EcomStream B.V. – Privacy Policy

Last updated: 29 September 2026

EcomStream B.V. ("we", "us", "our") processes personal data in accordance with the GDPR and Dutch law. This policy explains what we collect, why, and what you can do about it.

1. Who we are

EcomStream B.V., Frederik Hendriklaan 25, 3708 VA Zeist, The Netherlands. Email info@ecomstream.nl, telephone +31 (0)85 00 23 062. We are the controller for the processing described below.

Legal form: Besloten Vennootschap (B.V.), a private limited company under Dutch law. Authorised representative: Ramon Helwegen. Registered with the Dutch Chamber of Commerce (Kamer van Koophandel) under number 69283265. VAT identification number NL857815684B01.

EcomStream renegotiates PSP costs, runs payment RFPs and manages payment performance for retailers and brands, on merchant mandate. This activity requires no regulatory licence. EcomStream is not a payment service provider, an acquirer, or a payment institution.

This website is hosted by VDX Internet Services B.V., Vondellaan 47, 2332 AA Leiden, the Netherlands, Chamber of Commerce number 08190856.

2. Data you give us

We collect personal data when you contact us by email or through a contact form on this website. This concerns your name, email address, and whatever you choose to include in your message. We use it solely to respond to your enquiry and to maintain the business relationship that follows from it. The legal basis is our legitimate interest in responding to enquiries directed at us, and where a client relationship follows, the performance of that agreement. A request through a contact form is also linked to your visits to this website, as described in section 4.

Form submissions are delivered to our email environment, which runs on Google Workspace. Data is retained for up to seven years in line with Dutch tax law, or until you ask us to erase it.

Booking a call. When you book a call through our booking page, you provide your name, your email address and the details the booking form asks for. The booking page runs on Cal.com, which passes the booking on to us. We use these details to prepare and hold the call. The legal basis is our legitimate interest in handling requests directed at us and the steps you ask us to take before entering into an agreement. The retention periods above apply. A booking is also linked to your visits to this website, as described in section 4.

Payment set-up check. When you use the payment set-up check on this website, we receive the shop address you enter. The check reads the public pages of that shop, the same pages any visitor can open, and needs no access to any system. We log the address, the outcome and the time to keep the check within its daily limit. If you request the full payment scan, we also receive your name, your business email address and the markets you select, and use them to carry out the scan and send you the report. We only contact you about the report if you tick the box for that. Starting the check and requesting the scan are also recorded as actions in the visitor identification described in section 4, and a scan request is linked there to your visits to this website. The legal basis is our legitimate interest in handling requests directed at us and, for the scan, the steps you ask us to take before entering into an agreement. The check runs on Google Apps Script and requests reach our email environment on Google Workspace; the retention periods above apply.

3. Website statistics

We do not use a third-party analytics service on this website. No analytics cookie is placed on your device, and no data about your visit is sent to an external statistics provider. We measure how the site is used through our own visitor identification, described in section 4.

4. Business visitor identification

We operate our own visitor identification on this website. Its purpose is to recognise which organisations show interest in our services, so that we can follow up commercially. It is aimed at organisations. Visits are linked to you as a person only when you contact us yourself, as described below.

When you open a page, we record the page address, time, time spent on the page, scroll depth, the buttons, booking and contact links and downloads you click, device type, browser and operating system, browser language, time zone, the referring website, and any campaign parameters in the link you followed. We also record your internet connection and the technical characteristics that tell automated visitors apart from people.

Your IP address is used to establish which organisation or provider your connection belongs to. To that end we look it up in public internet registries and in the reverse DNS; for the registry lookups we use ipwho.is, rdap.org, and stat.ripe.net. To tell a company network apart from that of an internet provider, we also look up the number of the network your connection runs on, the AS number, in PeeringDB, a public database of networks. Only that network number is sent, not your IP address. Where a company domain is identified, we may retrieve the public homepage of that domain to obtain a short description of the organisation, and the public pages of its website to record which e-commerce platform, PSPs and payment methods it uses. Once these lookups have run, as a rule within an hour, the IP address is reduced to the surrounding network range, the first three blocks for IPv4 and the first three groups for IPv6, and only that range is kept.

Connections that belong to consumer internet providers, mobile networks, hosting companies, VPN services, and automated crawlers are marked as such and are not treated as business visitors.

If you contact us through a form on this website, book a call or request a payment scan, we link that request to the visits recorded from the same internet connection and browser. This shows us which subjects your request relates to. For this we use the name, email address and company name you give in the request itself. To connect a booking on Cal.com to your visit, the booking links on this website carry a random reference code that has no meaning outside our own records.

This processing takes place on our own servers. It uses no cookies and stores nothing on your device. Apart from the lookups described above, the data is not shared with third parties. It is not used for advertising. A recognised organisation is linked, at the level of the organisation, to what we have already recorded about that organisation ourselves, so that we can see whether it is known to us. Apart from that link and a request you send us yourself, the data is not combined with data from other sources. The legal basis is our legitimate interest in identifying business interest in our services, in understanding how our website is used, and in handling requests directed at us. Visit records, including the link to a request, are deleted automatically after 90 days.

If you would rather not be included, contact us at info@ecomstream.nl and we will exclude the network range concerned and delete the link to your request.

5. Cookies and similar technologies

This website places functional cookies only. These come from WordPress, the Divi theme, and WPML, which uses a cookie to remember your language preference. They are necessary for the site to work and are not used to build a profile of you.

We do not use advertising cookies, remarketing cookies, or cross-site tracking, and we do not sell or share data with advertising networks. Because we place no non-essential cookies, this website has no cookie consent banner. You can block or delete cookies through your browser settings; blocking functional cookies may affect how the site works.

6. Third parties whose services load on this website

Our contact forms are protected against automated abuse by Google reCAPTCHA. When a form loads, Google receives your IP address and technical data about your browser. The legal basis is our legitimate interest in protecting our forms against spam and abuse. See Google's privacy policy for how Google handles this data.

Typefaces are loaded through Google Fonts, which means Google receives your IP address when a page loads.

Client references are displayed through Trustindex, which retrieves review data from its own servers when the relevant page loads.

Our website links to our LinkedIn company page. Following that link takes you to LinkedIn, where LinkedIn's own privacy policy applies. We do not embed LinkedIn tracking on this website.

7. Transfers outside the European Economic Area

Some of the services above are provided by Google, which is established in the United States. Transfers to Google take place under the EU-US Data Privacy Framework, under Standard Contractual Clauses, or both. Our booking page runs on Cal.com, Inc., which is established in the United States and relies on Standard Contractual Clauses or the EU-US Data Privacy Framework for transfers. The registry lookups described in section 4 are made to services that may be established outside the European Economic Area; these requests contain your IP address and no other data about you.

8. Client data

Data received from clients during an engagement, including PSP invoices, contract documents, and transaction data, is treated as strictly confidential. It is processed in a closed environment, is not uploaded to third-party tools, and is never entered into any AI system that retains it or trains on it. It is never shared with payment service providers, acquirers, or any other third party.

9. Your rights

You have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent where processing is based on consent. Send your request to info@ecomstream.nl and we will act on it promptly.

You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl.

10. Security

We take appropriate technical and organisational measures to protect personal data, including encrypted transport, access control, and restricted retention.

11. Changes to this policy

We may update this policy to reflect changes in the services we use or in applicable law. The date at the top shows when it was last revised.