privacy statement
Privacy Statement Website and Business Relations Blauw Research B.V.
Version: 1.0
Last updated: 23 September 2026
1. Who is responsible for the processing of your personal data?
Blauw Research B.V. (‘Blauw’) is the controller of the personal data processed as described in this privacy statement.
Address
Coolsingel 55
3012 AB Rotterdam
The Netherlands
Email
privacy@blauw.com
Blauw has appointed a Data Protection Officer (DPO). The DPO monitors compliance with privacy legislation within our organisation and is registered with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
You can contact our Data Protection Officer at:
privacy@blauw.com
This privacy statement applies to visitors to www.blauw.com, to the personal data processed through this website, and to our business contacts: (contact persons at) clients, prospects (for example those requesting a quote), suppliers and other business contacts.
A separate privacy statement for
research participants applies to research participants, respondents, panel members and other research activities. Applicants and (former) employees are also covered by a separate privacy statement, which is provided when you apply or enter into an employment contract.
Blauw Research B.V. is a Dutch market research agency, founded in 1993. We are a member of the Data & Insights Network and follow the Code of Conduct for Research and Statistics (Gedragscode voor Onderzoek en Statistiek). We also base our information security and privacy management on the principles of ISO/IEC 27001 and ISO/IEC 27701.
2. What personal data do we process?
Depending on how you use our website, we may process the following personal data:
Data you provide to us
When you fill in a contact form, request a quote or get in touch with us, we may process data including:
● first and last name;
● company name;
● job title;
● email address;
● telephone number;
● the content of your message;
● any documents you send with it;
● other information you provide voluntarily.
Data of clients and other business contacts
If you work with us as a client, prospect or supplier (or as a contact person for one), we may also process the following data:
● business contact details, such as name, job title, company name, email address and
telephone number;
● data regarding quotes, assignments and agreements;
● invoice and payment details of your organisation;
● correspondence and meeting notes relevant to the collaboration;
● data about how you interact with our newsletters and emails, such as opening emails and clicking links.
Data collected automatically
When you visit our website, technical data such as the following may be processed automatically:
● IP address;
● browser type;
● operating system;
● language settings;
● date and time of your visit;
● pages visited;
● referring website;
● device information;
● cookie data;
● technical log data.
We only process personal data that is necessary for the purposes
described in this privacy statement.
You are not legally obliged to provide us with personal data. However, without certain data, such as your name and email address, we cannot handle your question or quote request, or perform an agreement.
3. Why do we process your personal data?
We only process personal data for specified, explicit and legitimate purposes.
Contacting us
When you contact us through our website, we use your data to answer your question or handle your request.
Quote requests
When you request a quote, we use your personal data to assess your
request, contact you and prepare a suitable
quote.
Client relationship management and carrying out assignments
If you’re a client or work with us in another business capacity, we use your data to carry out assignments, prepare invoices, stay in touch with you and manage our business contacts in our CRM and ERP systems.
Newsletters and marketing communication
If you’ve signed up for them, we use your personal data to send you newsletters, event invitations, white papers and other relevant information about our services.
You can unsubscribe at any time using the link in each newsletter.
Improving our website
We analyse how our website is used so we can keep improving its content, performance, accessibility, security and ease of use.
Online marketing
With your consent, we use analytics and marketing cookies to measure how effective our ads are and to further improve our online services.
Security
We process technical data to protect our website, systems and data
against misuse, fraud, cyberattacks and unauthorised access.
Legal obligations
Where applicable, we process personal data to comply with
legal obligations or requests from competent authorities.
4. On what legal basis do we process personal data?
Legitimate interest (maintaining our business relationships)
5. What systems do we use?
To manage our website and provide our services, we use various systems and suppliers.
Personal data may be processed in this context.
