Version: 2.1
Last updated: 13 October 2026
1. Introduction
Nostrion B.V. (“Nostrion”, “we”, “us” or “our”) attaches great importance to the protection of personal data. In this privacy policy we explain which personal data we process, why we process it, how we handle it and which rights data subjects have.
This privacy policy applies to the processing of personal data by Nostrion B.V. in connection with:
- the use of our websites;
- contact requests and business communication;
- our services;
- the use of the Nostrion Platform;
- other contacts with clients, suppliers, partners and other business relations.
We process personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable laws and regulations.
2. Who are we?
Nostrion B.V. has its registered office at Plesmanstraat 2, 3833 LA Leusden, and is registered with the Dutch Chamber of Commerce (Kamer van Koophandel) under number 42053269.
Contact details
Nostrion B.V.
Plesmanstraat 2
3833 LA Leusden
privacy@nostrion.com
Nostrion B.V. is part of a group of companies that includes Fidacta B.V. and Nostrion Healthcare B.V.
Where this is necessary to answer questions, handle requests, provide services or perform agreements, personal data may be shared with another company within the Nostrion group. Where a request relates to a specific service or company within the group, personal data may be passed on to the most relevant group company.
3. When do we collect personal data?
We may collect personal data when:
- you visit our website;
- you contact us via a contact form;
- you contact us by email, telephone or other means of communication;
- you request information about our services;
- you request a quotation;
- you enter into an agreement with us;
- you use the Nostrion Platform;
- you are in contact with us on behalf of a client, supplier, partner or other business relation.
4. Which personal data do we process?
Depending on the nature of the contact or the services, we may process the following categories of personal data.
Website visitors
When you visit our website, our hosting provider processes the technical data needed to deliver the page to you and to keep the website secure:
- IP address;
- browser and device information;
- the page requested and the date and time of the request.
We do not place cookies on our website, and we do not use analytics, tracking pixels or any other technology to follow your behaviour on or across websites.
Contacts and prospects
When you contact us, we may process, among other things:
- name;
- email address;
- telephone number;
- company name;
- job title;
- subject of your request;
- content of correspondence.
Clients, suppliers and business relations
In connection with our services, we may process:
- contact details;
- contract details;
- correspondence;
- invoicing and payment details;
- data necessary for the performance of the agreement.
Users of the Nostrion Platform
For users of the Nostrion Platform, personal data may be processed that is necessary to provide the agreed services. The nature of this data depends on the specific application and use of the platform.
In many cases we process this data on behalf of our clients. Further information on this is provided in section 6.
5. Why do we process personal data?
We process personal data only for clearly defined purposes and on the basis of a valid legal basis.
| Purpose of the processing | Category of personal data | Legal basis |
|---|---|---|
| Responding to contact requests and enquiries | Name, email address, telephone number, subject and content of the message | Legitimate interest: answering the questions you send us |
| Maintaining business relationships with prospects, clients and suppliers, including recording points of contact and correspondence | Contact details, correspondence and business communication | Legitimate interest: maintaining and developing our business relationships |
| Preparing, issuing and following up quotations | Contact details, company details and correspondence | Pre-contractual measures |
| Performing and managing agreements | Contact details, contract details and communication | Performance of a contract |
| Keeping financial records and complying with legal obligations | Contact details, invoicing and payment details | Legal obligation |
| Securing, managing and keeping available our website, systems and services | IP address, log data and technical metadata | Legitimate interest: keeping our website, systems and services secure and available |
We do not use automated decision-making, including profiling, that produces legal effects for you or similarly significantly affects you.
6. Processing on behalf of our clients
When our clients use the Nostrion Platform, they decide which personal data is processed and for what purpose. For that processing the client is the controller within the meaning of the GDPR, and Nostrion acts as processor.
As processor, we process this personal data only on the documented instructions of our client and in accordance with the data processing agreement we have concluded with them. We do not use this data for our own purposes, and we do not use it to train AI models unless the client has explicitly instructed us to do so.
If your personal data is processed within the Nostrion Platform by one of our clients, for example by your notary, please direct questions and requests about that processing to that organisation. If we receive such a request ourselves, we forward it to the client concerned and support them in handling it.
