dopstack
Security & trust

Legal

Privacy Policy

How Dopstack handles personal data under the GDPR: what we collect, why, who receives it, how long we keep it and your rights.

Draft. This text has not yet been reviewed by a legal advisor and placeholders marked [CONFIRM] still need to be filled in.

Last updated: 11 October 2026

This policy explains how we handle personal data when you visit dopstack.com, contact us, book a call or apply for a job. We follow the General Data Protection Regulation (GDPR, in Dutch: AVG). Work we do for clients is covered by separate agreements.

Who is responsible

The controller for the processing in this policy is Aleeza Shahid, trading as Dopstack Technologies (Sole proprietorship (eenmanszaak)), [CONFIRM] Luios Daviddstraat 183, 2551 EE Den Haag, Netherlands, KVK [CONFIRM KVK number]. For anything about your data, email info@dopstack.com. We have not appointed a data protection officer; this is not required for a business of our size.

What we collect and why

Contact form and email
Name, email address, message, and optionally company, phone number, service of interest and budget range. Used to answer your enquiry and discuss a possible project. Legal basis: steps you ask for before a contract (Art. 6(1)(b) GDPR) or our legitimate interest in answering business enquiries (Art. 6(1)(f)).
Booking a call
Name, email address, chosen time and any notes you add in Cal.com. Used to hold the call. Legal basis: steps before a contract or legitimate interest, as above.
Clients and suppliers
Contact details, agreements, correspondence and invoicing details. Used to carry out the agreement and keep our accounts. Legal basis: performance of a contract (Art. 6(1)(b)) and our legal obligations, including tax record keeping (Art. 6(1)(c)).
Job applications
Your CV, letter and the details you send. Used to assess your application. Legal basis: steps before an employment contract and legitimate interest.
Website visits
Technical data such as IP address, browser, pages requested and time, processed by our hosting provider to deliver and secure the site. Legal basis: legitimate interest in a working, secure website.
Analytics (optional)
Pages viewed, interactions, approximate location and device information, through Google Analytics, only after you accept it. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time.

Please do not send passwords, sensitive personal data (such as health information) or confidential client data through the contact form. We do not use your enquiry for automated marketing, we do not sell personal data, and we do not make decisions about you by automated means only.

Who receives your data

We only share personal data where needed for the purposes above, with service providers that process it on our behalf under a data processing agreement:

  • Resend: delivers contact-form messages to our inbox.
  • [CONFIRM hosting provider, e.g. Vercel]: hosts this website.
  • [CONFIRM email provider, e.g. Google Workspace or Microsoft 365]: our business email.
  • Cal.com: call booking.
  • Google: Google Analytics, only if you consent.
  • [CONFIRM accountant and bookkeeping software]: our financial administration.

We may also disclose data when the law requires it, for example to the Dutch Tax Administration.

Data outside the EEA

Some of these providers are based in the United States or use sub-processors there. We only allow such transfers when an adequate safeguard is in place, such as certification under the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses. Ask us if you want details.

How long we keep it

  • Enquiries that do not lead to a project: up to 2 years after our last contact.
  • Client and supplier administration: 7 years, as Dutch tax law requires (Article 52 of the General Tax Act).
  • Job applications: up to 4 weeks after the procedure ends, or 1 year if you allow us to keep your details for future roles.
  • Analytics data: [CONFIRM: 14] months, set in our Google Analytics property.
  • Your cookie choice: on your own device until you change it or clear your browser data.

Your rights

You have the right to access, correct or delete your personal data, to restrict or object to its processing, to data portability, and to withdraw consent at any time without affecting earlier processing. Send your request to info@dopstack.com. We respond within one month and may ask you to confirm your identity.

If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

Security

We protect personal data with appropriate technical and organisational measures, including encrypted connections (HTTPS), access only for people who need it, and two-factor authentication on the accounts that hold data. No system is completely secure; if a data breach occurs that poses a risk to you, we report it as the law requires.

Our products and client work

Our products, such as MoveCubic, have their own privacy policy for the data processed inside the product. When we process personal data for a client during a project, we do so as a processor under a data processing agreement with that client.

Changes

We update this policy when our processing changes. The date at the top shows the latest version. See also our Cookie Policy.