Privacy Notice

---

Last updated: 13 July 2026 

1. Who we are 

This Privacy Notice explains how Bokmaan B.V., trading as Bokmaan Consulting (“Bokmaan”, “we”, “us” or “our”), collects and processes personal data. 

Bokmaan provides business consulting, corporate establishment and operational support, financial administration and tax compliance support, payroll and employment support, immigration and expatriate tax support, EU regulatory compliance services and related professional and administrative services. 

Our contact details are: 

Bokmaan B.V.
Grote Bickersstraat 74
1013 KS Amsterdam
The Netherlands 

Chamber of Commerce (KvK): 92551580
VAT ID: NL866097260B01
Email: info@bokmaan.com 

2. Scope of this Privacy Notice 

This Privacy Notice applies to personal data processed by Bokmaan in connection with: 

• visits to and use of our website;  
• enquiries submitted through our website, by email or through other communication channels;  
• newsletter subscriptions;  
• requests for information, proposals or quotations;  
• client onboarding and engagement management;  
• client due diligence, KYC, AML and sanctions compliance activities, where applicable;  
• the provision of professional, advisory and administrative services;  
• communications with clients, client representatives, employees, expatriates, family members, suppliers and professional advisers;  
• invoicing, payment administration and general business operations;  
• compliance with legal and regulatory obligations; and  
• the establishment, exercise or defence of legal claims.  

This Privacy Notice applies whether we receive personal data directly from the individual concerned or from a client, employer, group company, authorised representative, authority, public register or other third party. 

3. Our role as controller or processor 

Bokmaan’s role under the General Data Protection Regulation (“GDPR”) depends on the nature of the relevant processing. 

Bokmaan acts as a controller where we determine the purposes and essential means of processing personal data. This generally includes processing for: 

• responding to enquiries and managing prospective client relationships;  
• client onboarding and Bokmaan’s own compliance procedures;  
• engagement and client relationship management;  
• professional assessments, advice and application support where Bokmaan determines how the relevant service is performed;  
• invoicing and financial administration;  
• information security and fraud prevention;  
• compliance with Bokmaan’s own legal obligations; and  
• the establishment, exercise or defence of legal claims.  

In certain engagements, Bokmaan may process personal data solely on the documented instructions of a client. This may apply, for example, to certain outsourced financial administration, accounting administration, payroll administration or other administrative processing services. 

In those circumstances: 

• the client generally acts as the controller;  
• Bokmaan acts as the processor;  
• the relevant processing is governed by the applicable engagement documentation and data processing agreement; and  
• the client determines the purposes and legal bases for that processing.  

This Privacy Notice continues to apply to any processing undertaken by Bokmaan for its own purposes, including onboarding, billing, security, compliance and legal claims. 

4. Whose personal data we process 

Depending on the relevant interaction or service, we may process personal data relating to: 

• website visitors;  
• persons submitting an enquiry through our website or by email;  
• newsletter subscribers;  
• prospective and existing clients;  
• directors, officers and authorised representatives of clients;  
• shareholders and ultimate beneficial owners;  
• employees, expatriates, job applicants and contractors of clients;  
• spouses, partners, dependent children and other family members involved in immigration or relocation procedures;  
• customers, suppliers, business partners and other contacts whose information appears in documents supplied for the services;  
• civil-law notaries, lawyers, accountants, tax advisers, payroll providers, translators and other professional advisers;  
• suppliers and service providers engaged by Bokmaan; and  
• other persons involved in an engagement or whose personal data are included in supporting documents.  

We may process personal data relating to children where this is necessary for a family immigration, residence, relocation or related administrative procedure. We do not use children’s personal data for marketing purposes. 

5. Categories of personal data 

The personal data we process depend on the nature of the relevant interaction or service and may include the following categories. 

Website enquiries and business contact information 

When you contact us through our website, by email or through another communication channel, we may process: 

• your name;  
• your company name;  
• your email address;  
• your telephone number, where provided;  
• your position or role;  
• the service in which you are interested;  
• the contents of your enquiry or message; and  
• subsequent correspondence concerning the enquiry.  

