Privacy statement
- Edited 30 September 2024
- 7 min
The Netherlands Chamber of Commerce KVK (hereinafter: KVK) provides information, education, and support to entrepreneurs on key entrepreneurial topics. Our statutory tasks are aimed at registering, informing, and advising entrepreneurs. When carrying out these tasks, we process personal data for various purposes. In this privacy statement, you can read what data is involved, how we handle it, and how you can exercise your rights in relation to your personal data.
Direct links to
- What is personal data?
- What do we use your personal data for?
- Whose personal data does KVK process?
- With which third parties does KVK share my personal data?
- How do we ensure the security of your personal data?
- For how long will my data be stored?
- How can I exercise my privacy rights?
- Contact details
- About this privacy statement
1. What is personal data?
Personal data is any data that reveals something about you or that can be used to identify you as an individual. Examples of personal data are your name, contact details, and citizen service number (BSN). Information relating to a company is sometimes also personal data, for example, the KVK number of an eenmanszaak.
KVK does not process any special categories of personal data, such as race, religion, or political affiliation. In carrying out our statutory duties, we do process more sensitive personal data, such as a citizen service number (BSN) and director disqualifications. This is done only to the extent required by law, and we delete this data when we no longer need it. We may also process details on birthplace and nationality for use in
UBO registers.
What is processing?
Processing includes all operations that can be carried out with personal data, including recording, collecting, sharing, combining, consulting, and destroying.
2. What do we use your personal data for?
We use your personal data
Registering your company, and the data associated with it, is a statutory task of KVK, set out in the Commercial Register Act.
This data includes
- your name
- address details
- gender
- date of birth
- place and country of birth
- citizen service number (BSN)
- email address
- telephone number
What we use this data for
If you register a business in the Business Register, we process some data about you and your business to fulfil our statutory duties.
Your business must be registered in the Business Register, just like all Dutch companies. Based on the registration, you will receive a KVK number. This number is your unique company ID, enabling other entrepreneurs to check who they are dealing with, and allowing you to do business. Managing the Business Register is the statutory
responsibility of KVK.
Some of the personal data in the Business Register is made public and provided to third parties upon request. More information can be found under the heading 'For providing data from the Business Register'.
The Business Register lists the registered business addresses* of businesses and the private addresses of officers. The business address* is the place where a company carries out its activities. It is public, unless the business address* is shielded upon request. The private address of officers is not public except for the private address
of the keeper of books and records. As well as officers, the UBOs of companies and other legal entities are also listed.
* This includes the company’s visiting and/or postal address.Â
The Business Register is a public register. Managing the Business Register is a statutory task of KVK. The register is, amongst other things, intended to make entrepreneurs findable. To know whether the company they are doing business with exists, to find new customers, or to explore the market. This stimulates the economy.
This concerns the following data:
- your name
- date of birth
- place of birth
- business name (name of your company)
- your company’s address details
- legal structure
- email address
What we use this data for
By far the most data from the Business Register is used for the provision of public services. All public authorities, such as municipalities, provinces, and regional water authorities, use the Business Register to carry out their tasks. KVK also supplies data from the Business Register to private parties in return for payment. See the heading 'With which third parties will KVK share my personal data?' for more information.
These parties use this data for compliance purposes, legal security, fraud prevention, or market analysis.
Recipients of data from the Business Register must comply with the General Data Protection Regulation and the Telecommunications Act when using your data. This means that they are not allowed to use your data for marketing or other purposes. Almost always, recipients must inform you about their use of your data.
KVK keeps a so-called Non-Mailing Indicator and shares it with persons or companies who request your data. If you activate this Non-Mailing Indicator, all recipients of Business Register data are informed that you do not want to receive unsolicited mail or unsolicited visits to your home. Recipients of Business Register data must comply with this requirement.
If you are confronted with unwanted marketing based on Business Register data, you can file a complaint with the Authority for Consumers and (ACM), for direct marketing by email, or the Dutch Data Protection (AP) for direct marketing by post or telephone, or any other unwanted use of your data.
KVK has a statutory duty to register and publish director disqualifications under civil law (Bestuursverboden). The courts are generally the source of this data. The law states which information must be registered and what is published by KVK in the context of a director disqualification.