The systems we use include:
● WordPress to manage our website;
● Microsoft 365 for email, calendars, documents and business communication;
● AFAS Profit as an ERP system for relationship management (CRM), project administration
and invoicing;
● Salesforce as a CRM system for managing client, prospect and
quote data;
● Act-On for sending newsletters and email marketing;
● Google Analytics 4 for website analysis;
● Google Tag Manager for managing scripts and tags;
● Google Ads for online advertisements and conversion measurements;
● website hosting and supporting IT services for keeping our website available
and secure.
Where legally required, we enter into a data processing agreement with suppliers who process personal data on Blauw’s behalf, setting out arrangements on security, confidentiality and GDPR compliance.
6. Who do we share personal data with?
We never sell your personal data to third parties.
We only share personal data when this is necessary for:
● the functioning of our website;
● the provision of our services;
● the maintenance and security of our IT environment;
● the fulfilment of legal obligations;
● or when you have given consent for this.
We always limit any disclosure of personal data to what is necessary for the purpose concerned.
7. International transfers of personal data
Some of our suppliers process personal data outside the European Economic Area (EEA). Where personal data is processed outside the EEA, we make sure appropriate safeguards are in place in line with the General Data Protection Regulation (GDPR). Depending on the supplier, this may be based on the EU-US Data Privacy Framework, supplemented where necessary by the Standard Contractual Clauses adopted by the European Commission.
An up-to-date overview of the recipients and processors Blauw uses, and the transfer mechanisms applied, is included in the Overview of Recipients and Processors, which forms part of this privacy documentation.
8. How long do we keep your personal data?
We do not keep personal data longer than is necessary for the purpose
for which it was collected, unless a legal retention obligation or a
legitimate interest requires a longer retention period.
Blauw applies the following retention periods as a starting point:
| Processing | Retention period |
|---|---|
| Contact form | Up to 3 months after your request has been handled |
| Quote requests | Up to 1 year if no agreement is reached |
| Correspondence | As long as necessary to handle your request or perform an agreement |
| Client and business contact data (CRM) | For the duration of the business relationship and up to 2 years after the last contact |
| Newsletter data | Until you unsubscribe |
| Google Analytics 4 | Up to 14 months |
| Cookie preferences | Up to 12 months |
| Web server logs | Up to 90 days, unless longer is necessary for security purposes |
When personal data is no longer necessary for the purpose for which it
was collected, it will be deleted or anonymised.
9. How do we secure your personal data?
Blauw Research B.V. takes the protection of personal data very seriously. That’s why we take appropriate technical and organisational measures to prevent loss, misuse, unauthorised access, alteration or unauthorised disclosure of personal data.
Our security measures include:
● encrypted connections (TLS/HTTPS);
● access management based on roles and permissions;
● strong authentication where appropriate;
● logging and monitoring of systems;
● regular security updates and patch management;
● backup and recovery procedures;
● network and endpoint security;
● security incident management;
● regular risk assessments;
● information security and privacy awareness training for employees.
We also regularly review our security measures and update them when technological developments, changes in legislation or new risks call for it.
Blauw bases its information security and privacy management on the principles of ISO/IEC 27001 and ISO/IEC 27701.
10. Minors
Our website and services are not aimed at children under 16.
We do not intend to collect or process personal data of children under 16 through our website.
If we discover that we have unintentionally processed personal data of a minor under 16, we will delete this data as soon as possible.
If you suspect that we have processed personal data of a minor, please contact us at privacy@blauw.com.
11. Automated decision-making
Blauw does not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you, as referred to in Article 22 of the General Data Protection Regulation (GDPR).
If you have given your consent, we may use marketing cookies to gain insight into your interests and to better tailor advertising and marketing communications to your preferences. This may be regarded as profiling for marketing purposes.
This form of profiling does not produce legal effects for you and does not constitute automated decision-making as referred to in Article 22 GDPR.
You can find more information about marketing cookies and your cookie preferences in our Cookie Statement. You can change or withdraw your consent for marketing cookies at any time via our cookie banner settings.