Please do not include passports, identification numbers, health information, criminal offence information or other sensitive personal data in an initial website enquiry unless Bokmaan has specifically requested the information and provided an appropriate method for submitting it. 

Newsletter subscription information 

Where you subscribe to receive news, updates or business insights, we may process: 

• your email address;  
• the date and source of the subscription, where available;  
• records of consent, where available;  
• email delivery, unsubscribe and preference information; and  
• limited information concerning interaction with an email, where provided by the relevant email service.  

Identity and contact information 

• name and title;  
• residential or business address;  
• email address and telephone number;  
• date and place of birth;  
• nationality;  
• gender, where required for an official application;  
• signature;  
• photograph;  
• passport, identity card or residence permit details; and  
• copies of identification documents where necessary and permitted.  

Professional and employment information 

• employer and group company;  
• job title, responsibilities and authority;  
• employment contract information;  
• employment history and qualifications;  
• working hours, salary, allowances and other remuneration;  
• payroll information;  
• assignment or expatriation information; and  
• information concerning employment commencement or termination.  

Corporate and compliance information 

• directorships and authorised signatory status;  
• shareholdings and ownership structures;  
• ultimate beneficial ownership information;  
• company and tax registration information;  
• source of funds or source of wealth information where required;  
• politically exposed person information;  
• sanctions and compliance screening results; and  
• client due diligence and risk assessment information.  

Immigration and family information 

• immigration and residence status;  
• visa and residence permit information;  
• travel and entry information;  
• family relationships;  
• marriage, birth and family relationship documentation;  
• information concerning accompanying family members; and  
• information required by the Immigration and Naturalisation Service or another competent authority.  

Tax and financial information 

• Dutch citizen service number (BSN), where permitted and necessary;  
• other tax identification numbers;  
• bank account and payment information;  
• income and remuneration information;  
• tax residence information;  
• invoices, payment history and transaction details;  
• VAT, payroll tax and corporate income tax information; and  
• information required for tax registrations, returns, applications, rulings or correspondence with tax authorities.  

Service and communication information 

• instructions and correspondence;  
• application forms and supporting documents;  
• records of meetings, reviews, advice and decisions;  
• documents submitted to or received from authorities;  
• engagement, quotation and contractual information; and  
• complaints, disputes and legal correspondence.  

Website and technical information 

• IP address;  
• browser type and version;  
• device and operating system information;  
• pages visited;  
• date and time of visits;  
• referring website;  
• cookie identifiers and preferences;  
• session and website interaction information; and  
• website security information.  

We only seek to process personal data that are relevant and reasonably necessary for the applicable purpose or service. 

6. How we obtain personal data 

We may obtain personal data: 

• directly from you;  
• through our website enquiry or subscription forms;  
• from a client that has engaged Bokmaan;  
• from your employer or another company within your employer’s group;  
• from an authorised representative;  
• from family members involved in the same application or procedure;  
• from public registers, including the Dutch Chamber of Commerce;  
• from government authorities and public bodies;  
• from banks, civil-law notaries and professional advisers;  
• from publicly available sanctions, PEP and compliance sources;  
• from third-party service providers; and  
• automatically when you use our website.  

Where a client provides personal data relating to employees, family members or other individuals, the client must ensure that it is authorised to provide the information and should make this Privacy Notice available to the relevant individuals. 

Bokmaan may also provide this Privacy Notice directly to the individuals concerned where appropriate. 