The law states which personal data must be published:
- First name
- Surname
- Year of birth
- Place of birth
- Country of birth
In addition, KVK processes other personal data that is only visible to certain groups of authorised persons. For example, citizen service number (BSN), date of birth, and address.
Under European legislation, the Netherlands is required to have, manage, and centrally register information on the ultimate beneficial owners (UBOs) of companies and other legal entities incorporated in the Netherlands (hereinafter the ‘UBO register’*). The UBO register is part of the Business Register.
The law stipulates which details of a UBO are registered (Commercial Registers Act 2007, article 15a). To give some examples:
- Name
- BSN (citizen service number, or fiscal identifcation number)
- Month and year of birth
- Date of birth
- Place of birth and nation of birth
- Nationality
- Country of residence
- Residential address
- Nature and size of the economic stake of the UBO
- Copies of documents that pertain to the details mentioned above.Â
Some of this data is only accessible to a limited group defined by law. This applies at least to the following data: BSN, fiscal identification number, date, place, and country
of birth, residential address, and copies of documents.Â
* See  (in Dutch) for information on the processing of personal data for the purposes of the UBO register trusts and equivalent legal constructions.
For example, when you call or email us with a question. This is part of our statutory duty to provide information and advice to entrepreneurs.
This concerns the following data
- identification data
- questions that you have asked
- contact history (when there was contact, with which department, via which channel)
- information from a submitted complaint
- email correspondence
- contact details of your social media accounts (if we want to answer a question you have asked via social media)
What we use this data for
- To be able to answer questions you have asked, we record the original question, any explanation, and any actions taken subsequently. We can also serve you better if we know what previous contact there has been. If we have arranged an appointment with you, we will also record this.
- In case of a complaint or complex question, information about the content is kept to ensure that your question is answered correctly. We also use this data to learn from and to improve our service.
- We respond to questions or other comments on social media.
To provide you with the best possible service, KVK continuously improves its products and services. For example, because we want to know what you think about our products and services and what can be improved next time. Your cooperation is always based on consent.
This concerns the following data
- identification data
- questions that you have asked
- contact history (when there was contact, with which department, via which channel)
- information from a submitted complaint
- email address
- email correspondence
- contact details of your social media accounts
We record the content of the contact you have had with us, for example, by recording telephone calls and chats. We also store and read cookies when visiting the website. More information can be found on our cookie page.
What we use this data for
- To better understand who uses our products, when they do so, and how often. With this information, we can make improvements so that our products better meet the needs of entrepreneurs.
- To get a better understanding of our customer groups, which helps us to better identify who is relevant to our products.
- To measure and evaluate customer satisfaction by means of customer satisfaction surveys by email, to determine which of our services and products are valued and which ones need improvement.
This concerns the following data
- name of the entrepreneur
- email address
- telephone number
- date of birth
- gender
- postal address and postcode of the company
What we use this data for
- We like to keep you informed about our products or services.
- When we do this by email, we ask for your consent to do so (opt-in email).
- For example, you can subscribe to our newsletter and email subscriptions.
- To make emails as relevant to you as possible, we ask you a few questions to get to know you better. We also link your KVK data, favourite subjects, and preferences to your newsletter profile, so that we do not send you information on topics that do not interest you.
- Every email subscription/newsletter you receive includes an option to unsubscribe.
- In some cases, we will also contact you by post or telephone, for example, to invite you to a seminar or event, or to make you aware of products and services you have indicated an interest in.
- Whenever we contact you by post or telephone, we always give you the option to opt out of this means of contact.
- We further analyse your data to understand the needs of entrepreneurs and tailor our services accordingly.
Good to know
We will not use your email address for marketing purposes unless you have given us your consent. You can stop marketing by email, post, or telephone at any time using the method indicated in the communication. This information relates only to KVK’s own marketing. Third parties sometimes use data from the Business Register for marketing purposes. See the heading 'For providing data from the Business Register' for more details.
This concerns the following data
- identification data (name, address, date of birth, etc.)
- identity documents
- photos and camera recordings
What we use this data for
- Visitors at the office or at an event organised by KVK will only be allowed access after registration, and should report to and identify themselves at the information desk.
- Security cameras are situated at every KVK entrance, filming visitors.
