Privacy statement

Who are we?

TaxSavers B.V. is the controller for the personal data described in this statement, within the meaning of Article 4(7) GDPR. That means we decide why and how we process your data. We are registered with the Chamber of Commerce under 73318752, at Amsterdamseweg 71A, 1182 GP Amstelveen. You can reach us at info@taxsavers.nl or +31 20 2170120. We trade as TaxSavers, a tax-advisory and administrative-services firm in Amstelveen. In this statement we call ourselves TaxSavers, ‘we’ or ‘us’.

Our details are below. You can find more about our firm and our team on the page about us.

What does this statement cover?

This statement applies to all personal data we process. That is the data of clients, prospective clients, website visitors, people who register for our events and the contacts of business partners. It also covers data about your partner and children that you provide yourself. It applies to your use of taxsavers.nl and our client portal MyTaxSavers. It also covers every advisory, filing and administrative service we provide.

Does a specific service or campaign have its own privacy notice? Then that notice supplements this general statement. Where the two conflict, the specific notice takes precedence. Alongside this statement, our terms and conditions and our disclaimer apply to your use of our services and website.

Which personal data do we collect?

We ask only for the data your advice and our legal duties require. Depending on the service, this includes:

1. Identity and contact data: name, date of birth, nationality, address, email and phone number.
2. Financial and tax data: income, assets, deductions and allowances, plus your bank details and the documents you upload.
3. Employment and residency data: your employer, your status under the 30% ruling and your residency situation, where relevant to your return.
4. Account and usage data: login details for MyTaxSavers, correspondence with our advisors and limited technical logs.
5. Event registration data: your name and email, whether you live in the Netherlands, and, if you choose to answer, which situation describes you best and how you heard about the event. We also note the language of the page, the page and campaign link you came from (referrer and UTM tags) and a shortened IP address (only the first two parts), which we use to stop abuse of the form. If you tick a box to receive a newsletter, we record the exact sentence you agreed to and when.
6. Cookie choices: what you chose in our cookie banner and when, a shortened IP address (only the first two parts) and a one-way code of your browser details. The section ‘Which cookies does our website use?’ explains this.

Why do we process your BSN?

To file your tax return we must process your citizen service number (BSN). Dutch law permits this strictly for tax purposes. We never use your BSN for anything else.

Do we process special-category data?

We do not ask for special-category data, such as health data. Is a detail directly relevant to a deduction and do you give it to us yourself? Then we do process it.

How do we collect your data?

Most of the data we hold comes directly from you. That happens when you ask for a proposal, create an account, complete a questionnaire, upload documents or register for one of our events. We also receive data:

1. From the Belastingdienst (the Dutch tax authority) and other government bodies, where you have authorised us to act on your behalf.
2. From your employer or previous advisor, where relevant to your return and with your permission.
3. Automatically via our website: essential cookies on every visit. Statistics and marketing cookies and embedded content only after you accept them. The section ‘Which cookies does our website use?’ explains this in full.

Why do we use your data and on what legal basis?

We process personal data only on a lawful basis under Article 6 GDPR. The table below maps each purpose to its basis. For marketing cookies and embedded content the cookie section names the basis. Passing your details to New Business Group B.V. rests on your separate consent.

That company trades as A&H Finance.

Do we rely on consent? Then you may withdraw it at any time, without affecting processing that has already taken place. Do we rely on a legitimate interest? Then we have weighed that interest against your rights. You may object, as the section ‘What are your privacy rights?’ explains.

Our online events

Your confirmation email contains the Microsoft Teams link for the session, plus a calendar invite with the same link. The link is the same for every participant, so please don't share it. You don't need a Teams account. When you join, Microsoft processes the name you enter and technical data needed to run the call. You choose the name you show, and you can keep your camera and microphone off. We do not record our online events.

Who do we share your data with?

We share your data with the Belastingdienst, our processors, New Business Group B.V. and professional advisors. We never sell your data. Recipients fall into these groups:

