Privacy statement

1. Who is responsible for your data

Payments Consulting Strategy, trading as Leakproof Payments ("we", "us", "our"), is the controller of the personal data described in this statement. We are registered with the Netherlands Chamber of Commerce (KvK) under number 99888556. Our VAT number is NL005416377B30.

For questions about this statement or about your personal data, please contact us at [email protected].

2. Personal data we process

We process personal data that you provide to us, or that arises from your use of our website and services. Depending on how you interact with us, this includes the following.

When you contact us through our contact form, by email or by phone, we process your name, business email address, company name or website, the content of your message and the page from which you contacted us.

When you use the payments scorecard on our website, your answers are processed in your browser to calculate your result. To see your result, you send us your answers, your work email address and your company website. We use them to show your result and to send you one follow-up email about your top risk, on the basis of our legitimate interest in answering business enquiries. We do not add you to a newsletter.

When you or your organisation becomes a client, we process the names, job titles and business contact details of your representatives, and the company details, billing address, VAT number and payment records needed for invoicing.

We do not intentionally process special categories of personal data, such as data concerning health or political opinions.

3. Purposes and legal bases

We process personal data only for specified purposes and on a legal basis under Article 6 of the General Data Protection Regulation (GDPR).

We process personal data to respond to your enquiries and requests, to schedule and hold calls, and to follow up on them. We do this on the basis of our legitimate interest in answering business enquiries and developing our business relationships.

We process personal data to prepare, enter into and perform agreements with our clients. The legal basis is the performance of a contract or, where we deal with a client's representatives, our legitimate interest in carrying out that contract.

We process personal data to comply with legal obligations, including tax and bookkeeping requirements. The legal basis is compliance with a legal obligation.

We process technical and aggregated data to operate, secure and improve our website, on the basis of our legitimate interest in a secure and well-functioning website.

We only send newsletters or other marketing emails with your consent, which you may withdraw at any time.

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you. The scorecard result is indicative only.

4. Cookies and website statistics

Our website does not use cookies and does not store information on your device.

We use a privacy-friendly analytics service to compile aggregated statistics about the use of our website, such as the number of visits, the pages viewed, referring websites, country, device type and actions such as submitting the contact form. This service does not use cookies, does not store your IP address or anything else that identifies you, and does not track visitors across other websites.

Our hosting provider processes technical data, including IP addresses, to deliver the website and to protect it against misuse. We do not use this data to identify visitors.

Our website may contain links to websites of third parties, such as social media. We are not responsible for the privacy practices of those websites, and we recommend that you read their privacy statements.

5. Recipients of personal data

We do not sell personal data. We share personal data only with service providers that support our business, such as providers of website hosting, website analytics, form handling, email and accounting services, and only to the extent necessary for their services. These providers act as processors on our behalf under a data processing agreement, or are otherwise bound by confidentiality.

We may also disclose personal data where we are required to do so by law, for example to the tax authorities.

6. International transfers

Some of our service providers are located outside the European Economic Area (EEA), or may process personal data outside the EEA. In that case, we ensure that appropriate safeguards are in place, such as an adequacy decision of the European Commission, including the EU–US Data Privacy Framework, or the European Commission's standard contractual clauses.

7. Retention periods

We do not keep personal data longer than necessary for the purposes for which it was collected.

Enquiries, scorecard results you send to us and related correspondence that do not lead to an assignment are deleted no later than 12 months after our last contact. Personal data relating to clients is kept for the duration of the agreement and up to two years after it ends. Invoices and accounting records are kept for seven years, as required by Dutch tax law.

8. Data processed on behalf of clients

When we perform services for a client, we may process personal data contained in information that the client provides to us, such as payment transaction data. In that case, we act as a processor on behalf of the client, who remains the controller. This processing is governed by a data processing agreement with the client. Questions about such data should be addressed to the client concerned.

9. Security

We take appropriate technical and organisational measures to protect personal data against loss and any form of unlawful processing. These include encrypted connections, access controls and multi-factor authentication. In the event of a personal data breach, we notify the Dutch Data Protection Authority and, where required, the individuals concerned.

10. Your rights

Under the GDPR, you have the right to access the personal data we hold about you, and to have it rectified or erased. You also have the right to restrict or object to its processing and to receive your data in a structured, commonly used format (data portability). Where processing is based on your consent, you may withdraw that consent at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise your rights, please contact us at [email protected]. We respond to your request within one month. We may ask you to verify your identity before we handle your request. Some data, such as invoices, we are legally required to keep.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or with the supervisory authority in your country of residence.

11. Changes to this privacy statement

We may amend this privacy statement from time to time, for example when our services or applicable laws change. The latest version is always available on our website.

This privacy statement was last updated on 7 November 2026.