Privacy Policy

1. Who we are

This website is operated by Ciconia Legal, a legal practice registered with the Dutch Chamber of Commerce (KVK) under number 74817566.

For questions about this privacy policy or the processing of your personal data, you can reach us through the contact form on our website.

2. What data we collect

We collect personal data only when you actively provide it to us:

Contact form

When you submit the contact form, we collect your name, email address, phone number (if provided), subject, and message. This data is stored securely and used solely to respond to your inquiry.

When you become a client

If you engage our support — such as for advisory work, a residence or work permit application, an expat scheme (30% ruling) application, or another application to or procedure with the Dutch authorities (for example the IND, UWV, or Belastingdienst) — we collect only the personal data that is necessary to carry out that specific matter. Depending on the case, this can include information such as your name, contact and address details, nationality, date and place of birth, your citizen service number (BSN), employment and salary details, bank details, information about family members, and identity or immigration documents — some of which may be sensitive. We ask only for what is genuinely needed for your matter, use it solely for that purpose, and treat it with care and confidentiality.

Expat scheme pre-assessment tool

The pre-assessment tool runs entirely in your browser. No personal data is collected, stored, or transmitted to our servers. Your answers are not saved and are lost when you close or refresh the page.

Website visits

We do not use cookies for tracking or advertising purposes, and we do not use Google Analytics or similar tracking tools. To understand how our website is used, we use privacy-friendly, cookieless analytics (Vercel Web Analytics). These analytics are aggregate only: they show us information such as how many people visit a page, which pages are most read, and the general country of origin. They do not use cookies, do not create a profile of you, and do not track you across other websites. Basic server logs may also be generated by our hosting provider for security and performance purposes.

3. Why we process your data

We process your personal data for the following purposes:

• To respond to your contact form inquiry (legal basis: legitimate interest / pre-contractual measures)
• To carry out the matter you engage us for — including preparing and submitting applications and representing you before the Dutch authorities (legal basis: performance of a contract)
• To comply with legal obligations (legal basis: legal obligation)
• To understand how our website is used, on an aggregate and cookieless basis, so we can improve it (legal basis: legitimate interest)

4. How long we keep your data

Contact form submissions are retained for as long as necessary to respond to your inquiry and for a reasonable period thereafter in case of follow-up questions. If you become a client, your data is retained in accordance with our professional obligations (generally 5 years after the conclusion of the matter, or longer where required by law).

5. Who has access to your data

We never sell your data or share it for marketing or commercial purposes. We share personal data in only two situations, and in each case only to the extent necessary.

Service providers that help us run our practice

These providers process only the limited data needed to deliver their service — essentially what you send us — and each is bound by a data processing agreement:

• Our website host (Vercel Inc.) — hosting of this website and cookieless, aggregate website analytics
• Our database provider (Supabase Inc.) — secure storage of contact-form submissions and, if you order online, your order details
• Our email provider (Google Workspace) — our email correspondence with you

To carry out your matter

If you are a client, we share the specific personal data required to handle your matter — and only that data. This may include the information described in section 2 above (such as, but not limited to, your name, contact and address details, BSN, salary details, and family and identity information). Depending on what your matter requires, we share it with the competent Dutch authorities or other parties involved — for example the IND, the UWV, a municipality (gemeente) or other authority, a translator or interpreter, or, where applicable, the courts — and always only to the extent necessary to carry out your matter, such as to submit an application on your behalf.

Some of these providers may process data on servers outside the EU/EEA. Where that is the case, appropriate safeguards (such as Standard Contractual Clauses) are in place.

6. Your rights

Under the General Data Protection Regulation (GDPR / AVG), you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict the processing of your data
• Request data portability
• Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens)

To exercise your rights of access, correction, deletion, objection, restriction, or data portability, please reach us through the contact form on our website. The right to lodge a complaint is exercised directly with the Autoriteit Persoonsgegevens — you do not need to go through us — via autoriteitpersoonsgegevens.nl.

7. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. Contact form data is transmitted over an encrypted connection (HTTPS) and stored in a secured database.

8. Changes to this policy

We may update this privacy policy from time to time. The most current version will always be available on this page with the date of the last update.