7. Purposes for which we process personal data 

We may process personal data for the following purposes: 

• responding to website, email and other enquiries;  
• communicating about our services;  
• preparing quotations, proposals and engagement documentation;  
• assessing whether we can accept or continue an engagement;  
• conducting client onboarding, KYC, due diligence, sanctions and compliance checks;  
• verifying the identity and authority of clients and their representatives;  
• providing the services agreed with a client;  
• assessing eligibility for registrations, permits, applications, rulings or other procedures;  
• preparing, reviewing and submitting applications, forms, returns and supporting documents;  
• communicating with clients, employees, family members, authorities and professional advisers;  
• monitoring deadlines, application progress and engagement status;  
• maintaining appropriate records of advice and services provided;  
• managing financial administration, tax, payroll, immigration, employment and regulatory compliance matters;  
• issuing invoices, processing payments and maintaining our financial administration;  
• managing suppliers, professional advisers and technology providers;  
• complying with legal and regulatory obligations;  
• responding to lawful requests from competent authorities;  
• maintaining the security and integrity of our systems and website;  
• preventing fraud, misuse, spam and cybersecurity incidents;  
• handling complaints and disputes;  
• establishing, exercising or defending legal claims;  
• analysing and improving our website and services; and  
• sending occasional newsletters, news updates and business insights to persons who have subscribed.  

We will not use personal data for a materially incompatible purpose without providing further information or obtaining consent where required. 

8. Legal bases for processing 

We rely on one or more of the following legal bases, depending on the relevant circumstances. 

Contract and pre-contractual steps 

We may process personal data where necessary to: 

• respond to a request made by an individual before entering into a contract;  
• enter into or perform a contract with an individual; or  
• provide a service requested directly by the individual concerned.  

Where the client is a company rather than the individual concerned, this legal basis does not necessarily apply to personal data relating to the client’s employees, representatives or family members. 

Legitimate interests 

We may process personal data where necessary for our legitimate interests or those of a client or another third party, provided that those interests are not overridden by the rights and freedoms of the individual concerned. 

These interests may include: 

• responding to business and service enquiries;  
• providing professional services requested by a corporate client;  
• processing information relating to a client’s employees, representatives or family members where necessary for an engagement;  
• managing client and business relationships;  
• communicating with business contacts;  
• carrying out appropriate client due diligence and risk management;  
• ensuring the quality and continuity of our services;  
• maintaining appropriate business and engagement records;  
• protecting our website, systems and information;  
• preventing fraud, spam and misuse;  
• collecting unpaid amounts; and  
• establishing, exercising or defending legal claims.  

Where appropriate, we assess whether our legitimate interests are proportionate to the effect of the processing on the individuals concerned. 

Legal obligations 

We may process personal data where necessary to comply with a legal obligation to which Bokmaan is subject, including obligations concerning: 

• accounting and tax administration;  
• record retention;  
• cooperation with competent authorities;  
• court orders and legally binding requests;  
• client due diligence, AML and sanctions compliance where applicable; and  
• other obligations under Dutch or EU law.  

Consent 

We rely on consent where required, including for: 

• newsletter subscriptions;  
• non-essential and analytical website cookies;  
• Google Analytics cookies; and  
• other limited processing where consent is the appropriate legal basis.  

Consent may be withdrawn at any time. 

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn. 

We do not generally rely on consent for processing that is objectively necessary to provide an agreed service or complete an official procedure. 

Where Bokmaan acts as a processor, the relevant client is responsible for determining the applicable legal basis for the processing carried out on its instructions. 

9. Special categories of personal data 

Bokmaan does not ordinarily request special categories of personal data, such as information concerning health, racial or ethnic origin, religion, political opinions, trade union membership, biometric data or sexual orientation. 

Such information may nevertheless appear in documents required for a particular employment, immigration, compliance or other official procedure. 

Where special category data are processed, we do so only where: 

• the information is necessary for a specific and legitimate purpose;  
• an applicable condition under Article 9(2) GDPR is satisfied;  
• the processing is permitted under applicable Dutch or EU law; and  
• appropriate safeguards are applied.  

10. Criminal offence and antecedent information 

Certain immigration, compliance or regulatory procedures may require an individual to complete or provide a declaration relating to criminal convictions, offences or antecedents. 

Bokmaan processes such information only where an applicable legal basis under Article 6 GDPR and the requirements of Article 10 GDPR are satisfied, including where the processing is carried out under the control of an official authority or is otherwise authorised by applicable EU or Dutch law providing appropriate safeguards. 

