# Privacy Policy — English Summary

Plain-English summary of `privacy-policy-nl.md`, version 1.0, effective 30 September 2026. The Dutch text is legally binding.

## Scope

Rule Step B.V.'s public Privacy Policy under the AVG. Covers all processing for which Rule Step is the **Verwerkingsverantwoordelijke** (Controller), primarily its own administrative processing. For processing on behalf of clients (online services and consulting), Rule Step is the **Verwerker** (Processor); see the DPA.

## Key takeaways per article

- **Art. 1 — Definitions.** AVG, UAVG, Persoonsgegevens, Verwerking, Verwerkingsverantwoordelijke (= Rule Step), Verwerker, Sub-verwerker, B2C, B2B.
- **Art. 2 — Controller identity.** Rule Step B.V., KvK 42042967, RSIN 869445200, Amsterdam. FG/DPO = J.J. van Grondelle per bestuursbesluit.
- **Art. 3 — Processing tables.**
  - **Table 1 — Hosting:** purpose / categories / data / basis (6(1)(b) AVG execution + 6(1)(f) AVG legitimate interest) / retention (financial 7y, logs 30d, client 2y post-contract, backups 30d post-termination).
  - **Table 2 — Domain registration:** WHOIS for B2C shielded (R2-fix). ICANN/SIDN compliance under 6(1)(c).
  - **Table 3 — Consulting:** **B2B retention 5 years, B2C retention 2 years** (per D-4). Project communication, contact data.
- **Art. 4 — Legal bases & B2C/B2B separation.** 6(1)(a/b/c/f) only. **B2C: Boek 6 Afdeling 3 BW (6:193a-6:193s) prevails; consumer rights cannot be excluded or limited.**
- **Art. 5 — Retention & minimization.** 7-year financial retention per art. 193 Sr / 3:307 BW. Defensive 5-year (B2B) / 2-year (B2C) consulting retention per 3:306/3:307 BW.
- **Art. 6 — Third-country transfers.** EU/EER primary. Outside EER: SCC + TIA + DPF where applicable. WHOIS gTLD: SCC + TIA for ICANN (not DPF).
- **Art. 7 — Sub-processors.** 30-day notification mechanism (art. 28 lid 2 AVG); data subjects have no independent objection right.
- **Art. 8 — Security measures.** Art. 32 AVG TOMs + Cbw conditional (art. 8.6). No design/Figma/Adobe sub-processors.
- **Art. 9 — Breach notification.** 72-hour AP notification (art. 33 AVG); **48-hour client notification** (R2-fix). Internal datalekregister (art. 33 lid 5).
- **Art. 10 — Data subject rights.** Arts. 15-22 AVG. Free of charge; 1-month response (extendable to 3 months).
- **Art. 11 — Automated decision-making.** Domain suspension only, with right to human review.
- **Art. 12 — FG/DPO.** J.J. van Grondelle (per bestuursbesluit, art. 38 lid 6 AVG).
- **Art. 13 — DPIA.** Art. 35-36 AVG conditional on risk.
- **Art. 14 — Applicable law & forum.** Dutch law; B2B Amsterdam; B2C domicile option (Brussel I bis art. 18 lid 1; 6:194 lid 3 sub w BW).
- **Art. 15 — Amendments.** B2C 30-day notice for material adverse changes.
- **Annex 1 — Sub-processor register.** Hosting (EU partners, Realtime Register, Proxmox, billing placeholder), Domain (Realtime Register, TransIP, Gandi, ICANN, SIDN, payment processor).

## Notable adjudications

- All design-related references removed (Table 3 replaced by consulting-table).
- F2/F3 consulting-table (was 5 years for design) now split per D-4 (B2B 5y, B2C 2y).
- DPO = director per bestuursbesluit (art. 38 lid 6 AVG, allowed for small orgs).
- K-2 fix: forum cite now art. 18 lid 1 Brussel I bis.
- D-13: billing-platform redacted as placeholder.

For full legal text, see `privacy-policy-nl.md`.