1. Introduction

GG Financial Consulting B.V. ("GGFC", "we", "us" or "our") respects your privacy and is committed to protecting the personal data entrusted to us.

This Privacy Policy explains how we collect, use, store and share personal data when you visit our website, enquire about our services or engage GGFC for accounting, bookkeeping, tax, payroll or financial services.

We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Dutch data protection legislation.

2. Who We Are

GG Financial Consulting B.V.

Registered address: Prins Hendrikkade 21 E, 1012 TL Amsterdam, the Netherlands.

Chamber of Commerce (KvK): 99041081

Email: info@ggfinancialconsulting.com

Website: www.ggfinancialconsulting.com

For questions about personal data or to exercise your privacy rights, please contact us using the email address above.

3. What Personal Data We Collect

Depending on our relationship with you and the services provided, we may collect and process the following information.

Contact and business information

Names, business names, email addresses, telephone numbers, company registration details, business addresses and professional contact information.

Identity and verification information

Identification documents, information about company directors, beneficial owners and other details needed for client verification and applicable compliance obligations.

Financial and tax information

Accounting records, invoices, receipts, bank transactions, income information, tax identification numbers, financial statements and information required for tax filings or financial reports.

Payroll and employment information

Where payroll services are provided, this may include employee identification details, employment information, salary details, bank account information, tax information and other information necessary for payroll administration.

Information relating to specialist services

Depending on the engagement, we may process additional information relevant to personal income tax returns, 30% ruling applications, DAFT documentation, mortgage reports or other financial services.

Some engagements may involve sensitive personal data. We process such information only where an appropriate legal basis and any additional conditions required under applicable data protection law are satisfied.

Website and communication information

We may obtain personal data directly from individuals, from our business clients and their authorised representatives, through connected accounting and payroll systems, or from third parties and public sources where relevant to the services provided. These sources may include employers, financial institutions, tax authorities, company registers and other authorised professional advisers.

Where the provision of personal data is necessary for a contract or legal obligation, we will explain the relevant requirements where appropriate. Failure to provide necessary information may prevent us from providing certain services.

GGFC does not make decisions about individuals based solely on automated processing, including profiling, that produce legal or similarly significant effects.

4. Why We Process Personal Data

We process personal data for the following purposes:

• Responding to enquiries and assessing prospective client engagements

• Performing client identification and applicable compliance checks

• Preparing engagement letters and managing client relationships

• Providing bookkeeping, tax compliance, payroll and financial services

• Preparing and submitting agreed reports and declarations

• Managing invoices, payments and business administration

• Communicating with clients and their authorised representatives

• Maintaining professional records and meeting legal obligations

• Protecting the security and integrity of our systems

• Operating and improving our website

• Sending newsletters or marketing communications where permitted

We do not sell personal data to advertisers or data brokers.

5. Legal Bases for Processing

We process personal data only where an appropriate legal basis applies under Article 6 of the GDPR. Depending on the circumstances, these include:

Contractual necessity: To provide agreed accounting, bookkeeping, tax or financial services to individual clients, or to take steps requested by individuals before entering into a contract.

Legal obligations: To comply with applicable tax, accounting, record-keeping and other statutory requirements.

Legitimate interests: To manage business relationships, respond to enquiries, maintain information security, prevent misuse of our systems, recover outstanding payments and protect our legal rights, where these interests are not overridden by individuals' rights and freedoms.

Consent: Where consent is required for optional cookies, certain marketing communications or other specific processing activities. Consent may be withdrawn at any time.

Where we process personal data on behalf of business clients, including their employees or customers, the client may act as the data controller and GGFC as the data processor. In such cases, we process information in accordance with the applicable agreement and documented instructions, subject to legal requirements.

Where special categories of personal data are involved, we process such information only where an appropriate legal basis and an additional condition under Article 9 GDPR apply.

6. Client Portals and Accounting Software

GGFC uses professional software and secure digital services to manage accounting records, client communication, document collection and other aspects of its work.

Depending on the services provided, these may include:

• Jortt for bookkeeping and accounting

• Employes for payroll administration

• Fiscaal Online for tax compliance

• TaxDome for practice management, document exchange, client communication and electronic signatures

• Google Workspace for business email, documents and related administration

• Squarespace for website hosting and enquiry forms

• Other appropriate professional software providers

The specific systems used may change as we update our working processes.

We manage access to information according to operational needs and applicable confidentiality and security requirements.

Clients who receive portal access are responsible for protecting their login credentials and notifying us if they suspect unauthorised use.

Use of AI-Assisted Tools

GGFC may use AI-assisted software to support internal administrative tasks, document review, financial analysis, research and the preparation of draft communications or reports.

Where personal data is processed through such tools, we assess the applicable contractual, confidentiality and data protection requirements. We aim to minimise unnecessary personal information and restrict access to authorised users.