Where such information is handled in connection with an application or official procedure, Bokmaan limits the processing to what is reasonably necessary to prepare, submit and administer the relevant procedure. 

Bokmaan does not use such information for unrelated profiling, screening or decision-making. 

Access is restricted to persons who reasonably require the information for the relevant purpose. 

11. BSN and other national identification numbers 

The Dutch BSN and other national identification numbers are processed only where their use is necessary and permitted for the relevant tax, payroll, immigration or statutory administrative purpose. 

Bokmaan does not use the BSN as a general client number or business contact identifier. 

Access to documents containing a BSN is restricted to persons who reasonably require access for the relevant purpose. 

12. Sharing personal data 

We do not sell or rent personal data. 

We may share personal data, where reasonably necessary, with the following categories of recipients. 

Clients and related parties 

• the client that engaged Bokmaan;  
• the individual to whom the service relates;  
• authorised representatives;  
• employers and relevant group companies;  
• accompanying family members; and  
• other persons specifically authorised by the client or individual concerned.  

Authorities and public bodies 

Depending on the service, these may include: 

• the Dutch Immigration and Naturalisation Service;  
• the Netherlands Tax Administration;  
• Dutch municipalities;  
• the Dutch Chamber of Commerce;  
• the Employee Insurance Agency;  
• courts, regulators and supervisory authorities; and  
• other Dutch, EU or foreign authorities involved in the relevant procedure.  

Authorities generally process personal data under their own statutory responsibilities and act as independent controllers. 

Professional advisers and external specialists 

These may include: 

• civil-law notaries;  
• lawyers;  
• accountants and tax advisers;  
• payroll providers;  
• immigration specialists;  
• translators and legalisation providers;  
• regulatory and technical specialists; and  
• other external professionals reasonably involved in the services.  

Such parties may act as independent controllers or processors, depending on the nature of their involvement. 

Technology and operational service providers 

These may include providers of: 

• website hosting and website management;  
• email and communication systems;  
• cloud storage and document management;  
• accounting, CRM and business administration software;  
• electronic signature and secure document exchange services;  
• website analytics;  
• newsletter and email distribution services;  
• cybersecurity, backup and IT support;  
• banking and payment services; and  
• courier and delivery services.  

Where a service provider processes personal data on our behalf, we enter into appropriate contractual arrangements in accordance with Article 28 GDPR. 

Legal and regulatory disclosures 

We may disclose personal data where necessary: 

• to comply with a legal obligation;  
• in response to a lawful request from a competent authority;  
• to enforce an agreement;  
• to protect the rights, property or safety of Bokmaan or another person; or  
• to establish, exercise or defend legal claims.  

13. International transfers 

We seek to use service providers and systems located within the European Economic Area where reasonably practicable. 

However, personal data may be transferred to or accessed from countries outside the European Economic Area, for example where: 

• a client, employer or group company is located outside the EEA;  
• an application or transaction involves a non-EEA country;  
• an external adviser or service provider is located outside the EEA; or  
• a technology, analytics or communication provider uses international support or infrastructure.  

Where personal data are transferred outside the EEA, we use an appropriate lawful transfer mechanism, which may include: 

• a European Commission adequacy decision;  
• the European Commission’s Standard Contractual Clauses;  
• another transfer mechanism permitted under the GDPR; or  
• a specific GDPR derogation where applicable.  

Where appropriate, we assess whether supplementary contractual, technical or organisational measures are required. 

Further information about safeguards applicable to a particular transfer may be requested by contacting us. 

14. Data retention 

We retain personal data only for as long as reasonably necessary for the purpose for which they were collected, including applicable legal, regulatory, contractual, accounting and risk-management requirements. 

The applicable period depends on the nature of the information, the relevant service and the purpose of processing. 

Website and other enquiries 

Information relating to an enquiry that does not result in an engagement is generally retained for up to two years after the last substantive correspondence, unless there is a reason to delete it earlier or retain it longer. 