The rest of this privacy policy covers the processing for which Nostrion itself is the controller.
7. With whom do we share personal data?
Personal data is shared only where this is necessary to provide our services, perform agreements, comply with legal obligations or protect our legitimate interests.
Depending on the nature of the services, personal data may be shared with the following categories of recipients.
Companies within the Nostrion group
Personal data may be shared with companies within the Nostrion group, including Fidacta B.V. and Nostrion Healthcare B.V., where this is necessary to answer questions, handle requests, provide services or perform agreements.
Service providers and suppliers
We use carefully selected service providers for, among other things:
- hosting and cloud infrastructure;
- communication and collaboration services;
- customer relationship management;
- website hosting and content delivery;
- security and monitoring;
- administrative support.
These parties process personal data solely on behalf of our organisation and solely for the purposes for which the data was provided.
Professional advisers
Where necessary, personal data may be shared with professional advisers, such as accountants, auditors, legal advisers and other experts involved in our business operations.
Government bodies and supervisory authorities
We may provide personal data to competent authorities, supervisory authorities or other government bodies where this is required by law or necessary to protect the rights, safety or interests of our organisation, its clients or third parties.
8. International transfers of personal data
The Nostrion Platform
To provide the Nostrion Platform, we use exclusively a European processing chain. Personal data, documents and other data processed within the platform remain within the European Union and are processed only by suppliers operating under European law.
As a result, data processed within the Nostrion Platform remains within a European legal, organisational and technical framework.
Supporting business processes
For certain supporting business processes, such as communication, relationship management and internal business operations, we may use service providers that process personal data outside the European Economic Area. This concerns only personal data needed for these supporting processes and does not relate to data, documents or other information that users share or process within the Nostrion Platform.
Where personal data is processed outside the EEA, we ensure that appropriate safeguards are put in place in accordance with the GDPR. These safeguards may include:
- an adequacy decision of the European Commission;
- standard contractual clauses (Standard Contractual Clauses);
- other legal mechanisms that ensure an appropriate level of protection.
We periodically assess whether these safeguards remain appropriate for the processing concerned.
9. Retention periods
We do not keep personal data for longer than necessary for the purposes for which it was collected, unless a longer retention period is required by law or necessary to pursue legitimate interests.
The following retention periods apply:
| Category | Retention period |
|---|---|
| Contact requests via the website | 24 months after the last contact |
| Prospects and business contacts | 24 months after the last contact |
| Quotation requests and quotations | 24 months after the last contact |
| Agreements and contract documentation | Up to 7 years after termination of the agreement |
| Invoicing and financial records | 7 years |
| Security, audit and system log files | For as long as technically supported by the systems concerned, with a maximum retention period of 90 days, unless a longer retention period is necessary in connection with a security incident, investigation or legal obligation |
At the end of the applicable retention period, personal data is deleted, anonymised or otherwise taken out of use.
10. Security
We take appropriate technical and organisational measures to protect personal data against loss, unauthorised access and unlawful processing. These include encryption, personal accounts secured with multi-factor authentication and least-privilege access, logging and monitoring, and regular security testing.
Our information security and AI management systems are certified to ISO 27001, NEN 7510 and ISO 42001. More information about our measures is available in our Trust Center.
11. Your rights
Under the GDPR you have various rights with regard to your personal data.
Where applicable, you have the right to:
- request access to your personal data;
- have inaccurate personal data corrected;
- have personal data erased;
- restrict the processing of personal data;
- object to processing;
- have personal data transferred to yourself or another party (data portability);
- withdraw consent you have previously given.
If you wish to exercise any of these rights, you can contact us at privacy@nostrion.com. We will assess your request and respond within the statutory time limits.
12. Cookies and similar technologies
We do not place cookies on our website and we do not use tracking technologies. If this changes, we will update our Cookie Policy and, where required, ask for your consent first.
13. Contact and complaints
If you have any questions about this privacy policy or the way in which we process personal data, you can contact us at:
Nostrion B.V.
Plesmanstraat 2
3833 LA Leusden
privacy@nostrion.com
If you believe that we are not handling your personal data with due care, we ask you to contact us first so that we can look for a solution together. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via www.autoriteitpersoonsgegevens.nl.