Privacy Notice

Last updated: 23 October 2026

1. Who is responsible for your personal data?

Oranjedam Bouw B.V. is the controller responsible for the personal data described in this notice.

IDC Projects is the name used for our digital infrastructure activities and is not a separate controller.

Statutory seat: Amsterdam, The Netherlands
Dutch Chamber of Commerce number: 63542994
Privacy contact: info@oranjedam.nl

2. Personal data we process

Depending on your interaction with us, we may process:

• Your name, job title, employer and business contact details.
• Correspondence, meeting arrangements and information you provide about a business enquiry or project.
• Personal data contained in project documents you are authorised to share.
• Relevant business contact information obtained from introductions, company websites, public business registers or professional profiles.
• Technical information generated when visiting our website, such as IP address, requested pages, access times, browser information and security events, to the extent recorded by our website infrastructure.

Please do not send unnecessary personal data or sensitive identification documents with an initial enquiry.

3. Why we process data and our legal bases

Responding to enquiries and maintaining business relationships. We use contact details and correspondence to answer questions, arrange discussions and assess potential cooperation. Our legal basis is our legitimate interest in conducting business and communicating with relevant contacts. Where you personally request steps towards a contract with us, processing necessary for those steps may instead be based on Article 6(1)(b) GDPR.

Assessing and coordinating projects. We process relevant business contact and project information to evaluate opportunities, coordinate discussions and perform agreed work. This is based on our legitimate interests and, where applicable, the necessity of performing a contract with the individual concerned.

Operating and protecting the website. We process necessary technical information to deliver the website, prevent misuse and investigate security incidents. Our legal basis is our legitimate interest in maintaining a reliable and secure website.

Legal compliance and claims. We process information where necessary to meet legal obligations. Where appropriate, we also retain information for the establishment, exercise or defence of legal claims, based on our legitimate interests.

Optional technologies or communications. Where consent is required for a particular technology or communication, we obtain it before the relevant processing. You may withdraw consent without affecting the lawfulness of processing before withdrawal.

4. Information obtained from other sources

Where we obtain your business contact details through an introduction, public professional source or project counterparty, we use them only where relevant to a legitimate business purpose.

Where required by applicable data protection law, we provide the relevant privacy information within the applicable statutory period.

5. Who may receive your data?

We restrict access to persons who need it for the relevant purpose. Recipients may include:

• Authorised personnel and contracted support providers.
• Website hosting, security and email service providers.
• Legal, accounting and other professional advisers.
• Project counterparties, but only where necessary for an identified project purpose and supported by an appropriate legal basis.
• Public authorities where disclosure is legally required or otherwise lawfully necessary.

The public website is hosted and delivered using Cloudflare services. Oranjedam uses Proton Mail for business email. Other professional or project-specific service providers may be used where necessary for a particular engagement.

We do not treat a commercial introduction as permission to circulate a person’s details without limitation.

6. International transfers

Personal data may only be transferred outside the European Economic Area where applicable GDPR requirements are met.

Cloudflare operates a global network and may process limited website traffic metadata in locations outside the EEA. Where Chapter V GDPR applies, transfers are handled using the applicable transfer mechanism made available by the provider, such as an adequacy decision or appropriate contractual safeguards.

Proton Mail states that its mail servers are located in Switzerland, Germany or Norway. Other provider or support processing may occur as described in Proton’s applicable privacy documentation.

Where another project-specific provider requires an international transfer, we assess the relevant legal transfer mechanism before relying on that provider for the relevant processing.

7. How long we retain personal data

We retain personal data only for as long as necessary for the purpose for which it was collected, taking into account the nature of the relationship, legal obligations and the possibility of legal claims.

• General enquiries that do not lead to cooperation are periodically reviewed and deleted or anonymised when they are no longer reasonably relevant.
• Active business relationship and project records are retained for the duration of the relationship and afterwards for as long as reasonably necessary for administration, legal obligations or claims.
• Business records that fall within Dutch statutory recordkeeping obligations are retained for the applicable statutory period, generally at least seven years and, for certain immovable-property records, ten years.
• Technical and security logs are retained in accordance with the configuration and retention periods of the relevant infrastructure provider.
• Records needed for an actual or reasonably anticipated dispute are retained for as long as reasonably necessary to address that dispute.

8. Cookies and similar technologies

The website source code does not include advertising cookies, behavioural tracking, third-party advertising, embedded social-media feeds or a website contact form.

Cloudflare may use strictly necessary cookies or similar security mechanisms and may process limited technical request information as part of providing and protecting the website.

We do not intentionally deploy optional analytics or marketing technologies without first updating this notice and, where legally required, implementing an appropriate consent mechanism.

9. Security

We apply technical and organisational measures proportionate to the nature of the information and the risks involved. These include appropriate access restrictions and the use of suitable service providers.

No website or communication system can be guaranteed completely secure. Contact us if you suspect that personal data shared with us has been compromised.

10. Your rights

Subject to the conditions and exceptions in the GDPR, you may request access, correction, deletion, restriction of processing or data portability.

You may object to processing based on legitimate interests, including profiling based on those interests. You may object to direct marketing at any time.

Where processing is based on consent, you may withdraw that consent at any time.

Send requests to info@oranjedam.nl. We may request proportionate information to verify your identity; please do not send an identity document unless we explain why it is necessary.

We normally respond within one month. If a permitted extension is necessary, we will explain this within that period.

You may lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, at www.autoriteitpersoonsgegevens.nl, or another competent supervisory authority.

11. Required information and automated decisions

You are not required to submit a business enquiry. However, without appropriate contact details and sufficient information, we may be unable to respond or assess your request.

We do not use the website to make solely automated decisions that produce legal effects or similarly significant effects concerning website visitors or business contacts.

12. Changes

We may update this notice to reflect changes in our activities, service providers, technologies or legal requirements. The latest version will be published on this website with its revision date. Where required, we will communicate material changes directly.