Where an enquiry results in an engagement, relevant information may become part of the client or engagement file. 

Newsletter subscriptions 

Newsletter subscription information is retained until: 

• you unsubscribe or withdraw your consent;  
• your email address is no longer valid;  
• Bokmaan determines that retention is no longer necessary; or  
• Bokmaan permanently discontinues the newsletter.  

The newsletter may be issued irregularly. 

Where the newsletter has been inactive for an extended period, Bokmaan may ask subscribers to reconfirm their subscription before further newsletters are sent. 

Bokmaan may remove subscription information where consent cannot be adequately confirmed or continued retention is no longer appropriate. 

After an unsubscribe request, we may retain a minimal suppression record to ensure that no further newsletters are sent to the relevant address. 

Each newsletter will include an appropriate method to unsubscribe. 

Engagement and case records 

Engagement and case records are retained for the duration of the engagement and thereafter for a period determined by: 

• the nature of the service;  
• applicable statutory obligations;  
• reasonable follow-up requirements;  
• the need to demonstrate the services performed;  
• the management of complaints or disputes; and  
• applicable limitation periods for legal claims.  

Core contractual, advisory and correspondence records may be retained where necessary for these purposes. 

Higher-risk supporting documents, including passport copies, BSNs, family certificates and antecedent forms, are subject to shorter, case-specific retention periods where appropriate and are deleted, redacted or placed under restricted access when they are no longer necessary for the relevant purpose. 

Financial and business administration 

Invoices, payment records and records forming part of Bokmaan’s statutory business and tax administration are generally retained for seven years, or for a longer period where required by applicable law. 

Client due diligence and compliance records 

CDD, KYC, AML and sanctions-related records are retained for the period required or permitted under applicable law. 

Where the Dutch Money Laundering and Terrorist Financing (Prevention) Act applies, relevant identification and due diligence records may generally be retained for the applicable statutory retention period. 

Google Analytics 

Our current Google Analytics retention settings are: 

• event-level data: two months;  
• user-level data: fourteen months.  

The user-level retention period is reset when new user activity is recorded. This means that the retention period for an active user may restart following a new visit or interaction. 

These settings apply to user-level and event-level information stored by Google Analytics. Aggregated information included in standard analytical reports may remain available for a longer period. 

Other website and technical information 

Cookies and other technical information are retained according to the duration of the relevant cookie, security requirement or website service configuration. 

Personal data may be retained for a longer period where required by law, a competent authority, an actual or anticipated legal claim or another overriding legal necessity. 

15. Data security 

We implement technical and organisational measures appropriate to the nature of the personal data and the risks associated with the processing. 

These measures may include: 

• access restrictions based on business need;  
• authentication and account security measures;  
• secure cloud storage and transmission;  
• confidentiality obligations;  
• backup and recovery arrangements;  
• security and software updates;  
• service-provider due diligence;  
• procedures for handling security incidents; and  
• periodic review of access rights and retention.  

Access to passports, BSNs, family documentation, financial data and other higher-risk information is limited to persons who reasonably require access for the relevant purpose. 

Although we take reasonable steps to protect personal data, no electronic transmission or storage system can be guaranteed to be completely secure. 

16. When providing personal data is required 

Certain personal data may be required: 

• by law or regulation;  
• by a competent authority;  
• under an engagement or contract;  
• to verify identity or authority;  
• to complete client due diligence; or  
• to perform a requested service or application.  

Where required information is not provided, Bokmaan may be unable to: 

• respond fully to an enquiry;  
• accept or continue an engagement;  
• provide the requested service;  
• submit an application; or  
• complete the relevant procedure.  

We will indicate, where reasonably possible, whether providing particular information is mandatory and the likely consequences of not providing it. 

