Version: 2.0
Date: 24 August 2026

1. Data Controller

Balancify is responsible for the processing of personal data as described in this Privacy Policy.

Contact details

Balancify
Established in Silvolde, the Netherlands
Dutch Chamber of Commerce (KvK) number: 99382520
Email: support@balancify.nl
Website: www.balancify.nl

2. What Personal Data Do We Process?

Depending on the services provided and the circumstances, Balancify may process the following personal data:

• name, address and place of residence;

• contact details, such as telephone number and email address;

• date and place of birth;

• Dutch Citizen Service Number (BSN), insofar as its processing is permitted or required by law;

• identification and verification data, including information from an identity document;

• information relating to representatives, directors, shareholders and ultimate beneficial owners (UBOs);

• financial and administrative data;

• bank and payment details;

• tax-related data and information required for tax returns;

• information required for client due diligence and other obligations under the Dutch Anti-Money Laundering and Anti-Terrorist Financing Act (Wet ter voorkoming van witwassen en financieren van terrorisme, Wwft);

• correspondence and other information you provide to us;

• website, device and usage data, where applicable and permitted.

Balancify only processes personal data that is necessary or relevant for the purposes for which it is collected.

3. How Do We Obtain Personal Data?

In most cases, we receive personal data directly from you.

Where necessary and permitted, we may also receive or obtain personal data from other sources, including:

• the Dutch Tax and Customs Administration (Belastingdienst) and other competent government authorities;

• public registers, including the Dutch Trade Register and UBO Register;

• persons authorised or designated by you;

• your business, employer, representative or other parties involved in the provision of our services;

• administrative, accounting and tax systems used by Balancify.

Where personal data is not obtained directly from you, we will only process such data where a valid legal basis exists.

4. Legal Bases for Processing

Balancify only processes personal data where there is a valid legal basis for doing so.

Depending on the processing activity, this may include:

• Performance of a contract: where processing is necessary to enter into or perform our services.

• Legal obligation: for example, obligations arising from tax legislation or the Wwft.

• Legitimate interests: for example, securing our systems, conducting our business operations and establishing, exercising or defending legal claims, provided that your interests or fundamental rights do not override those interests.

• Consent: where consent is required for a specific processing activity, for example for certain non-essential cookies.

A BSN is only processed where there is a legal basis for doing so.

Where processing is based on consent, you may withdraw your consent at any time. This does not affect the lawfulness of processing carried out before your consent was withdrawn.

5. Purposes of Processing

Balancify may process personal data for the following purposes:

• entering into and performing agreements;

• providing administrative, accounting and tax services;

• preparing and filing tax returns;

• applying for or amending provisional tax assessments and submitting other tax-related requests;

• communicating and exchanging information with the Dutch Tax and Customs Administration insofar as necessary for the agreed services;

• maintaining accounts and preparing financial statements and reports;

• invoicing and processing payments;

• communicating with clients;

• carrying out client due diligence and complying with other obligations under the Wwft;

• complying with tax and other legal obligations;

• securing our systems and services;

• handling questions, requests, complaints and potential disputes;

• improving our website and services, where a valid legal basis exists.

6. Wwft and Client Due Diligence

Balancify may be required under the Wwft to carry out client due diligence.

In this context, Balancify may, among other things:

• establish and verify the identity of clients and representatives;

• identify UBOs and, where required, verify their identity;

• collect information regarding the purpose and intended nature of the business relationship;

• carry out a risk assessment;

• determine whether circumstances exist that present an increased risk;

• update information and monitor the business relationship throughout its duration insofar as required under the Wwft;

• take additional measures where required under the Wwft.

Where Balancify is legally required to obtain certain personal data and you do not provide the required information, Balancify may be unable to enter into a business relationship with you, perform certain Services, or may be required to terminate an existing business relationship.

7. Retention Periods

Balancify does not retain personal data for longer than necessary for the purposes for which it is processed, unless a statutory retention obligation or another valid reason requires a longer retention period.

