Privacy statement.

7FIGURES B.V., Bijlmerplein 290, 1102 DG Amsterdam, Netherlands. Registered with the Dutch Chamber of Commerce (KvK) under number 92294375, RSIN 865982338. Contact: info@sevenfigures.io · 670887667.

We are the controller for data we process for our own purposes (website visitors, prospects, candidates, suppliers). When we operate advertising accounts, CRM or HR workflows on behalf of a client, that client is the controller and we act as processor under a written data processing agreement (Article 28 GDPR).

We have not appointed a statutory Data Protection Officer; privacy questions are handled by our management board at the address above.

Website visitors. IP address (truncated where possible), device and browser data, pages visited, referrer. Purpose: security, availability and — with your consent — analytics and advertising measurement. Legal basis: legitimate interest (Article 6(1)(f)) for security; consent (Article 6(1)(a)) for non-essential cookies.

Contact and quote requests. Name, company, email, phone, message, configured placement details. Purpose: answering your request and preparing an offer. Legal basis: pre-contractual necessity (Article 6(1)(b)) and legitimate interest.

Placement orders and invoicing. Business buyers: company name, VAT/BTW number, contact details, order and payment data. Private buyers: name, address, postcode, city, country, contact details, order and payment data. Purpose: performing the agreement, invoicing and statutory bookkeeping. Legal basis: contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)).

Candidates (recruitment). CV data, work history, qualifications and certificates, availability, work authorisation status, references. Purpose: sourcing and introducing candidates to construction, road-building and shipbuilding employers. Legal basis: consent for keeping your file in our database, and pre-contractual necessity for a specific vacancy. We do not process special category data unless legally required for a placement and you have explicitly consented, and we do not run automated decision-making or profiling that produces legal effects.

Marketing. Email address and interest data for service updates. Legal basis: consent, or the soft opt-in for existing clients under Article 11.7 of the Dutch Telecommunications Act. Every message contains a one-click unsubscribe.

We share personal data only where necessary: hosting and infrastructure providers, email and CRM tooling, analytics, publishers and media owners executing your placement, advertising platforms (Meta, Google), payment providers, accountants and, for recruitment, the prospective employer. Each processor is bound by a data processing agreement with confidentiality, security and sub-processor obligations. We never sell personal data.

Our default is processing inside the European Economic Area. Where a provider processes data outside the EEA (typically United States advertising and analytics platforms), the transfer relies on an adequacy decision such as the EU–US Data Privacy Framework, or on the European Commission's Standard Contractual Clauses combined with a transfer impact assessment and supplementary measures. A copy of the relevant safeguards is available on request.

Invoices and accounting records: 7 years (Article 52 of the Dutch State Taxes Act). Records relating to real estate/VAT where applicable: 10 years. Client contracts and campaign files: 7 years after the end of the engagement. Contact and quote requests without a resulting contract: 24 months. Candidate files: 4 weeks after the procedure ends, or 12 months with your consent, renewable. Cookie consent records: 12 months. Server and security logs: up to 12 months.

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection, and the right to withdraw consent at any time without affecting the lawfulness of prior processing. Send your request to info@sevenfigures.io; we respond within one month and may ask for proof of identity in a data-minimising way. If you are not satisfied you may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ The Hague) or the supervisory authority of your habitual residence.

Our use of cookies and similar techniques, including the consent categories and how to change or withdraw your choice, is described in the cookie policy.

We apply TLS in transit, access control on a need-to-know basis, least-privilege credentials for advertising accounts, logging and regular review of processors. Personal data breaches are assessed without delay and, where required, reported to the Autoriteit Persoonsgegevens within 72 hours and to affected individuals where the risk is high.

We may update this statement to reflect changes in our services or the law. Material changes are announced on this page; the version date is shown at the top.