Skip to content
SystemsWorkSuitePartnershipRun your auditSign in
ENNL
Menu
ENNL
SystemsWorkSuitePartnershipAuditStudioContactSign inTermsPrivacyCookiesSubprocessors
Run your audit

DGDH OS is an AI venture studio. We architect AI systems, then build them into products and companies.

SystemsWorkSuitePartnershipAuditStudioContactSign inTermsPrivacyCookiesSubprocessors
[email protected]Netherlands · © 2026

Privacy

What we collect, and why.

We collect what a reply or an audit needs, and nothing beyond it.

01

Who

Who is responsible.

Trade name
DGDH OS
Legal entity
De Goede Commercieel
Registration
93259069
Address
Tak van Poortvlietstraat 4, 3332 HZ Zwijndrecht, Netherlands
VAT ID
NL005009591B33
Contact
[email protected]
02

Roles

Controller, or processor — it depends what you're using.

This site & the audit tool
DGDH OS is the controller: we decide why and how this data is processed.
DGDH Ads
The connecting workspace is the controller of the data inside its own connected ad account (which can include that workspace's own customers' data — for example, audiences or conversion events). DGDH OS processes that data only as a processor, under a data processing agreement with the workspace, and cannot act on it independently of the workspace's instructions.
03

What

What we collect.

Only through the contact form and the Digital System Audit. We do not buy data and we do not enrich it from third parties.

Contact form
Name, Business email, Company, Role, What are you trying to fix?
Audit
The URL you submit, your answers to the context questions, and the findings we produce from them.
Analytics
Only after you consent. See the cookie page.
04

DGDH Ads

Connected advertising accounts.

DGDH Ads is a separate product on this platform: an advertising MCP gateway. Each customer connects their own ad-platform accounts (Google, Meta, LinkedIn, TikTok, Snapchat, Pinterest and others) via that platform's own OAuth flow.

Access tokens
Encrypted at rest (AES-256-GCM). Used only to act on the connected account on the customer's own instruction.
Writes
Every write action (creating or changing a campaign) is gated behind the account owner's explicit approval before it executes.
Isolation
Each customer workspace only ever accesses the ad accounts it has itself connected. We do not aggregate, cross-reference, or resell data across workspaces.
05

Why

Why we hold it, and on what basis.

Contact form & audit
Legal basis: our legitimate interest in replying to a request you initiated (GDPR Art. 6(1)(f)). We do not treat submitting the form as consent to further processing.
DGDH Ads
Legal basis: performance of the contract with the workspace that connected the ad account (Art. 6(1)(b)), on that workspace's own instruction.
Analytics
Legal basis: your consent, given through the cookie banner (Art. 6(1)(a)). Withdraw it any time on the cookie page.
Security & abuse prevention
Legal basis: our legitimate interest in keeping the site and connected accounts safe (Art. 6(1)(f)).
Automated decisions
DGDH Ads does not make automated decisions with legal or similarly significant effects on you (Art. 22): every write action to a connected ad account requires your explicit approval before it executes.
06

Retention

How long we keep it.

We keep what a reply or a record needs, and delete it once that purpose ends — unless the law requires us to keep it longer (for example, tax records).

Contact form
Deleted within 12 months of your last message to us, unless a contract follows.
Audit
Deleted 24 months after the report is generated, or immediately on request.
DGDH Ads connections
Kept for as long as the workspace keeps the ad account connected; access tokens are revoked and deleted immediately on disconnect.
Invoicing records
Kept for the statutory Dutch tax retention period (currently 7 years).
07

Sharing

Who processes it on our behalf.

We use the following processors to run the site and its products. None of them are permitted to use your data for their own purposes. The right-hand column names the actual transfer mechanism for each — checked against that vendor's own current notice, not assumed.

Clerk
Authentication and session management
US · EU-U.S. Data Privacy Framework
Stripe
Payment processing and billing
US · EU-U.S. Data Privacy Framework
Postmark (ActiveCampaign)
Transactional email delivery
US · EU-U.S. Data Privacy Framework
Vercel
Application hosting for this site
US · EU-U.S. Data Privacy Framework
Google Analytics
Site analytics (only after consent)
US · EU-U.S. Data Privacy Framework
Microsoft Clarity
Session-behaviour analytics (only after consent)
US · EU-U.S. Data Privacy Framework
Hetzner (via Coolify)
Hosting for the audit backend service
EU (Germany) · no transfer
Cloudflare (R2 + DNS)
File storage and domain/DNS
US · Standard Contractual Clauses
Cal.com
Meeting scheduling, where used
US · Standard Contractual Clauses
SignWell
Electronic signature for agreements, where used
US · Standard Contractual Clauses
08

Your rights

How to see it, correct it, or have it removed.

Access, correction, deletion
Mail [email protected]. We will tell you what we hold and remove it on request, unless we are legally required to keep it.
Restriction
You can ask us to restrict processing while a dispute about accuracy or lawfulness is resolved, at the same address.
Portability & objection
You can ask for your data in a portable format, or object to processing based on our legitimate interest, at the same address.
Withdraw consent
Where processing relies on consent (analytics), withdraw it any time from the cookie page — this does not affect processing done before the withdrawal.
DGDH Ads end users
If your data appears inside a connected ad account we process as a processor, direct your request to the workspace that connected the account — they are the controller. If you cannot reach them, mail [email protected] and we will assist.
Complaints
You can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), or with the data-protection authority in your own country.