1. Tax and government authorities: mainly the Belastingdienst, when filing your return on your behalf.
2. Processors acting on our instructions: vetted providers of secure hosting, tax-filing software, document storage and email. Brevo sends our Clarity newsletter and our event emails (confirmation and reminders); for an event, Brevo receives only your name, email and language. Microsoft provides Microsoft Teams, which we use to host online events. Cloudflare checks that our forms are sent by a person (Turnstile). Each acts only on our instructions. We sign a data-processing agreement with each of them.
3. New Business Group B.V., trading as A&H Finance. Registered at Amsterdamseweg 71, 1182 GP Amstelveen, KvK 24408221. We give the mortgage, insurance and pension advice. They handle the application and closing. Do you apply for a mortgage, insurance or pension? Then we pass your name, address, telephone number and email to them. We do that only after you have agreed to that transfer on the request form. That is a separate consent from the newsletter. You can give one without the other. That consent rests on Article 6(1)(a) GDPR.
4. Event partners, only with your consent. Some events are organised together with a partner, such as Amsterdam Financial Coaching for our Box 3 webinar. The registration form then shows a separate, unticked box for that partner's newsletter. Only if you tick it do we pass your name and email to that partner, after the event. Nothing else from the form goes to the partner. From then on the partner is responsible for your data under its own privacy statement, which the form links to. You can give this consent without signing up for Clarity, and the other way round. That consent rests on Article 6(1)(a) GDPR.
5. Professional advisors: auditors or lawyers, where strictly necessary and under a duty of confidentiality.

Every processor may use your data only for the purposes we specify.

Does your data leave the EEA?

We store and process your personal data within the European Economic Area (EEA). Does a processor ever need to transfer data outside the EEA? Then we ensure an adequate level of protection. For example through an adequacy decision of the European Commission or the EU Standard Contractual Clauses, with additional safeguards where required.

How long do we keep your data?

We keep your data no longer than needed, unless the law sets a longer period. The Algemene wet inzake rijksbelastingen is the Dutch general tax act. It often sets that longer period at seven years. The table below gives the period per type of data. It also states how long we keep your consent record.

Article 52(4) of the Algemene wet inzake rijksbelastingen sets the seven-year duty.

Does a retention period end? Then we securely delete the data or anonymise it irreversibly.

How do we keep your data secure?

We secure your data with appropriate technical and organisational measures. That is how we prevent loss, misuse and unauthorised access. Our measures include:

1. Encryption of data in transit (TLS) and at rest.
2. Strict, role-based access controls and multi-factor authentication for staff.
3. Regular backups, monitoring and security testing.
4. A confidentiality duty binding every advisor and employee.

Which cookies does our website use?

Without your consent our website sets only essential cookies. We measure visits with Google Analytics and Microsoft Clarity. They set cookies, so they only run after you allow statistics.

When a page loads, our server reads the cookie ‘ts_consent’. Is it absent? Then no statistics or marketing cookies are set and no embedded chat or video loads. Our own cookie banner asks your consent for three purposes: statistics, marketing and embedded content such as chat and video. The legal basis is Article 6(1)(a) GDPR. Rejecting and accepting are equally easy, in one click.

Do you send a form on our website and did you allow marketing? Then we pass a coded version of your email address to Google Ads together with the conversion. It is a SHA-256 hash: a one-way code from which the address cannot be read back. Google compares it with its own accounts to see whether you came through one of our ads (enhanced conversions). Google never receives your email address itself. Without marketing consent we send nothing.

You can adjust your choice at any time via the permanent ‘Cookie settings’ link in the footer. There you can also withdraw your consent. We store every choice as an unalterable record with a pseudonymous consent ID. That is how we prove your consent (Article 7(1) GDPR). We keep each record for 24 months after your choice, together with a copy that nobody can change or delete during that time. After 24 months we delete both. Your consent ID is shown in our cookie policy and in the cookie settings. Mention it when you ask us about your consent.

You can find the full list of cookies in our cookie policy. It gives the purpose, provider and retention period per cookie.

Do we make automated decisions?

We make no decisions with legal effects that rest solely on automated processing. The same goes for decisions with similarly significant effects. One of our advisors always reviews and signs off our advice.

What are your privacy rights?

Under the GDPR you have the following rights over your personal data. Below we explain each right briefly.

How do you exercise your rights?

Email privacy@taxsavers.nl or write to the postal address at the foot of this statement. To protect your data we may ask you to confirm your identity. Exercising your rights is free of charge and we reply within one month. For complex requests we may extend that period by two months. We then explain why. Article 12(3) GDPR sets the one month term and the extension.

How do you file a complaint?

Contact us first. We prefer to resolve your complaint together right away. You always have the right to lodge a complaint with the Dutch supervisory authority:

Do we collect children’s data?

Our services are for adults, not for children. We do not knowingly collect data from children under 16, unless a parent gives consent. Article 8 GDPR and article 5 UAVG set the age limit of 16. Do you believe we have done so anyway? Then contact us and we will delete it.

When does this statement change?

We update this statement when our services or the law change. The version number and the ‘Last updated’ date at the top always show the current edition. For material changes we notify you in advance, for example by email or a notice in MyTaxSavers.

How do you contact us?

You can reach our privacy contact by email or by post. We answer every question about this statement and about your personal data. These are the details:

We provide this privacy statement in English for our international clients. If the two versions differ, the Dutch text prevails. © TaxSavers B.V., version 3.4, 27 October 2026.