EcomStream B.V. – Privacy Policy

Last updated: 7 August 2026

EcomStream B.V. ("we", "us", "our") processes personal data in accordance with the GDPR and Dutch law. This policy explains what we collect, why, and what you can do about it.

1. Who we are

EcomStream B.V., Frederik Hendriklaan 25, 3708 VA Zeist, The Netherlands. Email info@ecomstream.nl, telephone +31 (0)85 00 23 062. We are the controller for the processing described below.

Legal form: Besloten Vennootschap (B.V.), a private limited company under Dutch law. Authorised representative: Ramon Helwegen. Registered with the Dutch Chamber of Commerce (Kamer van Koophandel) under number 69283265. VAT identification number NL857815684B01.

EcomStream provides independent payment advisory services to retailers and brands. This activity requires no regulatory licence. EcomStream is not a payment service provider, an acquirer, or a payment institution.

This website is hosted by VDX Internet Services B.V., Vondellaan 47, 2332 AA Leiden, the Netherlands, Chamber of Commerce number 08190856.

2. Data you give us

We collect personal data when you contact us by email or through a contact form on this website. This concerns your name, email address, and whatever you choose to include in your message. We use it solely to respond to your enquiry and to maintain the business relationship that follows from it. The legal basis is our legitimate interest in responding to enquiries directed at us, and where a client relationship follows, the performance of that agreement.

Form submissions are delivered to our email environment, which runs on Google Workspace. Data is retained for up to seven years in line with Dutch tax law, or until you ask us to erase it.

3. Website statistics

We do not use a third-party analytics service on this website. No analytics cookie is placed on your device, and no data about your visit is sent to an external statistics provider. We measure how the site is used through our own visitor identification, described in section 4.

4. Business visitor identification

We operate our own visitor identification on this website. Its purpose is to recognise which organisations show interest in our services, so that we can follow up commercially. It is aimed at organisations, not at identifying you personally.

When you open a page, we record the page address, time, time spent on the page, scroll depth, device type, browser language, the referring website, and any campaign parameters in the link you followed. We also record your internet connection.

We do not store your full IP address. It is reduced on arrival to the surrounding network range, the first three blocks for IPv4 and the first three groups for IPv6, and only that range is written to our database. That range is then looked up in public internet registries to establish which organisation or provider it belongs to. For those lookups we use ipwho.is, rdap.org, and stat.ripe.net. Where a company domain is identified, we may retrieve the public homepage of that domain to obtain a short description of the organisation.

Connections that belong to consumer internet providers, mobile networks, hosting companies, VPN services, and automated crawlers are marked as such and are not treated as business visitors.

This processing takes place on our own servers. It uses no cookies and stores nothing on your device. The data is not shared with third parties, is not used for advertising, and is not combined with data from other sources. The legal basis is our legitimate interest in identifying business interest in our services and in understanding how our website is used. Records are deleted automatically after 90 days.

If you would rather not be included, contact us at info@ecomstream.nl and we will exclude the network range concerned.

5. Cookies and similar technologies

This website places functional cookies only. These come from WordPress, the Divi theme, and WPML, which uses a cookie to remember your language preference. They are necessary for the site to work and are not used to build a profile of you.

We do not use advertising cookies, remarketing cookies, or cross-site tracking, and we do not sell or share data with advertising networks. Because we place no non-essential cookies, this website has no cookie consent banner. You can block or delete cookies through your browser settings; blocking functional cookies may affect how the site works.

6. Third parties whose services load on this website

Our contact forms are protected against automated abuse by Google reCAPTCHA. When a form loads, Google receives your IP address and technical data about your browser. The legal basis is our legitimate interest in protecting our forms against spam and abuse. See Google's privacy policy for how Google handles this data.

Typefaces are loaded through Google Fonts, which means Google receives your IP address when a page loads.

Client references are displayed through Trustindex, which retrieves review data from its own servers when the relevant page loads.

Our website is delivered through NitroPack, a caching and performance service that processes technical request data in order to serve pages quickly.

Our website links to our LinkedIn company page. Following that link takes you to LinkedIn, where LinkedIn's own privacy policy applies. We do not embed LinkedIn tracking on this website.

7. Transfers outside the European Economic Area

Some of the services above are provided by Google, which is established in the United States. Transfers to Google take place under the EU-US Data Privacy Framework, under Standard Contractual Clauses, or both. The registry lookups described in section 4 are made to services that may be established outside the European Economic Area; these requests contain a network range and no other data about you.

8. Client data

Data received from clients during an engagement, including PSP invoices, contract documents, and transaction data, is treated as strictly confidential. It is processed in a closed environment, is not uploaded to third-party tools, and is not processed by any AI system. It is never shared with payment service providers, acquirers, or any other third party.

9. Your rights

You have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent where processing is based on consent. Send your request to info@ecomstream.nl and we will act on it promptly.

You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl.

10. Security

We take appropriate technical and organisational measures to protect personal data, including encrypted transport, access control, and restricted retention.

11. Changes to this policy

We may update this policy to reflect changes in the services we use or in applicable law. The date at the top shows when it was last revised.