This concerns the following data:
- IP address
- details of visits to our websites (times of visits, pages viewed, keywords)
- devices used (PC, laptop, smartphone, tablet)
- personal data processed in cookies
What we use this data for
- Your IP address is processed by default when you visit websites. KVK only uses the IP address to allow you to participate in a survey (for example, testing a new website) or to participate in events.
- By monitoring visits to, and use of the website, we can improve your user experience by making it easier to navigate between pages. Based on your search behaviour, we can also better tailor the information displayed to your needs.
- By making sure that the website responds to the device used, all content (text, images, video) is displayed in optimal form.
- In addition to your browsing behaviour on our website, cookies help to further personalise the information offered. Cookies can also be used to store your personal preferences.
KVK places different types of cookies on your computer. Cookies are small text files that websites place on your computer when you visit the site. Placing cookies may involve the processing of personal data if the information in the cookie can be traced back to a person. For example, by using your IP address. We place cookies to make
the site work properly, to carry out statistical analysis, and to better serve you.
For more information about the cookies we place, see our cookie page.
Data obtained from third parties
In some cases, KVK receives your personal data from third parties. For example, from the Belastingdienst (Dutch Tax Administration) for the purposes of fraud research, from the Rechtspraak (Judicial System Netherlands) in case of an administrative ban or bankruptcy, or from the Basisregistratie Personen (Personal Records Database). These data are used to reduce the risk of incorrect or incomplete registrations, or of registrations of company names that already exist. Sometimes data is sent to us if an inaccuracy in the Business Register is reported via a feedback obligation.
3. Whose personal data does KVK process?
KVK processes personal data of entrepreneurs and of end users who purchase products from KVK. Different rules apply to registration in the Business Register and to informing clients about KVK products and services. In addition, KVK processes the personal data of website visitors to KVK.nl.
4. With which third parties does KVK share my personal data?
End users of data from the Business Register
The Business Register is a crucial source of information for entrepreneurs. For example, to check who they are doing business with and to keep their customer database up to date. This includes banks, insurers, telecommunications and energy companies, and business service providers. Information brokers who supply address files to third parties also use KVK data as a source of information.
All end users must comply with the General Data Protection Regulation, the Telecommunications Act, and other laws and regulations when using Business Register data. Data users are personally responsible for this compliance. We inform data users about this in our terms of use.Â
Public authorities
All public authorities are connected to the Business Register. They are obliged to use the authentic data from the Business Register when carrying out their public tasks. These include, for example, granting a licence or collecting taxes.
LEI register
LEI stands for Legal Entity Identifier. It is a worldwide unique 20-digit identifying code, based on ISO standard 17442. It is for companies and legal entities owning or trading certain financial products (shares, bonds, or derivatives). The LEI covers key reference information that allows clear and unique identification of legal entities taking part in financial transactions. LEI data can be divided into 2 levels: level 1 - who is who, and level 2 - who owns whom. Level 1 data contains registration details of the entity such as legal name, KVK number, and the legal and head office address. Level 2 contains information about an entity’s ownership structure and thus answers the question of who owns whom. The aim is to identify parent-subsidiary relationships in the corporate structure.
BRIS
Business registers in the European Union (and EEA) are connected via the Business Registers Interconnection System (BRIS) platform of the European e-Justice Portal. This also applies to the (Dutch) Business Register. KVK is not a data controller for this purpose. Refer to this privacy statement for more information. With the help of this platform, national (business) registers can exchange information.
Business information is also publicly available on the European e-Justice . This information is retrieved, via BRIS, in real time from the Business Register and consists of the company name, registered office, registration number, type of business, European Unified ID (EUID), business status, and the Non-Mailing Indicator (NMI). There may be personal information in this data exchange, for example in the name of the business.
International data transfer
In principle, your personal data will not be transferred to recipients in countries outside the European Economic Area (EEA). If this does happen, we will take appropriate measures, such as contractual arrangements, to ensure that your data is adequately protected. If you know that your data is being processed somewhere abroad, report this to KVK.
Open data and the Business Register
KVK has made datasets available as open data for reuse by third parties. The open datasets from the Business Register can be found on the government  and on our website. Personal data in the Business Register may be shielded in certain circumstances. For more information on how KVK handles open data, please refer to the Press theme (in Dutch). There you will find information about open data and the Business Register.
