This policy explains why MirAdvisory processes your personal data, on what legal basis and for how long. It applies when you visit our website, use the contact form, email us or book a call.
We process your data in accordance with the EU General Data Protection Regulation (GDPR) and Dutch law. For visitors and clients in Türkiye, we also observe the obligations under Turkish Personal Data Protection Law No. 6698 (KVKK); for those purposes, this policy also serves as the information notice required by that law.
1. Controller and contact
The party responsible for processing your personal data is:
MirAdvisory · 3065 HB Rotterdam, the Netherlands
Chamber of Commerce (KvK): 97174440 · VAT: NL005253127B21
Email: info@miradvisory.com · Phone: +31 6 27 23 32 37
For any question or request about data protection, write to info@miradvisory.com. We are not required to appoint a data protection officer.
2. Scope of this policy
This policy covers the miradvisory.com website and the contact that starts through it. Once an advisory engagement begins, the processing of data shared with us within that engagement is governed by the signed agreement and, where required, a separate data processing agreement.
3. What data we process, why, and on what legal basis
| Processing activity | Data | Purpose | Legal basis (GDPR) | Legal basis (KVKK) |
|---|---|---|---|---|
| Contact form | Name, company, email, phone (optional), topic, message | Assessing and answering your enquiry | Steps prior to a contract at your request (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) | Directly related to the conclusion or performance of a contract (Art. 5(2)(c)); legitimate interest (Art. 5(2)(f)) |
| Email correspondence | What you share in your emails, your email address, the thread history | Handling your enquiry and maintaining the working relationship | Pre-contractual steps and performance of a contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) | Art. 5(2)(c) and Art. 5(2)(f) |
| Booking a call | Name, email, chosen date and time, any note you add | Scheduling the call and sending a reminder | Steps prior to a contract at your request (Art. 6(1)(b)) | Art. 5(2)(c) |
| Visitor statistics | Page views, referring site, country, browser and device type; no cookies, no IP address stored | Understanding which content is read and improving the website | Legitimate interest (Art. 6(1)(f)) | Legitimate interest (Art. 5(2)(f)) |
| Server logs | IP address, time of request, requested address, browser details, error records | Security of the website, preventing abuse, resolving technical faults | Legitimate interest (Art. 6(1)(f)) | Legitimate interest (Art. 5(2)(f)) |
| Accounting records | Invoice and contract details: name, company, address, VAT number | Meeting our accounting and tax obligations | Legal obligation (Art. 6(1)(c)) | Compliance with a legal obligation (Art. 5(2)(a)) |
Balancing test: Where we rely on legitimate interest, that interest is the secure operation of the website, the prevention of abuse and our ability to reply to you in good time. For this we work with the minimum amount of data, build no profiles and keep the data only as long as needed.
We do not add you to marketing lists. We do not send newsletters. We do not sell your data or share it with third parties for advertising.
4. Where the data comes from, and whether you have to provide it
We receive your personal data directly from you: when you complete the form, write to us or book a call. We do not buy data from third parties.
The starred fields in the form are needed to answer your enquiry; without them we may not be able to get back to you. The phone number is optional. You are under no legal obligation to provide any data.
5. Cookies and visitor statistics
Our website uses no advertising, tracking or profiling cookies. There are no social media trackers, advertising pixels or third-party analytics scripts. Our typefaces are served from our own server, so opening a page does not connect your browser to an external font provider.
Visitor statistics are measured in aggregate on our own server with a tool that sets no cookies, stores no IP addresses and does not identify individual visitors. Only technical information needed for the website to work (such as your language preference) may be stored in your browser. For that reason we show no cookie consent banner.
Where we link to platforms such as LinkedIn, these are plain links: no embedded content, no trackers. Once you follow such a link, that platform's own privacy policy applies.
6. Who we share data with
We share your data only with the service providers we need in order to deliver our service. They process the data solely on our instructions, and we have a data processing agreement with each of them.
| Provider | Role | Where the data sits |
|---|---|---|
| Hetzner Online GmbH | Hosting of the website and of the visitor statistics and booking tools | Germany (EU) |
| Brevo (Sendinblue SAS) | Delivering contact form messages by email | EU |
| Zoho Corporation B.V. | The info@ and ayhan@miradvisory.com mailboxes | EU data centre |
Beyond this, we may share data with competent authorities or with our legal and financial advisers where we have a legal obligation (for example an official request) or where we need to protect our rights. If an engagement requires bringing in a specialist from our partner network, we discuss this with you first and put the necessary agreements in place.
7. Where your data is stored, and transfers outside the EU
All data is stored within the European Union. We do not transfer personal data outside the European Economic Area. Should a transfer become unavoidable, we will only make it with a safeguard permitted by the GDPR (an adequacy decision or standard contractual clauses) and will update this policy accordingly.
8. Retention periods
We do not keep your data longer than the purpose requires:
| Data | Retention |
|---|---|
| Contact form messages and email correspondence | Up to 2 years after your enquiry is closed |
| Call bookings | Up to 1 year after the call |
| Server logs | Up to 30 days |
| Visitor statistics | Indefinitely, in aggregate form containing no personal data |
| If a working relationship follows: agreements and correspondence | 5 years after the relationship ends (limitation period) |
| Invoices and accounting records | 7 years, as required by Dutch tax law |
At the end of the period, data is deleted or irreversibly anonymised.
9. Your rights
Under the GDPR and the KVKK you have the right to:
- know whether we process your data, access it and receive a copy
- have inaccurate or incomplete data corrected
- have your data erased
- restrict processing
- receive your data in a structured, commonly used format and have it transferred to another controller
- object to processing based on legitimate interest
- withdraw your consent at any time, where processing is based on consent
- under the KVKK additionally: to know the third parties to whom your data has been transferred, and to claim compensation if you suffer damage from unlawful processing
Send your request to info@miradvisory.com. We respond within one month; if the request is complex we may extend that period by a further two months and will tell you why. To be sure the request comes from you, we may ask for additional information. Requests are free of charge; for manifestly unfounded or excessively repeated requests we may charge a reasonable fee or decline the request.
10. Right to complain
If you believe we process your data unlawfully, we ask you to contact us first. You also have the right to lodge a complaint directly with a supervisory authority:
- Netherlands: Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl)
- If you live in Türkiye: Personal Data Protection Authority (kvkk.gov.tr)
11. Security and data breaches
We take technical and organisational measures to protect your data against unauthorised access, loss and misuse: an encrypted connection to the website (HTTPS), key-only access to the server, current security patches, access controls, regular backups, and working with trusted providers established in the EU.
If a breach affects the protection of personal data, we record it, report it to the Autoriteit Persoonsgegevens within 72 hours where required, and inform the people affected if the risk to them is high.
12. Automated decision-making and profiling
We do not use your personal data to make decisions about you with legal effect based solely on automated processing. We do not carry out profiling.
13. Children
Our services are aimed at organisations. We do not knowingly collect data from anyone under 16. If you notice that such data has reached us, let us know and we will delete it.
14. Changes to this policy
We update this policy when our services or the law change. The current version is always published on this page, with the date of the last update shown above. If a change is significant, we also inform the clients we work with directly.