Your personal data
Privacy Statement
This statement explains how Vlas Construction B.V. handles personal data when you visit our website, contact us or request information about construction and renovation services.
Last updated: 27 August 2026
1. Controller and contact details
Vlas Construction B.V. is the controller for the processing described in this statement.
Vlas Construction B.V.Mercuriusweg 37
2516 AW Den Haag
Chamber of Commerce number: 82634645
Email: info@vlasconstruction.nl
Telephone: +31 6 20 77 39 99
Privacy requests can be sent to info@vlasconstruction.nl. We may ask for information needed to verify your identity before responding to a request.
2. Personal data we process
- Enquiry and contact data: name, email address, telephone number, city, project type, message and any files you choose to attach.
- Quotation and customer data: address/project location, requested work, correspondence, agreements, planning, invoices and payment or administration data when a business relationship follows.
- Website and technical data: IP address, browser/device information, page and referral information, security signals, consent choice and limited analytics or advertising identifiers when the relevant consent is granted.
- Communication data: emails, telephone notes and other information you provide when communicating with us.
Please do not include unnecessary sensitive personal data in open message fields or attachments.
3. Why we use personal data and our legal bases
| Purpose | Legal basis |
|---|---|
| Respond to questions, assess a project and prepare a quotation. | Steps at your request before entering a contract and our legitimate interest in handling business enquiries. |
| Perform construction/renovation agreements, communicate about work, invoice and maintain administration. | Performance of a contract and compliance with legal obligations. |
| Protect the website and forms, prevent spam/fraud, maintain logs and resolve technical problems. | Our legitimate interest in operating a secure and reliable service; necessary security technology is used for this purpose. |
| Measure website use and improve content and performance with Google Analytics. | Your Analytics consent. |
| Measure and personalise advertising with Google Ads and Meta Pixel. | Your Advertising consent. |
| Establish, exercise or defend legal claims and protect our business. | Our legitimate interest and, where applicable, a legal obligation. |
Where processing is based on consent, you can withdraw it at any time. Withdrawal does not affect processing that was lawful before withdrawal.
4. Website analytics, advertising and consent
Google Analytics 4, Google Ads and Meta Pixel are controlled by the choices in our privacy banner. Analytics and Advertising are separate. Advertising storage, advertising user data and advertising personalisation are granted only when you choose Advertising.
The website uses advanced Google Consent Mode. With optional consent denied, Google may receive limited cookieless and redacted measurement requests. Meta Pixel is not loaded before Advertising consent. For details, identifiers and typical storage periods, read our Cookie Statement.
Our first-party lead code sends a successful form event with only form identifier/name, language, lead type and page path. It does not read or intentionally send form values such as name, email, telephone, address or message to Analytics, Ads or Meta.
5. reCAPTCHA
Our forms use Google reCAPTCHA to distinguish legitimate use from spam and abuse. reCAPTCHA can process IP address, browser/device and interaction/security information and sets a necessary security cookie. Google's own terms and privacy policy apply to that processing.
6. Who may receive data?
We disclose personal data only where necessary to operate the business, provide the requested service or comply with law. Recipients may include:
- hosting, email, website, security and IT service providers;
- Google for reCAPTCHA and, according to your consent, Analytics and Ads;
- Meta when Advertising consent is granted;
- professional advisers, subcontractors or suppliers involved in a requested project, where appropriate and subject to suitable confidentiality arrangements;
- public authorities or other parties where disclosure is legally required or needed for legal claims.
We do not sell contact-form data.
7. Processing outside the EEA
Some technology providers operate internationally, so personal data or technical identifiers may be processed outside the European Economic Area. Where required, transfers rely on an adequacy decision, the EU Standard Contractual Clauses or another lawful transfer mechanism, together with appropriate supplementary safeguards. Provider privacy notices contain more information about their locations and mechanisms.
8. How long do we keep data?
- General enquiries that do not become a project are normally kept for no longer than 24 months after the last meaningful contact, unless needed longer for a dispute or another justified reason.
- Customer, contract, invoice and administration records are kept for the periods required by applicable tax, accounting and civil law.
- Security and technical logs are retained only for the limited period needed for protection, troubleshooting and provider operations.
- Analytics data and cookies follow the property settings and periods described in the Cookie Statement.
Data may be kept longer when required by law or reasonably necessary to establish, exercise or defend a legal claim.
9. Your privacy rights
Subject to the conditions in the GDPR, you may request access, rectification, erasure, restriction, data portability or object to processing. You can withdraw consent at any time. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
We do not use website data to make such solely automated significant decisions. We normally respond to a valid privacy request within one month. Complex or repeated requests may take longer where the GDPR permits.
If you believe your data is not handled correctly, please contact us first. You may also lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or seek a judicial remedy.
10. Security and changes
We use technical and organisational measures intended to protect personal data, including restricted access, secure connections, anti-spam controls and maintained systems. No internet service can guarantee absolute security.
We may update this statement when our services, providers or legal duties change. The date at the top shows the latest material revision.
