NL · PT · EU · versie 2026-09-09-v2
Privacy notice
How Dark Blue Estates processes personal data carefully, purposefully and transparently.
Private persons and business contacts
When submitting a request or completing your customer profile, you can indicate whether you are acting as an individual or on behalf of a company. For companies, we retain the company name, country of establishment, contact person’s role, declaration of authority and any registration and VAT identification numbers. These details are self-declared; they do not grant administrator rights or membership and do not automatically determine your statutory consumer rights.
Automatic browser control
When sending a protected form, your browser performs a short technical check. The server stores a random control code, target, host, time, usage status and a daily changing IP hash with secret key. The raw IP address is not saved for this purpose. The check expires after five minutes; records older than ten minutes are removed at the next verification request. The check is not an identity verification and does not process form content or health data.
Status and Responsible
This is an expanded working draft for legal review before public launch. Dark Blue Estates can be contacted at Herengracht 320, 1016 CE Amsterdam and contact@darkblueestates.com. The statutory entity, KvK number and definitive privacy contact will be added before publication.
GDPR, GDPR and RGPD
AVG is the Dutch name for the European General Data Protection Regulation (GDPR), in Portugal RGPD. For applications and services, we distinguish the responsible DBE entity, location and applicable national law. A membership does not give general permission to share data within all DBE divisions. Only necessary data shall be made available for an appropriate purpose and a valid basis.
Applications, consent and retention policy
We process contact details to answer your request and, where applicable, to prepare a contract for your request. Marketing and information on additional services are separate optional choices. You can send a privacy request or withdrawal to contact@darkblueestates.com. Currently, requests are stored in the website database; the external CRM/ERP transfer is prepared and not yet active. Automatic disposal according to a storage matrix has not yet been arranged. Its definition and implementation, by purpose and category of data, is a condition for public use of the forms.
What data?
Depending on your relationship, we can process identification and contact information, organizational and project data, object and transaction data, account and payment status, communication, preferences, technical log data and consent registrations. We ask no more than is necessary for the purpose in question.
Objectives and GDPR bases
Data may be used to answer enquiries, assess offers and projects, operate accounts and subscriptions, prevent fraud and misuse, manage relationships, comply with legal obligations and improve our service securely. Depending on the purpose, the legal basis is the performance of a contract or steps prior to entering into a contract, a legal obligation, legitimate interests or consent.
Sensory and health data
Voluntary responses about sensory sensitivities, health or wellbeing may constitute special categories of personal data. This information remains in a separate protected domain and is not used for membership admission, pricing, marketing or investment profiling. Any personalised service requires a separate legal basis and, where necessary, explicit consent. Withdrawal must be straightforward and does not have retroactive effect. The intake does not initiate medical monitoring or replace healthcare advice.
Recipients and processors
Access is limited to authorized DBE employees and necessary service providers for hosting, security, forms, communication, CRM, payment and professional advice. Commercial lead data and sensitive intake responses are logically separated. Processors are given contractual privacy and security obligations.
Outside the EEA
When a supplier processes data outside the European Economic Area, we only use a valid transfer basis and appropriate safeguards, such as an adequacy decision or standard contractual clauses, supplemented by risk analysis where necessary.
Storage periods
Data are retained no longer than necessary for their purpose, legal obligations, dispute resolution and security. Before public launch, a retention schedule will be implemented for enquiries, rejected or withdrawn Hybrid Living applications, accounts, transactions, contract files, security logs and consent records.
Your rights
Under the GDPR, depending on your situation, you may request access, rectification, erasure, restriction or portability, object to processing and withdraw consent. We verify your identity proportionately and respond within the statutory time limit. You may also lodge a complaint with the Dutch Data Protection Authority, the CNPD in Portugal or the competent supervisory authority for your habitual residence, place of work or the location of the suspected infringement.
Security and incidents
DBE applies appropriate technical and organisational measures, including minimum access rights, secure connections, logging, updates, backups and vendor control. No system is hackproof. An incident shall be investigated, limited and reported to the supervisor and data subjects in a timely manner where required.
Children and changes
Our commercial services and admission review intake are not intended for independent use by children. Material changes shall be published by date and actively communicated or re-submitted for approval where necessary.