Legal
Privacy Policy
Version 1.0, September 2026.
We take your privacy as seriously as our work. On this page you can read which data we process about you, why, how long we keep it and what your rights are. No small print we wouldn't read ourselves. If you still have a question after reading, email privacy@daysix.nl.
Who are we?
Day Six Digitale Communicatie B.V.
Energieweg 4, 3641 RT Mijdrecht, the Netherlands
Chamber of Commerce (KvK) 88224953
privacy@daysix.nl · +31 (0)85 488 53 90
We are the controller for the data described in this policy. We do not have a data protection officer; that is not mandatory for a company of our size. Privacy questions are answered by Kevin Regelink.
Are you a customer of one of our clients?
We build and host websites, webshops and applications for other companies. If you use such a website or application, that company is responsible for your data and we are the processor. We then work according to the data processing agreement with that company and do nothing with your data outside their instructions. If you want to know something about your data on such a website, please contact that company. If you cannot work it out together, we will of course help.
Which data do we process, why and for how long?
You contact us via the form, email or phone
Which data: name, email address, phone number, company name and the content of your message
Why: to answer your question and prepare a possible quotation. Legal basis: legitimate interest, or preparation of an agreement
How long: up to 2 years after the last contact. If it becomes an assignment, the retention period for clients applies
You are a client or a contact person at a client
Which data: name, role, business contact details, communication, contract arrangements, invoicing and payment details and access credentials you give us
Why: to perform the agreement, invoice, provide support and document the project. Legal basis: performance of the agreement and legal obligation (tax law)
How long: up to 2 years after the end of the collaboration; invoices and records 7 years (statutory retention obligation)
You use our client portal (app.daysix.nl)
Which data: name, email address, login details (passwordless, via email code), project files you upload, messages and notifications, and when signing a data processing agreement your signature, date and IP address
Why: to give you access to your projects, files and agreements, and to record signing in a legally valid way. Legal basis: performance of the agreement
How long: as long as you have access, and up to 2 years after the end of the collaboration. Signed agreements are kept as long as the agreement and the statutory retention period run
You apply for a job with us
Which data: name, email address, phone number, CV, motivation, links to work you share and possibly a practical assignment
Why: to assess your application and stay in touch during the procedure. Legal basis: legitimate interest, and consent if we keep your data longer
How long: 4 weeks after the end of the procedure. With your consent up to 1 year, for a future vacancy
You visit daysix.nl
Which data: technical data such as IP address, browser type and the pages you visit, in the log files of our hosting party
Why: to keep the website secure and available and to detect abuse. Legal basis: legitimate interest
How long: log files up to 12 months
We email you about our work
Which data: name, email address and company name
Why: to keep existing clients and relations informed. Legal basis: legitimate interest for existing clients, otherwise consent. You can always unsubscribe via the link in every email
How long: until you unsubscribe, or up to 2 years after the last contact
Do we use cookies?
On daysix.nl we use functional cookies needed to make the website work, such as a cookie that remembers you are logged in to the client portal. We also use Google Analytics to see in broad terms how the website is used. We have set this up in a privacy-friendly way: IP addresses are anonymised, advertising features and data sharing with other Google services are switched off, and we do not show third-party advertising. We also host our fonts ourselves, so your data does not go to external font services.
Who do we share your data with?
We do not sell your data. We only share it with companies that help us do our work, and only to the extent necessary. With each of these companies we have a data processing agreement or their standard data protection terms apply.
CloudPress: hosting of daysix.nl and the client portal, backups and log files. EU data centre (Amsterdam)
Cloudflare: storage of project files in the client portal, security and CDN. EU region; Cloudflare is a US company, certified under the EU-US Data Privacy Framework
Microsoft 365: email, calendar, documents and archiving of project communication. EU (Microsoft EU Data Boundary); certified under the Data Privacy Framework
WeFact: invoicing and subscription administration. Netherlands
Brevo: sending login codes, notifications and system email from the client portal. EU
Slack: internal notifications about monitoring and support (no client data content). US, certified under the Data Privacy Framework
UptimeRobot and WPScan: availability and security monitoring of websites (URLs only, no personal data). EU and United Kingdom
Anthropic and OpenAI: AI tools for our internal work. We do not enter personal data of clients or applicants into AI services, unless a data processing agreement is in place and the client has agreed. US, with standard contractual clauses; data is not used for training
Google Analytics: statistics on the use of daysix.nl, set up privacy-friendly (IP anonymised, advertising features off). US, certified under the EU-US Data Privacy Framework
Accountant, bank and government: administration, payments and legal obligations. Netherlands
If your data is stored outside the European Economic Area, this only happens with companies certified under the EU-US Data Privacy Framework or with whom we have concluded the European Commission's standard contractual clauses. If you want to see them, email us.
How do we protect your data?
Security is our trade. A few things we always do:
Access only for those who need it, with two-step verification on all systems that support it
The client portal works without passwords: you log in with a one-time code by email, valid for a short time
Encrypted connections (TLS) on all our websites and systems, and encrypted storage of sensitive data such as access credentials
Daily backups, security updates and monitoring on our hosted environments
A fixed procedure for reporting data breaches: if we identify a breach that poses a risk to you, we report it to the Dutch Data Protection Authority and inform you
Do we make automated decisions about you?
No. We do not use profiling and do not make automated decisions that affect you. Job applications are always assessed by a human as well.
What are your rights?
You may always ask us for:
Access to the data we hold about you
Correction of data that is incorrect
Deletion of your data, unless we are legally required to keep it
Restriction of processing, or objection to processing based on our legitimate interest
Transfer of your data in a common file format
Withdrawal of consent you gave earlier; this does not affect what we did before the withdrawal
Email your request to privacy@daysix.nl. We respond within a month. To make sure it is really you, we may ask for confirmation via the email address we know from you. We never ask for a copy of your ID.
A complaint?
If you feel we are not handling your data properly, please let us know first. We usually solve it together. If we cannot work it out, you have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via autoriteitpersoonsgegevens.nl.
Changes
We update this policy when our work or the law requires it. The current version is always available at daysix.nl/privacy. In case of a material change we inform clients and portal users by email.
Last updated: 14 September 2026.