Upscale Consultancy Financial Services
NL EN
Call 020 - 369 29 61 WhatsApp

Document B

Privacy statement

As tax advisers we work with data all day long, and a good part of it is personal data. So it makes sense that we handle it with care. No fine print, just explained the way we would tell you over the phone.

Last updated: 13 July 2026. This English version is a translation provided for convenience only. The Dutch version (privacyverklaring) is the leading text; in the event of any discrepancy between the Dutch version and this translation, the Dutch text prevails.

We are Upscale Consultancy Financial Services B.V. (Dutch Chamber of Commerce no. 93950071), with registered office at Treubweg 13, 1112 BA Diemen, the Netherlands. You can reach us at info@upscaleconsultancy.com or 020 - 369 29 61.

In this statement you can read which data we process, why, and what your rights are.

§ 1The essentials in short

  • We only process data that is necessary for our services or that the law requires us to process.
  • We never sell data and we do not use it for third-party advertising.
  • We process records both manually and by automated means (sometimes with AI tools), but a human always reviews the work and no decisions about you are made by a computer alone.
  • You have rights over your data, and you can simply exercise them with us by sending an e-mail or giving us a call.

§ 2Whose data do we process?

Website visitors and people who contact us. If you fill in the contact form, send us a WhatsApp message or call us, we process the data you provide: name, telephone number, e-mail address and your message.

Clients and their contact persons. If you become a client, we process what is needed to serve you well and what the law requires of us: contact and business details, identification data, financial data and the data in your records and tax returns.

Persons in our clients' records. A business's records also contain data about others: staff (for example, for payroll administration), customers and suppliers of that business, and sometimes the entrepreneur's tax partner and children (for the income tax return). We process this data because it is inseparable from keeping records and preparing tax returns.

Children. Our website and services are not aimed at minors; we do not knowingly collect data from children through the site. However, tax return files do sometimes contain data about clients' children, for example the balances of bank and savings accounts of children under 18 for box 3 (the Dutch wealth tax box). We process this because Dutch tax law requires it, only within the parent's file and with the same care as all other data.

§ 3What do we use this data for, and on what legal basis?

  • To perform our agreement with you: keeping your records, preparing annual accounts, preparing and filing tax returns, giving advice, and staying in touch with you. (Legal basis: performance of a contract.)
  • Because the law requires us to: think of tax legislation and the statutory retention obligation. (Legal basis: legal obligation.)
  • For our normal business operations: invoicing, file management, securing our systems and, if it really comes to that, collecting an invoice or handling a dispute. (Legal basis: legitimate interest.)
  • For anything else only with your consent, which you can withdraw at any time.

We do not use your data for automated decision-making with legal effects, and not for third-party marketing.

§ 4Our role: controller

For our accounting and tax services we are an independent controller within the meaning of the GDPR. This follows from the GDPR Guidelines for accountants, tax advisers and payroll professionals, drawn up by the Dutch professional bodies (NBA, NOB, RB, Novak and NIRPA) in consultation with the Dutch Data Protection Authority: engaging an adviser for their expertise is not the same as outsourcing "bare" data processing.

In practical terms this means that you do not need to conclude a data processing agreement with us for our regular services; we bear the responsibility for careful processing ourselves, as described in this statement. Should a specific service deviate from this in the future, we will make separate arrangements for it.

Are you an employer with staff data in your records? Then you remain the controller for your own personnel administration; we are the controller for the processing within our services.

§ 5Automated and AI-assisted processing

We do not only process records manually, but also by automated means. We do this to work faster and more consistently. In concrete terms: if you link us to your accounting software (SnelStart) as your accountant, our systems can automatically assess, categorise and correct bookings, for example purchase invoices posted to a suspense account. AI tools may be used in this process.

Clear ground rules come with that, and we stick to them:

  • A human always reviews the work. Automated processing supports our work; decisions with consequences for you or for persons in your records are not made by a computer alone.
  • Suppliers are bound by agreements. We contract the software and AI suppliers we use under data processing agreements with confidentiality obligations. They may not use your data for their own purposes, including training their models.
  • The same confidentiality as always. Our duty of confidentiality applies to automated processing just as much as to manual work.
  • Within the EEA where possible. If data is processed outside the European Economic Area, we ensure appropriate safeguards, such as the European Commission's standard contractual clauses.

§ 6Who do we share data with?

Only with parties that are necessary for our work, and never commercially:

  • The Dutch Tax Administration (Belastingdienst) and other authorities, for filing tax returns and complying with legal obligations.
  • Our regular payroll partner, if we arrange payroll administration for you.
  • Software suppliers, such as SnelStart (accounting), the Dutch Tax Administration (website), and our IT, hosting and e-mail suppliers.
  • Suppliers of automated processing and AI tools, as described above.
  • Debt collection, legal or insurance parties, only if necessary in a specific case.

With parties that act as a processor for us, we conclude data processing agreements.

§ 7How long do we keep data?

As short as possible, as long as necessary. The Dutch statutory retention obligation requires us to keep administrative records for seven years as a rule. Data from the contact form of people who do not become clients is kept for a maximum of six months. After that, we delete or anonymise data.

§ 8How do we secure your data?

We take appropriate technical and organisational measures: encrypted connections, access only for those who need it, two-step verification on our systems and careful selection of suppliers. A hundred percent guarantee does not exist, but should something nevertheless go wrong with your data, we act in accordance with the data breach notification obligation and inform you if necessary.

§ 9Your rights

You may always ask us for access to your data, for correction, deletion or transfer of it, for restriction of processing, and you may object to a processing operation. Just e-mail info@upscaleconsultancy.com; we respond within one month.

Because we want to be sure that a request really comes from you, we first verify your identity. We do this in the most privacy-friendly way possible: for clients via the e-mail address or telephone number we already know, and otherwise for example with a verification question about something only you can know. As a rule we do not ask for a copy of your identity document for this; that would actually generate more data than necessary.

To be honest with you: the statutory retention obligation takes precedence over the right to deletion. Data we are legally required to keep cannot be erased earlier, however much you might want that.

Do you disagree with how we handle your data? Let us know first, and we will almost certainly resolve it together. In addition, you always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

§ 10Cookies

Our website only uses functional cookies that are needed to make the site work. We do not use tracking or advertising cookies, which is why we do not need to bother you with a cookie banner. Should that ever change (for example, because we start keeping statistics that require consent), we will update this statement and neatly ask for your consent first.

§ 11Changes

We may amend this statement, for example if our working methods or the law change. The current version is always available on our website; at the top you can see when it was last updated.

Questions about privacy? E-mail info@upscaleconsultancy.com or call 020 - 369 29 61.