Privacy policy

Within our company Starterslening.nl B.V., trading under the name HypotheekBerekenen.nl (hereinafter: Starterslening.nl), we work extensively with personal data of consumers who wish to use our company's services. In addition, we process personal data of mortgage advisers who are interested in the contact details of these consumers; based on the personal data of consumers provided, they can contact these consumers to make an appointment for an advisory meeting. We also process personal data of our own employees.

Personal data is primarily collected to carry out the services we provide. These are services to both consumers and mortgage advisers. We process the personal data of our employees on the basis of our legal obligations as an employer and to honour commitments under the employment contract.

All data subjects must be able to trust that our company handles the personal data it receives carefully and securely.

Through this policy we set out how privacy is handled within our company. In doing so we demonstrate that we do everything that may reasonably be expected of us to safeguard, protect and uphold the privacy of data subjects.

This privacy policy takes effect on 25 August 2021.

Legal frameworks for processing personal data

The management of our office is responsible for drawing up, implementing and enforcing this privacy policy.

The following legal frameworks apply, among others:

The Dutch Personal Data Protection Act (Wbp), replaced from 25 May 2018 by the General Data Protection Regulation (GDPR);
The Dutch GDPR Implementation Act.

Principles

Our company handles personal data securely and respects the privacy of data subjects. In doing so we adhere to the following principles:

Data subjects
We process only the personal data of those data subjects who have an interest in the performance of the services we provide. These are consumers interested in the options for a municipal first-time-buyer loan, and mortgage advisers who wish to get in touch with these – for them – potential customers.

We also process personal data of staff who carry out work for our company under our responsibility. These may be staff with an employment contract under civil law, but also interns, temporary workers or freelancers.

Lawfulness, fairness, transparency
Personal data is processed in accordance with the law and in a proper and careful manner.

Legal basis and purpose limitation
We ensure that personal data is collected and processed only for specified, explicitly described and legitimate purposes. Personal data is only processed on a lawful basis.

Data minimisation
We process only the personal data that is strictly necessary for the predetermined purpose. Minimal data processing is the starting point. Where possible, less or no personal data is processed.

Retention periods
Personal data is not retained longer than necessary. Retaining personal data for a certain period may be necessary to perform the work assigned to us properly or to comply with legal obligations.

Integrity and confidentiality
All our staff handle personal data carefully, treat it confidentially and use it solely for the purpose for which it was collected.

Sharing with third parties
We pass on personal data of consumers to mortgage advisers we cooperate with when these consumers leave contact details on a form on this website.

Third-party services or facilities
Where we use the services or facilities of third parties in connection with the processing of personal data, we make agreements with them about what these services and facilities must comply with. These agreements comply with the law.

Rights of data subjects
We inform data subjects in good time about the rights they have under privacy legislation and we honour all rights of data subjects.

Security
We take appropriate organisational and technical measures to adequately protect the personal data we process.

Processing of personal data

Categories of data subjects

We process personal data of consumers only when they wish to use one of the following services on Starterslening.nl:

Making a calculation;
Requesting a mortgage advisory meeting;
Requesting a call-back;
Receiving the Starterslening.nl newsletter.

In addition, we process personal data of mortgage advisers who have entered into a cooperation with Starterslening.nl for the purpose of carrying out the advisory meetings, call-back requests and calculations requested by the consumers mentioned above.

Categories of recipients to whom personal data is disclosed

We disclose personal data of consumers only to those parties that are essential for carrying out the services the consumers want. These are:

Mortgage advisers cooperating with Starterslening.nl;
Call centres;
Newsletter providers;
Email providers;
Payment providers.

Personal data to be processed

We process personal data. We do not process special category or criminal personal data.

In all situations this concerns only the personal data necessary to:

Communicate with the data subject(s) in the manner agreed between the parties;
Carry out the requested services.

We will always be able to substantiate why, in specific situations, we process the requested personal data.

Grounds for processing

We base the processing of personal data on at least one of the following grounds:

The performance of a contract for services (for example calculating a – maximum – loan, arranging an appointment for an advisory meeting);
Legal obligation; this ground follows, for example, from our position as an employer;
Legitimate interest of our office as data controller (for example, we retain files containing personal data longer than strictly necessary in connection with our liability position).

Retention periods

We do not retain personal data longer than we can provide a basis for it. Where possible we determine the retention period in advance per customer or per service, taking into account at least the following statutory periods relating to the liability of our company as contractor (Dutch Civil Code):

5 years after the client became aware of damage and (possible) liability of our company as contractor;
20 years after the contractual relationship between the client and our company has ended.

