Privacy Notice

Effective Date: 25 June 2026
Last Updated: 25 June 2026

‍

1. Data controller

‍

IDP International BV is the data controller for personal data collected through commercialsprints.com and related services. We process personal data in compliance with Regulation (EU) 2016/679 (GDPR) and the Dutch Implementation Act (Uitvoeringswet AVG).

IDP International BV: Orientblauw 10, 2718 KH Zoetermeer, The Netherlands

KvK number: 90975502

Privacy contact email: info@commercialsprints.com

Note: If IDP International BV is required to appoint a Data Protection Officer under GDPR Article 37, include the DPO's name and contact details here.

‍

2. Personal data we collect

‍

2.1. Website visitors

• IP address and approximate geolocation (collected automatically by web infrastructure).
• Browser type, device type, and operating system.
• Pages visited, time on site, and referral source (collected via analytics cookies with your consent).
• Information submitted through the Quick Scan diagnostic — this tool is designed to be used without providing an email address. Data entered is session-based unless explicitly submitted.

‍

2.2. Contact and enquiry forms

• Name.
• Email address.
• Company name and role (if provided).
• Message content and any additional information you voluntarily include.

‍

2.3. Newsletter and communications

• Email address (if you subscribe to updates or newsletters).
• Engagement data — opens and clicks — collected through our email service provider.

‍

2.4. Newsletter and communications

When you engage CommercialSprints for sprint services, we may collect additional business and contact information as set out in your service agreement. That data is governed by the Data Processing Agreement attached to or referenced in your service contract.

Note: Where IDP processes personal data on behalf of clients during sprint engagements, a Data Processing Agreement (DPA) under GDPR Article 28 is required. This Privacy Notice covers IDP's controller activities only.

‍

3. Legal basis for processing

‍

• Consent (GDPR Article 6(1)(a)) — for analytics cookies, marketing cookies, and newsletter subscriptions.
• Performance of a contract (Article 6(1)(b)) — for data necessary to deliver sprint services.
• Legitimate interests (Article 6(1)(f)) — for website security, fraud prevention, and service improvement, where not overridden by your rights.
• Legal obligation (Article 6(1)(c)) — where required by Dutch or EU law.

‍

4. How we use personal data

‍

• To operate and improve commercialsprints.com.
• To respond to enquiries submitted through contact forms or email.
• To deliver sprint services to contracted clients.
• To send newsletters and commercial communications (with your consent).
• To analyse website traffic and visitor behaviour (with your consent for analytics cookies).
• To comply with legal obligations.

‍

5. Data sharing and processors

‍

We do not sell personal data. We share data only with technology providers acting as data processors under GDPR-compliant agreements:

• Webflow Inc. (website hosting, USA — Standard Contractual Clauses apply) 
• Google LLC (analytics, USA — Standard Contractual Clauses apply)

We may also disclose personal data where required by law, court order, or to protect the rights, property, or safety of IDP International BV, its clients, or others.

‍

6. International data transfers

‍

Some technology providers are based outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses or an adequacy decision covering the recipient country.

‍

7. Retention periods

‍

• Contact enquiry data — up to 24 months from last contact, unless a commercial relationship develops.
• Newsletter subscriber data — until you unsubscribe or request deletion.
• Analytics data — Google Analytics: 2 months for events data and 14 months for user data.
• Sprint client data — as set out in the applicable service agreement, subject to statutory retention requirements under Dutch law.

Note: Dutch law (Burgerlijk Wetboek) requires retention of financial records for 7 years. Confirm applicable statutory retention obligations with your legal adviser.

‍

8. Your rights

‍

Under GDPR, you have the following rights in relation to your personal data:

• Right of access — to request a copy of the personal data we hold about you.
• Right to rectification — to request correction of inaccurate or incomplete data.
• Right to erasure — to request deletion of your data, subject to legal retention obligations.
• Right to restriction — to request limits on how we process your data.
• Right to data portability — to receive your data in a structured, machine-readable format.
• Right to object — to object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent — where processing is consent-based, to withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at: info@commercialsprints.com

We will respond within one month. Where a request is complex, we may extend by a further two months and will notify you accordingly.

You also have the right to lodge a complaint with the Dutch supervisory authority:

Autoriteit Persoonsgegevens — Postbus 93374, 2509 AJ Den Haag — www.autoriteitpersoonsgegevens.nl

‍

9. Security

‍

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or destruction. Measures include encrypted data transmission (TLS), access controls, and regular security assessments of service providers.

No transmission over the internet is completely secure. If you believe your interaction with us is no longer secure, notify us immediately at: info@commercialsprints.com

‍

10. Automated decision-making

‍

The Quick Scan diagnostic produces output based on your answers. This output is generated algorithmically as a structural indication only, not a binding assessment. No automated decision-making with legal or similarly significant effects is applied to individuals within the meaning of GDPR Article 22.

‍

11. Changes to this notice

‍

We review this Privacy Notice regularly. Material changes will be communicated through a notice on our website or by email where we hold your contact details. The effective date above reflects the most recent revision.

‍

11. Contact

‍

For any privacy-related question or request: info@commercialsprints.com