This document is a draft that is still being reviewed by a lawyer under Dutch and European law. It is not yet in force and may change. You can already send questions about your data or an objection; we handle them in accordance with the GDPR. The Dutch version is the reference text; this translation is for information.
Public company data can identify sole traders, partners in partnerships, employees or directors and can therefore contain personal data. This information explains the processing in the Dutch company database (Article 14 GDPR); it does not make every public data point freely reusable. Data about legal entities themselves, such as a bv or foundation, is not personal data.
Martin Adamec (trading as firmdat.nl) is responsible for the processing in the database. The contact details are below.
Depending on the source and the agreed export, records may contain company name, legal form, Chamber of Commerce number and VAT ID (if the company publishes them itself), business address, published business phone number, general email address and website, and the industry. The business address of a sole trader can also be a home address; we only include addresses published as a business address. Personal email addresses of employees, special categories of data and use for consumer credit decisions are not offered.
Categories of sources are open map data (Overture Maps, OpenStreetMap), publicly published company contact pages and public registers and member lists, to the extent reuse is permitted. As of 4 November 2026 only Overture Maps has been processed: Overture Maps Foundation, Places (release 2026-10-21.0), licence CDLA-Permissive-2.0; Overture merges data from Meta and Microsoft, among others. The other categories are planned. We do not obtain bulk data from the KVK business register. The data sources and methodology page lists the sources. Ask us for the available source information about your record.
The purpose is to organise company information and deliver agreed B2B exports for market research, maintenance of company data and lawful business contact, such as post and phone outreach to legal entities. Buying an export is not consent to marketing and not proof of reachability. We do not use this data for automated decisions with legal or similarly significant effects on individuals.
For business personal data the legal basis is Article 6(1)(f) GDPR: the interest of the operator and its customers in reliable company information. The Court of Justice of the EU has confirmed that a commercial interest can also be legitimate (judgment of 4 October 2024, C-621/22), provided the processing is necessary and the interests of data subjects do not override it. Public availability alone does not decide that balance. Data minimisation, source restrictions, corrections, objections, the Non-Mailing Indicator and blocking are relevant safeguards.
Recipients may include business customers receiving the agreed fields, hosting or IT service providers where necessary, professional advisers and competent authorities. Customers have their own obligations regarding information, security, the Telecommunications Act and handling data subject requests.
An export containing personal data to, or access from, a country outside the European Economic Area requires a case-by-case transfer assessment under the GDPR. Disclosure is not justified merely because a customer has bought the data.
Company data is kept only as long as needed for the stated purpose, taking into account the currency of the source, changes, objections and legal obligations. Outdated or unnecessary personal data is corrected or deleted. Minimal blocking markers are kept as long as necessary to prevent the data being added again.
Where applicable, you can request access, information about the source, rectification, erasure, restriction and portability. You can object to processing based on legitimate interest; an objection to direct marketing does not need to be justified, and we then stop that use (Article 21(3) GDPR). Use the objection form or contact us directly. If you have registered a Non-Mailing Indicator with the KVK, we respect it: your address is not supplied for advertising mail. We normally reply within one month.
You can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or with another competent supervisory authority. The lead supervisory authority for the operator is the Czech Office for Personal Data Protection (uoou.gov.cz).
Where Article 14 GDPR applies, individual information must be provided within the applicable period: normally within one month, or earlier at the first contact or first disclosure. Any exception requires a documented legal basis. This page supplements that obligation and does not automatically replace individual information.
This information is updated when relevant sources, purposes or processing change. The current version date is shown at the top.
Martin Adamec
Mírová 1541, 516 01 Rychnov nad Kněžnou, Czech Republic
IČO: 19552319
info@firmdat.nl
Legal notice · Terms · Website privacy · Information about the database · Request form · Sources and methodology
