6. International Data Transfers

Our business is established in the European Union and our core consulting activities take place within the European Economic Area (EEA).

Personal data relating to housing applications is not transferred to countries outside the EEA unless such transfer is necessary for the housing application process. Where applicable, appropriate safeguards are applied.

Analytics data. Where analytics is active (see Section 10), website usage data may be transferred to and processed in the United States by Google LLC and Microsoft Corporation. These transfers are based on:

• the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework, under which both Google LLC and Microsoft Corporation are certified; and, as an additional safeguard,

• the Standard Contractual Clauses adopted by the European Commission, together with supplementary technical and organisational measures applied by these providers.

You have the right to request further information about these safeguards by contacting us at info@azupatoser.nl.

While subject primarily to EU data protection law, we strive to align with the principles of Japan’s Act on the Protection of Personal Information (APPI) when handling data of clients residing in Japan.

7. Data Retention

We retain personal data no longer than necessary for the purposes for which it was collected.

Client and inquiry data:

• Personal data collected in connection with inquiries or applications is retained only until it is clear whether a service agreement will be concluded, and is deleted without undue delay once the outcome is determined.

• If a service agreement is cancelled or the services are terminated, relevant personal data will be deleted within 14 days after cancellation or service completion, unless retention is required by law.

• Where personal data must be retained for legal, tax, or administrative obligations, such data will be stored for the legally required period only.

Website usage data:

• Google Analytics: user-level and event-level data is retained for a maximum of 14 months, after which it is automatically deleted by Google. Aggregated, non-identifiable reporting data may be retained longer.

• Microsoft Clarity: session recordings are retained for 30 days; aggregated heatmap data is retained for up to 13 months.

• Cookies stored on your device expire according to the periods listed in Section 10, or earlier if you delete them.

8. Rights of Data Subjects

Under the GDPR, you have the right to:

• Access your personal data

• Rectify or erase your personal data

• Withdraw consent at any time, where consent is the legal basis (see below)

• Object to or restrict processing

• Request data portability

How to withdraw consent for cookies and analytics:

• Open the cookie settings link in the footer of our website and change your preferences at any time; or

• Delete and block cookies through your browser settings; or

• Install the Google Analytics Opt-out Browser Add-on, available at https://tools.google.com/dlpage/gaoptout

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, please contact us at info@azupatoser.nl. We will respond to your request within one month.

If you believe that your personal data is being processed unlawfully, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), https://autoriteitpersoonsgegevens.nl.

9. Security Measures

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or alteration. These measures include controlled access to personal data, secure storage systems, and limiting access to personal data on a need-to-know basis.

10. Cookies and Similar Technologies

Our website uses cookies and similar technologies. A cookie is a small text file that is stored on your device when you visit a website.

10.1 Categories of cookies we use

Strictly necessary cookies and storage. These are required for the website to function and to remember the choice you make in our cookie banner, so that we do not have to ask you again on every visit. They are placed without consent, as permitted under Article 11.7a(3) of the Dutch Telecommunications Act. Framer, the platform our website is built on, does not place any cookies of its own.

Analytics cookies (consent required). We use Google Analytics 4 and Microsoft Clarity to understand how visitors use our website, which pages are most useful, and where visitors experience difficulties. For visitors from the European Economic Area and the United Kingdom, these cookies are only placed after you have given your explicit consent through our cookie banner.

We manage these tools through Google Tag Manager, which is configured so that, for these visitors, no analytics tags are loaded before consent is given.

Visitors outside the EEA and the United Kingdom. The consent requirement described above follows from European law and applies to visits from the European Economic Area and the United Kingdom. If you visit our website from outside these regions, analytics cookies may be active by default, based on our legitimate interest in understanding how our website is used. You can opt out at any time via the cookie settings link in the footer. This approach is consistent with the notice-based principles of Japan’s APPI.

Cookieless visit statistics. Framer, our hosting platform, counts page visits through an anonymous measurement endpoint. This measurement places no cookies, stores nothing on your device, and cannot be traced back to you as an individual.

We do not use advertising, retargeting, or social media tracking cookies.

10.2 Microsoft Clarity: session recordings

Microsoft Clarity records anonymised information about how visitors interact with our pages, including mouse movement, clicks, and scrolling, and can replay these interactions as a session recording. This helps us identify usability problems.

We have configured Clarity with the following privacy safeguards:

• Session recording is disabled entirely on our application form page (/apply). Information you enter when applying for our services, including age, occupation, and income-related information, is never captured by Clarity.

• Text input fields elsewhere on the site are masked, so their content is not recorded.

• IP addresses are anonymised by Microsoft and are not visible to us.

Further information is available in the Microsoft Privacy Statement: https://privacy.microsoft.com/privacystatement

10.3 Cookies placed on our website

For visitors from the EEA and the United Kingdom, the following cookies are placed only after you have accepted analytics cookies through our cookie banner. For other visitors they may be active by default (see Section 10.1):