1. Who we are
This privacy policy explains how Thijs Joosten Digital Acquisition (“TJDA”, “we”) processes personal data of people who visit this website, create an account, or otherwise deal with us as a client or contact. TJDA is registered with the Dutch Chamber of Commerce under number 83495975, at Weegsteen 8, 3823 GC Amersfoort, the Netherlands. For questions about your data, e-mail thijs.joosten@tj-da.com.
Two roles. For the data of your website visitors that flows through Pulse — conversion events, hashed contact details, click identifiers — TJDA acts as processor on your behalf. That processing is governed by the Data Processing Agreement, not by this policy. This policy covers the data for which TJDA is the controller: your own account, your use of this website, and our contact with you.
2. What we process, and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, business e-mail address, company name, Chamber of Commerce number | Creating and managing your account; the agreement; support | Performance of a contract (art. 6(1)(b) GDPR) | Duration of the account, then 2 years |
| Login credentials (password stored as a one-way hash), session tokens, login attempts | Securing access to the platform | Legitimate interest: security (art. 6(1)(f)) | Sessions expire automatically; failed-login records are cleared after login or within 24 hours |
| Acceptance of the Data Processing Agreement and these Terms: user, version, time and IP address | Proof that the agreement was accepted | Legitimate interest: evidence of contract (art. 6(1)(f)) | Duration of the agreement, then 5 years (limitation period) |
| Billing details and payment status | Invoicing and payment | Performance of a contract; legal obligation (Dutch tax law) | 7 years after the financial year (fiscal retention) |
| E-mail correspondence and support requests | Answering questions, resolving issues | Performance of a contract; legitimate interest | 2 years after the last contact |
| Website usage on pulse.tj-da.com (see section 4) | Understanding how the website is used | Consent, where cookies are used (see section 4) | According to the analytics settings, at most 14 months |
3. Who receives your data
We share your data only with parties we need to run the service, and only for that purpose:
- TransIP B.V. (Netherlands) — hosting of the platform and this website;
- Stripe Payments Europe Ltd. (Ireland) — payment processing and invoicing; Stripe receives your billing details and processes card or bank data directly, TJDA never stores card numbers;
- Google Ireland Ltd. — Google Tag Manager and Google Analytics on this website, only insofar as you have consented (section 4);
- Anthropic PBC (United States) — only if you actively use the AI data-access connector in the platform; governed by the Data Processing Agreement and Standard Contractual Clauses.
We do not sell personal data and do not share it with third parties for their own marketing.
4. Cookies and analytics on this website
This website loads Google Tag Manager. Through it we use Google Analytics 4 to understand, in aggregate, how the website is used — which pages are visited and from which sources. Analytics cookies are placed only after you have given consent; without consent, no analytics identifier is stored on your device. You can withdraw consent at any time through the cookie settings on this website.
The platform itself (behind login) uses only functional cookies that are strictly necessary: your session, and your preferences within the platform. These require no consent.
5. Where your data is stored
The platform, its database and its back-ups run on a server at TransIP in the Netherlands. Back-ups of the whole server are made every four hours and weekly, and are kept for at most six weeks; data deleted from the live system remains in the database's transaction logs for up to 30 days and in the back-ups until they expire. A staging environment on the same server holds a copy of production data for testing; the same retention rules apply to it. Data leaves the EEA only in the cases named in section 3, each under an appropriate transfer mechanism.
6. Your rights
Under the GDPR you have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on consent, you may withdraw that consent at any time; this does not affect the lawfulness of processing before the withdrawal.
To exercise a right, e-mail thijs.joosten@tj-da.com. We respond within one month. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).
If you are a visitor of a website that uses Pulse and want to know what data was processed about you, please contact the operator of that website: they are the controller, and TJDA acts on their instructions. We assist them in answering your request.
7. Security
Stored credentials for connected platforms are encrypted (AES-256). All connections use TLS. Access to the server is restricted to key-based authentication. IP addresses in the platform’s access log are truncated on write and cleared after 90 days; web-server access logs store the IP address in truncated form, together with the request line (with keys and tokens masked), the referring page and the browser's user agent; web-server error logs may contain the full IP address and the requested URL. Web-server logs are rotated daily and kept on the server for at most eight days. Each client’s data is logically isolated from every other client’s.
8. Changes to this policy
We may update this policy when the service or the law changes. The version and date at the top of this page show when it was last changed. Material changes are announced in the platform or by e-mail.