in your browser's local storage, not in a cookie, and are never sent to us. If you accept analytics, Matomo sets its own cookies in order to recognise a returning visit. If you decline, those cookies are not set, and any that already exist are removed.
When analytics is enabled, we record technical information about your visit, including your IP address, the pages you view, the referring page, and your browser and operating system. We treat your IP address as personal data, because under European case law it generally is. We do not use this information to identify you, and we do not attempt to link it to a named individual.
We do not sell personal data and we do not share it for commercial purposes. We use a small number of suppliers who process data on our behalf under a processing agreement, such as our email and hosting providers. They may only act on our instructions. Our website analytics is self-hosted, so no analytics provider receives your data. Where we are legally required to disclose data, for example to a supervisory authority, we will do so.
Our website analytics runs on our own infrastructure. For the other suppliers we rely on, we select services that store data within the European Economic Area where we can. Where a transfer outside the EEA cannot be avoided, it takes place under the safeguards the GDPR requires, such as the European Commission's standard contractual clauses.
We keep client records for as long as you are a client, and afterwards for as long as we are legally required to, which for financial records in the Netherlands is seven years. Enquiries that do not lead to work are deleted once it is clear they will not. Analytics data is retained in aggregate form and we do not keep raw visit logs indefinitely.
Under Dutch and European law you have the following rights regarding personal data we process. To exercise any of them, email info@creds.nl. We will not charge you and we will respond within one month.
You can ask us what personal data we hold about you and receive a copy of it.
You can ask us to correct personal data about you that is wrong or incomplete.
You can ask us to delete personal data about you. We will do so unless we are legally required to keep it.
You can ask us to pause our processing of your personal data while a question about it is resolved.
You can ask us to provide your personal data in a structured, commonly used format, or to transfer it to another party.
You can object to our processing of your personal data where we rely on legitimate interest.
Where we rely on your consent, such as for website analytics, you can withdraw it at any time. That does not affect processing that already took place.
If you think we are handling your personal data incorrectly, please tell us first so we can put it right. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl.
We may update this privacy policy. This page always shows the current version, with the date it was last updated at the top.