Service providers processing data on behalf of KVK
We are assisted in our work by other service providers. We only share personal data if it is needed for a particular assignment. And we make proper arrangements with those service providers about what they are allowed to do with your personal data. We record these agreements in contracts.
This is what the companies and individuals who help us do, for example:
- They design, maintain, and improve our IT systems, internet tools,
and applications. - They organise events, send emails or post, create videos and brochures.
- They carry out customer research, such as surveys.
5. How do we ensure the security of your personal data?
KVK has put in place appropriate technical and organisational security measures to protect your personal data from misuse and unlawful or unauthorised use. For example, we apply an access and security policy and enter into confidentiality agreements with third parties who work with sensitive personal data.
Our staff handle processed personal data with care. To this end, our permanent staff swear an oath of office, and temporary employees must sign a confidentiality agreement. Only authorised employees have access to personal data and only when necessary for the performance of their duties.
6. How long will my data be stored?
KVK does not retain your personal data for longer than is necessary for the purpose for which it was collected. In doing so, KVK complies with the terms laid down in the Basis Selectiedocument Kamer van Koophandel as established and published in the Government Gazette (Staatscourant) on 23 June 2022.
The Basis Selectiedocument is based on the documentation obligation laid down in the Archiefwet (Archives Act) 1995. In general, retention periods range from 1 to 10 years. KVK only deviates from the term when this is necessary for proper compliance with the privacy act GDPR, or when a specific situation requires it.
Business Register records are kept indefinitely. More information on retention periods for government archives can be found here:Â Government (in Dutch).
7. How can I exercise my privacy rights?
The following sections describe the rights you can exercise over your personal data and in which cases. Do you want to invoke any of these rights? Go to ‘Submitting a complaint’. We will then provide you with a response within 1 month.
Please note that these rights do not apply to personal data in the Business Register. If you want to view your data in the Business Register, you can do so via My business. Currently, this is only possible for sole proprietorships, but eventually, this option will be available for all registrations.
Right of inspection
You have the right to get access from KVK to the personal data that KVK processes about you, by submitting a request for access to personal data.Â
Right to rectification
If your personal data is incorrect, you can request us to correct the data.
Right to data erasure
In certain (in Dutch), you have the right to have your personal data (or part thereof) erased. For example, this applies when the personal data is no longer necessary for the purposes for which it was obtained, or when the data has been processed unlawfully.
Right to restriction of processing
In very exceptional cases, you have the right to have the processing of your personal data temporarily restricted. This applies in these cases:
- During the period KVK needs to check whether your report of inaccuracy of your data is correct.
- If the KVK no longer needs the data (and they must therefore be removed), but you indicate that you yourself still need the data for the establishment, exercise or substantiation of a legal claim.
- If you have objected to the processing by the KVK and are awaiting a decision on this.
- If the processing of data is unlawful, but you do not want your data to be deleted altogether (because you want to prevent your data from being processed again, for example, your data is on an opt-out list).
Right to object to processing
When KVK processes your data on the grounds of public interest or legitimate interest, you have the right to object to the processing of your personal data for information on KVK’s products and services.
8. Contact details of the Data Protection Office
KVK has appointed a Data Protection Officer (Functionaris Gegevensbescherming), whom you can contact at fg@kvk.nl.
Submitting a complaint
If you have a complaint about KVK’s processing of your personal data, you can file a complaint with us by completing this (page in Dutch). You can also file a report with the supervisory authority, the Dutch Data Protection (in Dutch).
If you have a complaint about the use of your personal data by a party other than KVK, we advise you to address that party and/or the Authority for Consumers and (for unsolicited email marketing, in Dutch) or the Dutch Data Protection (in Dutch), in case of postal or telephone marketing, or any other unwanted use of your data.
9. About this privacy statement
This is the privacy statement of the Netherlands Chamber of Commerce KVK, registered in the Business Register with KVK under number 59581883, concerning KVK.nl website. This privacy statement concerns data processing by KVK.
This privacy statement was most recently amended on 5 June 2024.
KVK has drawn up this privacy statement on the basis of the current situation. We constantly monitor relevant laws and regulations, on the basis of which we adjust the statement if necessary.