Privacy statement

Version: 5 November 2026

1. Controller

BM International Holding B.V., IJburglaan 1495, 1087 KM Amsterdam, The Netherlands (KVK 78052769). Contact for privacy matters: [email protected]. We have not appointed a data protection officer.

2. Whose data we process

(a) Business contact details from public sources, such as business name, website, public contact addresses and public listing data, to find websites we can improve and to contact the business. (b) Customers: contact, billing, order and project data, website content and, where you provide them, access credentials (stored encrypted and deleted after the project). (c) Website visitors: server logs with IP address, time and page requested. This website sets no cookies and uses no tracking. (d) Concept requests via the form: website address, company, email address and country. We first send a confirmation link and continue only after you click it.

3. Source of the data

Public websites and public business listings, for example Google Places. Every message we send states where we found your details.

4. Purposes and legal bases

Business-to-business outreach and security: legitimate interest (Art. 6(1)(f) GDPR). Delivering our service: performance of a contract (Art. 6(1)(b)). Bookkeeping and tax: legal obligation (Art. 6(1)(c)), with a retention period of 7 years under Dutch law. Concept requests: steps taken at your request (Art. 6(1)(b)) and your consent given in the form (Art. 6(1)(a)).

5. Recipients and processors

Cloudflare (traffic, DNS and security), our server hosting provider, Resend (sending email), Stripe (payments) and Google (public business data and page speed data). We have processing agreements in place. Where data leaves the European Economic Area, this happens on the basis of an adequacy decision (such as the EU-US Data Privacy Framework) or Standard Contractual Clauses. Cloudflare Turnstile protects the request form against bots and may process technical browser data for this purpose.

6. Retention

Business contacts who do not become customers: no longer than 12 months. If you object, we keep only your address on a block list so we never contact you again. Billing records: 7 years. Server logs: a short period, typically up to 30 days.

7. Your rights

You can request access, rectification, erasure, restriction and portability, and you can object to processing, in particular to direct marketing, which we always honour. Write to [email protected]. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

8. Security

We use HTTPS, store credentials encrypted and limit access to what is needed.