Rights of data subjects

We ensure that consumers who wish to use our services are informed in good time about the rights they have as data subjects in connection with the processing of personal data. These are the following rights.

Right to information: data subjects have the right to be informed in good time about how Starterslening.nl handles personal data. We honour this right by including a privacy statement on the Starterslening.nl website in a logical and easily findable place.
Right of access: a data subject can always request an overview from us of the personal data we have stored about them. We honour such a request willingly and do not charge any costs for it.
Right to rectification: where personal data we process is incorrect or incomplete, a data subject has the right to demand correction or completion. We carry out the desired correction / completion as soon as possible.
Right to restriction: we provide services and process personal data for that purpose. If data subjects believe that we request more personal data than necessary to provide the service in question, they may indicate this. We will then reconsider the need to process the personal data that may be superfluous for performing the service.
Right to object: in specific situations data subjects may indicate that they do not want us to process personal data. This is the case, for example, when we approach them in the context of direct marketing.
Right to erasure: data subjects have the right to ask us to erase their personal data. Our basic attitude is to do so. However, we will first consider whether this can reasonably be expected of us and to what extent our (liability) position objects to it.
Right to data portability: data subjects have the right to request the personal data we have stored in a machine-readable format, so that they can provide this data to another service provider of their choice.
Right not to be subject to profiling: insofar as we build an automated profile of customers based on the choices they make and the data they enter, in order to subsequently make them a personalised offer or proposal, a customer may indicate in advance that they do not consent to this.

The starting point is that we respect and honour these rights. Where the rights of data subjects conflict with the interests of our company, we will carefully weigh the mutual interests.

Data breaches

We take all measures that may reasonably be expected of us to ensure that personal data is processed carefully within our company. Should it nevertheless emerge that a personal data breach has occurred (a so-called data leak), we will take the legally required actions.

Where we cannot rule out that the breach poses a risk to the privacy of data subject(s), we will report the breach to the Dutch Data Protection Authority (AP). We will also take measures to limit these risks to the privacy of data subject(s) as much as possible, and to prevent a recurrence of the breach where possible. In addition, we will inform the data subject(s) about the nature and extent of the breach.

We inform our staff so that they can, on the one hand, recognise a personal data breach and, on the other hand, know what to do in the relevant circumstances.

We record all personal data breaches in an internal register.

Processors

We consider the following organisations to be processor(s) within the meaning of the GDPR:

TransIP B.V., Schipholweg 9B, 2316 XB Leiden
Elastic Email, 6244 Soule Rd., Sooke, British Columbia, Canada
Mailgun Technologies Inc., 535 Mission St., 14th Floor, San Francisco, CA 94105, United States of America (USA)

We have concluded so-called processing agreements with these organisations in which, in accordance with statutory requirements, we have set out arrangements regarding the work to be carried out by these processors in connection with the processing of personal data and the associated responsibilities.

Security

We take appropriate technical measures to secure the processing of personal data. The protection level of these technical measures is aligned with the possible risks. We ensure encryption of personal data, provide technical security of software and data via firewalls and protection software, and also ensure that the security of our websites meets the applicable requirements (SSL).

We have also taken appropriate organisational measures to prevent unauthorised persons from breaching the processing of personal data within our company. For example, we have secured our office premises against unauthorised entry and have aligned access rights to our data systems per employee with the work that the relevant employee carries out in connection with the processing of personal data. We keep log files from which we can read who performed which actions within our data systems.

Transfer of personal data abroad

We ask the processors we cooperate with for guarantees that personal data is not transferred to countries outside the European Economic Area (EEA) if these do not offer a level of privacy protection that is at least equal to the level of protection in the Netherlands.

Our website

Visitors to our website Starterslening.nl can indicate on the website which service they wish to use and can then leave the contact details required to carry out the service.

We will use the contact details provided solely for the purpose specified by the relevant visitor (= the requested service).

We can always demonstrate what the consent given by visitors relates to. They can, at any time, for example via the footer in a newsletter, submit changes to their consent and/or preferences.

We ensure that the websites are provided with the very latest security updates of the software or plug-ins used. Our website is also provided with an SSL certificate (green padlock).

Through a privacy statement on our website we explain how we handle personal data. This privacy statement is easy to find on our website.

When we use cookies on our website, we will inform visitors in advance what kind of cookies these are. Visitors are also given the opportunity in good time to indicate whether they consent to the placing of these cookies.

This privacy policy applies only to the services of Starterslening.nl. We have no control over sites with applications, products or services outside Starterslening.nl or links from our various services. These other sites may place their own cookies or other files on computers, collect data or ask data subjects to provide personal data.

We also have no control over the way in which the mortgage advisers we cooperate with process personal data.

Version: 25 August 2021