T. van der Hoeven Holding B.V., trading as Graifox, Amsterdam, Chamber of Commerce 83214003, e-mail hello@graifox.nl. August 2026. This statement replaces all earlier privacy statements.

This statement covers the processing of personal data for which Graifox is the controller: visitors of our website, our clients and prospective clients and their contact persons, and the business contacts we approach in the course of our own acquisition. Where Graifox executes campaigns on behalf of a client, Graifox acts as processor for that client; the client is the controller, the client's privacy information applies, and requests about that processing are forwarded to the client.

Data: name, job title, business contact details, organisation details, correspondence, contract and intake information, account and usage data of the client portal, and the payment details needed for billing (through our payment provider). Purposes: entering into and performing agreements, providing the client portal, support, invoicing and collection, and record keeping required by law. Legal bases: performance of a contract, legal obligation, and legitimate interest (relationship management and the protection of our rights).

Data: name, job title, employer, business contact details, professional profile information and the content of our correspondence. Purpose: approaching businesses that may benefit from our services and handling their replies, including honouring opt-outs. Legal basis: legitimate interest (business-to-business direct marketing). You can object at any time by replying to a message or by writing to hello@graifox.nl. An objection is recorded in our suppression register and you are not approached again.

Data: technical data such as IP address, browser type and pages visited, for the security and functioning of the website. Legal basis: legitimate interest. The website uses functional cookies only.

Directly from you, from your organisation, from public professional sources (such as company websites and professional network profiles) and from business data providers.

Service providers that support our business: hosting, e-mail and productivity tools, payment processing, scheduling, outreach infrastructure and AI providers, each bound by a data processing agreement. Providers outside the EEA are engaged under an adequacy decision (including the EU-US Data Privacy Framework) or Standard Contractual Clauses. We do not sell personal data. Data may be disclosed where the law requires it.

No longer than necessary for the purposes above. Indicative periods: client contract and billing records seven years (statutory); acquisition correspondence and prospect data up to eighteen months after the last meaningful contact; the suppression register for as long as needed to honour the opt-out; website logs up to twelve months.

Access, rectification, erasure, restriction, objection (at any time against direct marketing) and data portability where applicable. Send your request to hello@graifox.nl; we respond within the statutory period of one month, which may be extended where the law allows. We may ask you to identify yourself. You may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

We use AI tools to draft and handle correspondence under human-defined rules. We do not take decisions based solely on automated processing that produce legal effects or similarly significantly affect you.

We protect personal data with technical and organisational measures appropriate to the risk, including encrypted connections, access control and monitoring.

We may update this statement. The current version is on our website and in the client portal.

Privacy Statement, August 2026. T. van der Hoeven Holding B.V., trading as Graifox, Amsterdam, Chamber of Commerce 83214003.