Privacy Policy

Last updated: October 2026

1. Introduction

NCRB (“we”, “our”, “us”) is committed to protecting the personal data of everyone who interacts with our organization. This Privacy Policy explains how we collect, use, store, and protect personal data when you visit our website, contact us, or engage our investigative services.

Data Controller

NCRB is the data controller responsible for the processing described in this policy.

NCRB
Noordhoven 19, 6042 NW Roermond, Netherlands
Email: info@ncrb.nl
Phone: +31 (0)85 060 7911
KVK: 74939742

For full company registration details, see our Legal & Compliance page.

Data Protection Officer

Given the nature and scale of our data processing activities, NCRB has not appointed a Data Protection Officer (DPO) as this is not required under Articles 37-39 GDPR. All data protection inquiries can be directed to info@ncrb.nl.

2. What Data We Collect

We may collect and process the following categories of personal data depending on how you interact with us:

Contact Information

When you submit our contact form or reach out to us directly, we collect your name, email address, phone number, organization name, and how you heard about us (referral source). When you submit the contact form, we automatically include how you arrived at our website (referring site or campaign code) and your landing page, to learn which channels work (legitimate interest, Article 6(1)(f) GDPR).

Technical Data

When you visit our website, we automatically collect certain technical data including your IP address, browser type and version, operating system, referring URL, pages visited, and the date and time of your visit. Server logs are used only for security and troubleshooting and are deleted automatically by our hosting provider after a short period.

Cookie Data

We use cookies and similar technologies on our website. For full details, please see our Cookie Policy.

Investigation-Related Data

When you engage our investigative services, we may process personal data related to the investigation as agreed upon in our engagement terms. The scope and nature of this data varies depending on the specific assignment and is governed by the terms of our engagement agreement.

Data of persons who are the subject of an investigation

In an investigation we process personal data of persons who are not our client, such as an opposing party, a claimant or a debtor. The following applies:

  • Legal basis: the legitimate interest of the client (Article 6(1)(f) GDPR), after a documented assessment of necessity, proportionality and subsidiarity. Without a legitimate interest we do not accept the assignment.
  • Purpose: fact-finding on behalf of a client with a legitimate interest, such as a claim, dispute, suspected fraud or due diligence.
  • Categories of data: identification and contact details, public online information (profiles, publications), data on business roles and assets from public registers and, where necessary, data relating to criminal matters.
  • Recipients: the client and, through the client, its lawyer or insurer; in the event of a complaint, the person handling the complaint.
  • Sources: public and lawfully accessible sources only, and documents the client lawfully holds. No deception, no fake profiles to access restricted environments, no access to bank or tax data.
  • Notification: the data subject is informed about the investigation as soon as the interest of the investigation no longer prevents it. Who does so, and when, is agreed between NCRB and the client per assignment. Exceptions follow from Article 14(5) GDPR, Article 41 of the Dutch GDPR Implementation Act and the applicable privacy code of conduct for private investigation agencies.
  • Criminal data: a suspicion of fraud is personal data relating to criminal matters (Article 10 GDPR). NCRB may process such data under Article 33(4)(a) of the Dutch GDPR Implementation Act because it holds a licence under the Wpbr.
  • Retention: we keep investigation data for at least one year after the report has been delivered and delete it no later than five years after it was first recorded, as paragraph 5.5 of the privacy code of conduct requires; longer only while proceedings are pending.
  • Rights: as a data subject you have the right of access, rectification, restriction, objection and erasure, unless the law provides an exception. Send requests to info@ncrb.nl; we respond within one month and coordinate with the client where needed. Complaints about an investigation are handled under our complaints procedure.

Visitor statistics

To see which pages visitors find useful, we measure website use with Plausible Analytics, an EU service. Plausible sets no cookies, stores no IP addresses and builds no visitor profiles; we only see totals, such as visits per page, the referring website, the country and the device type. We also count how often the contact form is sent and how often a phone or email link is clicked, without their content. Legal basis: our legitimate interest in improving the website (Article 6(1)(f) GDPR).