17. Your rights 

Subject to the conditions and exceptions set out in the GDPR, you may have the right to: 

• request access to your personal data;  
• request correction of inaccurate or incomplete personal data;  
• request deletion of your personal data;  
• request restriction of processing;  
• object to processing based on legitimate interests;  
• object at any time to processing for direct marketing purposes;  
• receive certain personal data in a structured, commonly used and machine-readable format;  
• request transfer of eligible personal data to another controller;  
• withdraw consent where processing is based on consent; and  
• object to a decision based solely on automated processing where it produces legal or similarly significant effects.  

You may unsubscribe from newsletters at any time by using the unsubscribe function included in an email or by contacting us. 

To exercise another right, please contact: 

info@bokmaan.com 

We may request information reasonably necessary to verify your identity and prevent unauthorised disclosure. 

We normally respond within one month. This period may be extended where permitted by the GDPR, for example where a request is particularly complex or numerous. We will inform you if an extension is required. 

These rights are not absolute and may be limited where an applicable legal exception applies, including where information must be retained by law or is necessary for legal claims. 

Where Bokmaan processes personal data solely as a processor on behalf of a client, we may forward or refer the request to the relevant client as controller. 

18. Automated decision-making 

Bokmaan does not ordinarily use personal data to make decisions based solely on automated processing that produce legal effects or similarly significantly affect individuals. 

We may use automated tools for limited supporting purposes, such as spam detection, website security or record organisation. 

Material decisions are subject to appropriate human involvement. 

19. Website cookies, Google Analytics and reCAPTCHA 

Our website uses cookies and similar technologies. 

Necessary cookies 

Necessary cookies support the security, operation and basic functionality of the website. 

These cookies are used without consent where permitted by applicable law. 

Google Analytics 

We use Google Analytics to understand how visitors use our website and to improve its content, functionality and performance. 

Subject to your cookie consent, Google Analytics may process information such as: 

• pseudonymous cookie and user identifiers;  
• session and interaction information;  
• pages viewed and website events;  
• browser, device and operating system information;  
• approximate geographical information;  
• referring website information; and  
• the date and time of website interactions.  

The legal basis for placing and using Google Analytics cookies is your consent. 

Google Analytics cookies are placed only after you have accepted analytical cookies through our cookie banner. 

You may decline analytical cookies through the cookie banner. To reset a previous cookie choice, you can delete the cookies stored for this website in your browser and revisit the website. 

Our current Google Analytics retention periods are described in Section 14 of this Privacy Notice. 

Google may process or access information outside the EEA. Where applicable, international transfers are subject to appropriate safeguards as described in Section 13. 

Further information about Google’s processing is available in Google’s Privacy Policy. 

Google reCAPTCHA 

We use Google reCAPTCHA to protect website and contact forms against spam, fraud and automated abuse. 

Google reCAPTCHA may process technical and interaction information, including: 

• IP address;  
• browser and device information;  
• website interaction information; and  
• information necessary to assess whether an action is performed by a human user.  

We use reCAPTCHA on the basis of our legitimate interests in protecting our website, communication channels and systems against spam, abuse and security threats. 

Further information is available in Google’s Privacy Policy and Terms of Service. 

20. Complaints 

Please contact us first if you have a concern about how we process personal data. We will seek to review and address the concern appropriately. 

You also have the right to submit a complaint to the Dutch supervisory authority: 

Autoriteit Persoonsgegevens
Dutch Data Protection Authority 

The Authority’s contact and complaint information is available through the Autoriteit Persoonsgegevens website. 

Where you normally reside or work in another EEA country, you may also have the right to contact the supervisory authority in that country. 

21. Changes to this Privacy Notice 

We may update this Privacy Notice to reflect changes in: 

• our services or processing activities;  
• our website and communication activities;  
• the systems or service providers we use;  
• legal or regulatory requirements; or  
• relevant guidance and operational practices.  

The updated version will be published on this page with a revised “Last updated” date. 

Where an update materially affects how we process personal data, we may provide additional notice where appropriate. 

22. Contact 

For questions about this Privacy Notice, our processing of personal data or the exercise of privacy rights, please contact: 

Bokmaan B.V.
Grote Bickersstraat 74
1013 KS Amsterdam
The Netherlands 

Email: info@bokmaan.com