Tax records and other information subject to statutory tax retention requirements are generally retained for 7 years.

Certain information is subject to a longer statutory retention period. This includes a 10-year retention period for certain information relating to immovable property and information relating to the Union Scheme or Import Scheme under the One Stop Shop (OSS).

Information that must be retained as part of client due diligence under the Wwft is generally retained for 5 years after termination of the business relationship or completion of the relevant transaction.

Statutory retention periods may also apply to information relating to reports of unusual transactions.

For other personal data, the retention period is determined based on the purpose for which the data was processed, applicable legal obligations and any need to retain information for the establishment, exercise or defence of legal claims.

After the applicable retention period has expired, personal data will be deleted or anonymised unless continued retention is permitted or required by law.

8. Sharing Personal Data with Third Parties

Balancify only shares personal data with third parties where this is necessary for the provision of our services, where we are legally required to do so, or where another valid legal basis exists.

Depending on the services provided, personal data may be shared with:

• the Dutch Tax and Customs Administration;

• competent government authorities and supervisory authorities;

• banks and other financial institutions, where necessary;

• providers of accounting, tax and administrative software;

• hosting, cloud, communications and IT service providers;

• professional advisers and other service providers, where necessary for our business operations or services.

Where a third party processes personal data on behalf of Balancify as a processor, Balancify will, where required by law, enter into appropriate arrangements regarding the processing and security of personal data.

Balancify does not sell personal data to third parties.

9. Processing Outside the European Economic Area

Certain service providers used by Balancify may process personal data outside the European Economic Area (EEA).

Where personal data is processed outside the EEA, Balancify ensures that a valid legal basis for the transfer exists and, where required, that appropriate safeguards are implemented in accordance with the General Data Protection Regulation (GDPR).

10. Security

Balancify takes appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, unauthorised alteration and other unlawful processing.

Depending on the systems and data involved, these measures may include:

• secure cloud storage;

• access restrictions;

• strong authentication methods, including two-factor authentication where possible;

• security measures for accounts, devices and systems;

• appropriate procedures for processing and storing confidential personal data;

• measures to restrict access to personal data to persons who require such access for their work.

11. Communication

Balancify may communicate by email, telephone and other communication channels used with the Client for the purpose of providing its services.

Personal data received through these channels is only processed insofar as necessary for our services, communications or compliance with legal obligations.

When processing identifying or otherwise confidential personal data, Balancify takes appropriate measures and does not retain such data for longer than necessary, unless a statutory retention obligation applies.

12. Cookies and Website

Balancify's website may use functional, analytical and other cookies or similar technologies.

Cookies that are necessary for the operation of the website may be placed without prior consent insofar as permitted by law.

Cookies for which consent is required will only be placed after consent has been obtained.

Further information about the cookies actually used and their applicable retention periods will, where applicable, be provided through our cookie banner or Cookie Policy.

13. Your Privacy Rights

To the extent provided for under the GDPR, you have the right to:

• access the personal data we process about you;

• have inaccurate or incomplete personal data corrected;

• request the deletion of personal data;

• restrict the processing of personal data;

• object to certain processing activities;

• receive or transfer your personal data where the right to data portability applies;

• withdraw previously given consent.

You can submit a request by contacting support@balancify.nl.

Balancify may request additional information where necessary to verify your identity. We will handle requests within the applicable statutory time limit.

Not every right can be exercised in all circumstances. For example, statutory retention obligations may prevent certain personal data from being deleted immediately.

14. Automated Decision-Making

Balancify does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or otherwise significantly affect you, unless explicitly stated otherwise and a valid legal basis exists.

15. Complaints

If you have any questions or complaints regarding the processing of your personal data, please contact us at support@balancify.nl.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

16. Changes

Balancify may amend this Privacy Policy if our services, working methods or applicable laws and regulations change.

The most recent version of this Privacy Policy will be published on our website.