AI-assisted outputs are subject to appropriate professional review. GGFC remains responsible for the accounting, tax, and financial services provided to clients.

Where AI service providers process personal data on our behalf, we assess the applicable data processing arrangements and any international data transfers.

7. Sharing Personal Data

We may share personal data where necessary for the services provided or where required by law.

Recipients may include:

• The Belastingdienst and other competent authorities

• Authorised employees and contracted bookkeeping professionals

• Accounting, payroll and tax software providers

• Cloud hosting, email, IT and practice management providers

• Professional advisers, where necessary and authorised

• Other parties where disclosure is legally required

We require appropriate confidentiality and data protection safeguards when engaging third-party service providers.

Where a provider acts as a data processor on our behalf, we put appropriate contractual arrangements in place as required by applicable law.

Some processing activities may involve GGFC acting as a data controller, while others may involve processing personal data on behalf of a business client. The applicable roles and responsibilities depend on the particular processing activity.

8. International Data Transfers

Some third-party software and cloud services may involve access to or processing of personal data outside the European Economic Area.

Where an international transfer takes place, we take steps to ensure that an appropriate legal transfer mechanism and safeguards are in place.

These may include adequacy decisions, standard contractual clauses or other mechanisms recognised under applicable data protection law.

You may request further information about relevant safeguards using our contact details.

9. Data Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure or misuse.

Depending on the system and information involved, these measures may include access controls, authentication, secure communication methods, restricted permissions and security measures provided by our software suppliers.

We periodically review our access arrangements and security practices.

No electronic system can be guaranteed to be completely risk-free. Where a personal data breach occurs, we will assess and respond to it in accordance with applicable legal requirements.

10. How Long We Retain Personal Data

We retain personal data only for as long as necessary for the purposes for which it was collected, taking into account applicable legal obligations, contractual requirements and legitimate business needs.

Our retention periods depend on the nature of the information:

Accounting and tax records: Generally retained for seven years in accordance with Dutch tax administration requirements. Certain categories of records may require a longer statutory retention period.

Client engagement and professional records: Retained for the duration of the engagement and for an appropriate period afterwards, taking into account relevant legal obligations, professional responsibilities and potential legal claims.

Identity and verification documents: Retained only for as long as required under applicable laws or where otherwise necessary for a lawful purpose.

Prospective client enquiries: Retained for a limited period where an engagement does not proceed, unless a longer period is justified by ongoing correspondence, a legal obligation or another lawful purpose.

Marketing information: Retained while there is a valid basis for sending communications, subject to applicable legal requirements. Individuals may unsubscribe or withdraw consent where applicable.

Website and technical information: Retained according to the relevant purposes, system settings and applicable cookie and data protection requirements.

Where GGFC processes personal data on behalf of a business client, retention and deletion arrangements are governed by the relevant agreement and applicable legal obligations.

Once personal data is no longer required, we securely delete or anonymise it, subject to any applicable legal retention requirements.

11. Your Privacy Rights

To exercise your privacy rights, please contact us at info@ggfinancialconsulting.com.

We may ask for information reasonably necessary to verify your identity before responding to a request.

We aim to respond to privacy rights requests within one month of receipt, in accordance with the GDPR. Where legally permitted, this period may be extended by up to two additional months for complex or multiple requests. We will inform you of any extension and the reasons for it.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Certain rights may be restricted where we are legally required to retain information or where another applicable legal exception applies.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Website: www.autoriteitpersoonsgegevens.nl

12. Cookies and Website Analytics

Our website may use cookies and similar technologies that support website functionality, security, analytics and other permitted purposes.

Strictly necessary cookies may be used without consent where permitted by law.

Where consent is required for optional analytics, advertising or other tracking technologies, we will request it before activating those technologies.

Visitors can manage their preferences through the available cookie controls and their browser settings.

The cookies and third-party services used on the website may change over time. We aim to keep this information and our consent arrangements up to date.

13. Marketing Communications

We may send newsletters, business updates or other marketing communications where we have an appropriate legal basis to do so.

You may unsubscribe from marketing emails using the unsubscribe option provided or by contacting us directly.

Unsubscribing from marketing communications does not affect necessary communications relating to an existing engagement.

14. Third-Party Websites

Our website may contain links to external websites and services.

We are not responsible for the privacy practices of independent third parties. We recommend reviewing their privacy policies before providing personal information.

15. Changes to This Policy

We may update this Privacy Policy to reflect changes to our services, systems, legal requirements or data protection practices.

We will publish the latest version on our website with an updated revision date.

Where appropriate, we will communicate material changes to affected individuals.

16. Contact

If you have any questions about this Privacy Policy or how GGFC handles personal data, please contact:

GG Financial Consulting B.V.

Prins Hendrikkade 21 E

1012 TL Amsterdam

The Netherlands

KvK: 99041081

Email: info@ggfinancialconsulting.com