3. Legal Basis for Processing

We process personal data only where we have a valid legal basis to do so under the General Data Protection Regulation (GDPR). The legal bases we rely on include:

  • Answering your request: when you ask us, via the contact form, email or phone, to assess your situation, we process your data to take steps at your request before a possible engagement (Article 6(1)(b) GDPR). For other questions, and when you contact us on behalf of an organization, the legal basis is our legitimate interest in answering messages (Article 6(1)(f) GDPR).
  • Contractual necessity: When processing is necessary to perform our investigative services under an engagement agreement with you.
  • Legitimate interest: When processing is necessary for our legitimate business interests, such as maintaining website security, preventing fraud, and improving our services, provided these interests do not override your fundamental rights.
  • Legal obligation: When we are required to process personal data to comply with applicable laws, regulations, or court orders.

4. How We Use Your Data

We use the personal data we collect for the following purposes:

  • To respond to your inquiries and provide requested information about our services
  • To perform investigative services as contracted under an engagement agreement
  • To improve our website, user experience, and service offerings
  • To comply with legal and regulatory obligations

5. Data Sharing

NCRB does not sell, rent, or trade your personal data to any third party. We may share your personal data only in the following limited circumstances:

  • Trusted service providers: We work with carefully selected service providers who assist us with website hosting, email delivery, and IT infrastructure. These providers process data solely on our behalf and under our instructions.
  • Legal authorities: We may disclose personal data when required to do so by law, regulation, legal process, or enforceable governmental request.
  • Professional partners: When necessary for the performance of investigative services, we may share relevant data with professional partners, but only with your knowledge and as outlined in the engagement agreement.
  • Minister of Justice and Security: a copy of complaints submitted (Article 18(2) Rpbr).

International Transfers

As an international investigative firm, we may need to transfer personal data across borders. When we transfer data outside the European Economic Area, we ensure that appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission and reliance on adequacy decisions where available. You can request a copy of the safeguards used via info@ncrb.nl.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Our retention periods are as follows:

  • Contact form submissions: Retained for 12 months from the date of submission, unless an engagement follows.
  • Administration (quotes, engagement letters, invoices): 7 years, because of the statutory tax retention obligation (Section 52 of the Dutch General State Taxes Act).
  • Investigation files: see above; deleted no later than five years after first being recorded.

We conduct regular reviews of the data we hold and securely delete or anonymize personal data that is no longer required.

7. Your Rights Under the GDPR

As a data subject, you have the following rights under the General Data Protection Regulation:

  • Right of access: You may request a copy of the personal data we hold about you.
  • Right to rectification: You may request that we correct any inaccurate or incomplete personal data.
  • Right to erasure: You may request the deletion of your personal data, subject to legal retention obligations.
  • Right to restrict processing: You may request that we limit how we use your personal data.
  • Right to data portability: You may request to receive your personal data in a structured, commonly used, and machine-readable format.
  • Right to object: You may object to the processing of your personal data based on legitimate interests.
  • Right to withdraw consent: Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at info@ncrb.nl. We will respond to your request without undue delay and in any event within one month of receipt, in accordance with Article 12(3) GDPR.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

  • Encrypted communications using TLS/SSL protocols
  • Secure data storage with access controls and authentication
  • Regular security assessments and vulnerability testing
  • Staff training on data protection and information security
  • Strict confidentiality obligations for all personnel

We maintain the highest standards of confidentiality in all our operations, consistent with our professional obligations as a licensed investigative firm.

9. Automated Decision-Making

NCRB does not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you, as described in Article 22 GDPR.

10. Statutory and Contractual Requirements

The provision of certain personal data (such as your name and email address when using our contact form) is necessary for us to respond to your inquiry. The provision of personal data in the context of an engagement is a contractual requirement necessary for us to perform our services.

11. Code of Conduct

As required by Article 23a of the Dutch Regulation on Private Security Organisations and Investigation Agencies (Rpbr), NCRB has adopted the privacy code of conduct for the private investigation sector ((Privacy)gedragscode sector particuliere onderzoeksbureaus), identical to the model in Annex 6 to the Rpbr, and complies with it. The code is published at wetten.overheid.nl (Annex 6).

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes, we will revise the “Last updated” date at the top of this page.

13. Contact and Complaints

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

Data Protection Contact
Email: info@ncrb.nl

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) if you believe that our processing of your personal data violates applicable data protection law. More information is available at autoriteitpersoonsgegevens.nl.

Questions?

If you have any questions about our policies, please contact us.

Contact Us