Privacy notice
What we collect when you use this site or the client portal, why we collect it, who processes it for us, how long we keep it, and what you can ask of us.
Last updated: 3 October 2026
Who we are
Bram & Company is the compliance practice of Bram Hirsch. We are responsible for the personal data described here. The company is being registered; its legal name, address and Chamber of Commerce number will be added to this page at registration.
For anything about your data, use the contact form at the bottom of any page or reply to any email you received from us. I answer privacy questions myself.
What we collect and why
| What | Why | Legal basis |
|---|---|---|
| Your enquiry through the contact form: name, email, company and phone if you give them, the topic and your message, the page you sent it from and the site or campaign link you arrived through | To answer you and follow up on your question | Our legitimate interest in answering, and steps you ask for before a contract |
| Your account: email address, your name if you sign in with Google, and sign-in records | To let you into the client portal and keep it secure | Performance of our agreement with you |
| Orders and your company profile: what you ordered, start dates, payments, and the company details you enter | To deliver the services you ordered and invoice them | Performance of our agreement, and the legal duty to keep financial records |
| Documents and messages: files you upload, documents we deliver, and messages about an order | To do the work and keep a record of it | Performance of our agreement |
| Emails we send you: the address, what was sent and whether it was delivered | To tell you about payments, documents, messages and obligations falling due | Performance of our agreement |
| Visits to the public site: the page, the language, the site you came from, a device class (phone, tablet or desktop), your time zone and any campaign tags in the link | To see which pages help people, counted without cookies and without anything that identifies a person | Our legitimate interest in improving the site; this is not personal data |
Who processes it for us
- Google Cloud, in the Netherlands (region europe-west4): hosting, the database and the files.
- Google Identity Platform and Google sign-in: signing in to the portal.
- Brevo (Sendinblue SAS, France): sending our emails.
- Stripe: card payments, once online payment is switched on. Stripe receives what a payment needs, never your documents.
Each works under a data processing agreement. The site, the database, the files and the emails stay in the European Union. Google sign-in and Stripe may process data in the United States; they cover that with the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.
How long we keep it
- Enquiries: 24 months after the last activity on them, then deleted with their notes automatically.
- Account, orders and company profile: as long as you are a client, and invoices and payment records for seven years, as Dutch tax law requires.
- Documents and messages: for the duration of the engagement and as agreed in it. You can ask us to delete them earlier when nothing requires us to keep them.
- Email records: as long as the order or account they belong to.
Your rights
You may ask us for access to your data, to correct it, to delete it, to restrict or object to its use, and to receive it in a format you can take elsewhere. Ask through the contact form or by replying to one of our emails; we answer within one month.
If you are not satisfied with our answer, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
We make no decisions about you by automated means. The readiness score in the portal is a calculation you see and can question, not a decision.
What your browser stores
The public site sets no cookies and stores nothing in your browser; the readiness check is worked out in your browser and kept nowhere. In the client portal your browser keeps three things: your sign-in session, so you stay signed in; the email address you asked a sign-in link for, until you use it; and whether you folded the side menu. All three are needed for the portal to work as you set it, so we do not ask for consent for them.
Changes
When this notice changes, the date at the top changes with it.