12. Cookies
Our website uses cookies and similar techniques.
Cookies are small text files that are stored on your computer, tablet or smartphone when you visit our website. They help our website function properly, give insight into how the website is used and can be used to improve our services and online communications.
We use the following categories of cookies:
● strictly necessary cookies to ensure the website functions properly and securely;
● analytics cookies to gain insight into how the website is used;
● marketing cookies to measure the effectiveness of online advertisements and better tailor advertisements to visitors.
For analytics and marketing cookies, we ask for your consent in advance via our cookie banner.
You can find more information about the cookies we use, their retention periods and the parties that place them in our separate Cookie Statement.
13. Your rights
Under the General Data Protection Regulation (GDPR), you have a number of rights regarding your personal data.
You can submit a request to:
● access your personal data;
● have inaccurate or incomplete personal data corrected;
● have your personal data deleted;
● have the processing of your personal data restricted;
● have your personal data transferred (data portability);
● object to certain processing;
● withdraw consent you have previously given.
Right to object. If we process your data on the basis of legitimate interest, you can object to this processing on grounds relating to your particular situation. You can always object to the use of your data for direct marketing, such as newsletters and email marketing. If you do, we will stop immediately.
You can submit a request via privacy@blauw.com.
Our Data Protection Officer will handle your request with care. We will normally respond within one month of receiving your request. Depending on the complexity and number of requests, this period may be extended by two months. If so, we will let you know within the first month.
To verify your identity, we may ask you to provide additional information.
If we cannot fulfil a request, or can only partly fulfil it, we will let you know and explain why.
14. Complaints
If you have any questions about this privacy statement or how Blauw Research B.V. handles your personal data, please contact our Data Protection Officer (DPO) at:
privacy@blauw.com
We will handle your question or complaint with care and aim to work with you to find a suitable solution.
If we are unable to resolve the matter together, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). You can find more information at www.autoriteitpersoonsgegevens.nl.
15. Changes
Blauw Research B.V. may update this privacy statement from time to time, for example when laws and regulations change, our services change or we start processing personal data in new ways.
The latest version of this privacy statement is always available at www.blauw.com.
We recommend checking this privacy statement regularly to stay informed of any changes.
16. Contact
If you have any questions about this privacy statement or the processing of personal data, please contact:
Blauw Research B.V.
Coolsingel 55
3012 AB Rotterdam
The Netherlands
Email: privacy@blauw.com
Blauw has appointed a Data Protection Officer (DPO) who monitors compliance with privacy legislation within our organisation. The DPO is registered with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and can be contacted at privacy@blauw.com.
Annex: Overview of Recipients and Processors
Blauw Research B.V. uses various suppliers and service providers to manage, secure and optimise its website. When these parties process personal data on Blauw’s behalf, they act as processors within the meaning of the General Data Protection Regulation (GDPR).
Where legally required, we enter into a data processing agreement with parties that process personal data on Blauw’s behalf. We regularly assess our suppliers on information security, privacy and GDPR compliance.
For Google Ads, Google acts as an independent controller, not as a processor. Google’s privacy policy also applies to this processing (policies.google.com/privacy).
The overview below relates only to the processing of personal data of business contacts and visitors to www.blauw.com.
Processor
(AFAS Software B.V.)
(independent controller)
* The exact location of the hosting and backup environment depends on the hosting provider contracted by Blauw. Blauw ensures that personal data is processed within the European Economic Area or, if it is transferred outside the EEA, that appropriate safeguards are in place in accordance with the GDPR.
Dit overzicht wordt periodiek gecontroleerd en bijgewerkt wanneer leveranciers wijzigen, nieuwe leveranciers worden ingezet of de aard van de dienstverlening verandert.
Version: 1.0
Last updated: 23 September 2026
This privacy statement is a translation of the Dutch original. In the event of any discrepancy, the Dutch version prevails.
