Privacy policy

Who is responsible?

DustinLabs
Zuidster 9
3297 VL Puttershoek
Netherlands

Chamber of Commerce: 95365524
VAT ID: NL005147506B10
Contact: contact form
Website: dustinlabs.com

DustinLabs is the data controller for its own website, enquiries, customer administration, invoicing and support. This statement applies to visitors, contact persons and customers. For personal data that customers process in their own hosted website, mailbox or application, the customer usually determines the purpose. DustinLabs may act as a processor for that data; this processing is covered by the arrangements for the relevant service.

Which information do we use and why?

• Enquiries and contact: name, company, email address, optional telephone number, description and correspondence. We use these to answer your question and prepare an assignment. Legal basis: steps at your request before an agreement or its performance. For contact persons at organisations, the legal basis is our legitimate interest in maintaining business contact.
• Account and support: account details, password hash, session information, profile, support messages and order information. We use these to provide access and support. Legal basis: the agreement and our legitimate interest in securing accounts.
• Ordering and administration: name, business and billing address, invoice email address, optional Chamber of Commerce and VAT numbers, selected services, invoice references, payment status and mandate information. Legal basis: the agreement and statutory record-keeping obligations.
• Domain and hosting: the requested domain name, registrant and contact details, and information you supply for setup. A domain check shares the searched name with the domain supplier. Legal basis: carrying out your request and the agreement.
• Security: IP addresses, timestamps, browser information, session data and technical error data may be processed to investigate errors and prevent misuse. Legal basis: our legitimate interest in providing a reliable and secure service.
• Legal requests: the information in a cancellation, withdrawal, complaint, privacy request or report, with a date and acknowledgement. Legal basis: the agreement, statutory obligations and, where necessary, our legitimate interest in substantiating rights.

Required form fields are needed to process your request, account or order. Optional fields may be left blank. Do not send special categories of personal information, identity documents or passwords through the contact form. If we receive information about a colleague or client, we use it only for the business question or assignment concerned.

Who do we share information with?

We do not sell personal data. Access or disclosure is limited to what is necessary for the purpose. The parties involved in the current services include:

• OXXA / The Registrar Company B.V.: hosting, email and domain registration. For registration, the necessary registrant and contact details are also sent to the extension's registry, for example SIDN for .nl. See OXXA's privacy policy.
• Mollie: payment processing, payment status and direct debit mandates. You enter payment information in the payment environment. For its own payment service, Mollie acts as an independent data controller. See Mollie's privacy policy.
• Supporting service providers: only as needed for administration, technical maintenance, business communication or a specifically agreed project. Processors may process information only in accordance with the agreements made.
• Competent authorities and advisers: when a statutory obligation requires it or when this is necessary and permitted for a legal dispute.

For an assignment involving additional software or integrations, we document the suppliers and data flows involved in that assignment. This statement does not authorise unlimited sharing of data with new parties.

AI and processing outside the EEA

DustinLabs may use OpenAI for project preparation, process analysis and development support. The public enquiry form does not automatically send your data to OpenAI. For each project, we determine which information is necessary and minimise or anonymise personal data where possible. See also our agreements on AI.

International domain registrations and services such as OpenAI may involve processing outside the European Economic Area, including in the United States. Transferring personal data requires a valid transfer basis under the AVG (GDPR), such as an applicable adequacy decision or the European standard contractual clauses with the required supplementary assessment and measures. Ask through the contact form which recipients, countries and safeguards apply to your assignment and how you can obtain a copy of them.

How long do we retain data?

We do not retain data longer than necessary. The retention period depends on the purpose of the data and the course of your contact or agreement:

• Enquiries and correspondence: for as long as needed to answer the question, follow up on a proposal and document the arrangements made. Once the matter is closed, we assess which data is still needed; data with no remaining purpose is deleted.
• Customer and project data: for the duration of the service and afterwards only for necessary handover, completion, legal obligations or specific legal claims. When processing on behalf of a customer, the agreed deletion and return periods apply.
• Basic tax records and invoices: generally 7 years from the start of the statutory tax retention period. Data that remains current for an ongoing agreement may therefore be needed for longer.
• Complaints, withdrawals and other legal requests: for as long as needed to handle them and demonstrate their resolution. Data belonging to tax records is subject to the corresponding retention obligation.
• Security and error data: for as long as needed for investigation, protection of the service or an ongoing incident. Records of a specific incident may be needed for longer than ordinary technical logs.
• Browser storage and sessions: the specific retention periods are listed in the cookie policy.

Backups follow the retention period of the relevant backup service and have restricted access. Deleted data may remain in them until that cycle expires; it is not reused for other purposes. We do not automatically retain all personal data for 7 years: that period applies to the relevant administrative records.

Security and choices

The website uses HTTPS. Customer passwords are checked as hashes; session cookies are secured, and access to administration is restricted. We limit access to information and use measures against repeated sign-in attempts and misuse. No internet service can guarantee absolute security. Report a possible data breach through the contact form.

The website does not make decisions about you based solely on automated processing that have legal or similarly significant effects. Suspicious requests may trigger a temporary technical block; contact us if this wrongly prevents you from continuing. A request does not sign you up for a newsletter or give consent to advertising tracking.

Your rights and contact

Depending on the circumstances, you can request access to, correction, deletion, restriction or transfer of your data. You can object to processing based on a legitimate interest. You can always object to direct marketing. Where processing is based on consent, you can withdraw that consent; processing that was lawful before withdrawal remains lawful.

Use the contact form for your request. We may verify your identity in an appropriate way; do not send a complete copy of your identity document without being asked. We normally respond within one month. If an extension is needed because of complexity or the number of requests, we inform you within that month and give the reason; the extension may be no longer than two months. A request is normally free.

You can submit a complaint directly to the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) or the competent supervisory authority in your EU country. We cannot always delete information that we are legally required to retain immediately; in that case, we explain what is possible.

Version and changes

Last updated: 22 September 2026. When a relevant change occurs, we update this statement and inform those affected where necessary. New processing that requires consent only begins after that consent is given.