# PRIVACY POLICY RULE STEP B.V.

---

**Document details**
Version number: 1.0
Date of entry into force: 30 September 2026
Next planned evaluation date: 30 September 2027
Classification: Public

---

**Explanatory note**

Rule Step B.V. ("we", "us" or "the Controller" (Verwerkingsverantwoordelijke)) attaches great importance to the protection of the personal data of its customers, end users and other data subjects. This Privacy Policy ("Policy") has been drawn up in accordance with the Algemene Verordening Gegevensbescherming [General Data Protection Regulation] (hereinafter: "AVG" [GDPR]), the Uitvoeringswet Algemene Verordening Gegevensbescherming (hereinafter: "UAVG"), the Dutch Civil Code (Burgerlijk Wetboek, hereinafter: "BW").

This Policy applies to all processing activities with regard to personal data that take place in the context of the **online services** (hosting, domain registration and management, e-mail, certificates, licences, back-ups) and **consulting services** (ICT advice) offered by Rule Step B.V. The delivery arrangements with customers are laid down in the General Terms and Conditions, the applicable Supplementary Terms and Conditions (AVO for online services; AVC for consulting) and the Order Form. For the processing of personal data on behalf of customers, the Data Processing Agreement (Verwerkersovereenkomst, DPA) applies.

Where relevant, this Policy makes a strict separation between processing towards businesses (B2B) and consumers (B2C), in view of the specific protection that Book 6 Section 3 BW (Dutch Civil Code) (articles 6:231 et seq.) offers to consumers.

---

### Article 1: Definitions

1.1. **AVG**: Verordening (EU) 2016/679 [Regulation (EU) 2016/679] of the European Parliament and of the Council of 27 April 2016.

1.2. **UAVG**: Uitvoeringswet Algemene Verordening Gegevensbescherming [Dutch GDPR Implementation Act].

1.3. **Personal Data** (Persoonsgegevens): any information relating to an identified or identifiable natural person.

1.4. **Processing** (Verwerking): any operation or set of operations relating to personal data.

1.5. **Controller** (Verwerkingsverantwoordelijke): Rule Step B.V., which determines the purpose of and the means for the processing (for its own administrative processing).

1.6. **Processor** (Verwerker): a natural or legal person that processes personal data on behalf of the Controller. For the online services, Rule Step is the Processor on behalf of the Customer (the Controller within the meaning of the AVG (GDPR)).

1.7. **Sub-processor** (Sub-verwerker): a processor engaged by Rule Step.

1.8. **B2C Consumer** (B2C-consument): a natural person who does not act in the exercise of a profession or business.

1.9. **B2B Customer** (B2B-klant): a legal person or natural person who acts in the exercise of a profession or business.

1.10. **Customer** (Klant): a party with which Rule Step concludes an agreement (as further defined in AW Art. 1.1).

---

### Article 2: Identity of the Controller

2.1. The Controller for the processing mentioned in this Policy (own administrative processing) is:

- Company name: Rule Step B.V.
- KvK number: 42042967
- RSIN: 869445200
- Legal form: Besloten Vennootschap [private limited liability company]
- Business address: Amsterdam, the Netherlands
- Functionaris voor Gegevensbescherming [Data Protection Officer] (FG/DPO): J.J. van Grondelle (by board resolution)
- Privacy contact details: privacy@rulestep.com

2.2. For processing on behalf of customers in the context of the online services, Rule Step acts as Processor; the Customer is in those cases the Controller. The arrangements are laid down in the Data Processing Agreement (Verwerkersovereenkomst, DPA).

---

### Article 3: Overview of processing per processing activity

In compliance with articles 13 and 14 AVG (GDPR), an overview is provided below per category of services of the processing purposes, the categories of data subjects, the categories of personal data, the legal basis for processing and the retention periods.

#### Table 1: Online services — Hosting (Dedicated servers, VPS, app hosting)

| Aspect | Specification |
| :--- | :--- |
| **Purpose of processing** | Service provision, customer management, security monitoring, fraud prevention, server optimisation. |
| **Categories of data subjects** | Business customers (B2B), consumers (B2C), end users of hosted services, employees of customer organisations. |
| **Categories of data** | Identity data (initials, surname), contact data (e-mail address, telephone number, postal address), billing data (company name, KvK number, VAT number, bank account), technical data (IP addresses, server logs, access logs). |
| **Legal basis for processing** | Performance of a contract (Art. 6(1)(b) AVG (GDPR)) for service provision and customer management; Legitimate interest (Art. 6(1)(f) AVG (GDPR)) for security monitoring, fraud prevention and server optimisation. |
| **Retention period** | Accounting/financial data: 7 years after end of financial year (article 193 of the Dutch Criminal Code (Wetboek van Strafrecht) / article 3:307 BW); Access logs/server logs: 30 days (rolling basis); Customer data: duration of agreement + 2 years; Back-up data: 30 days after termination. |

#### Table 2: Online services — Domain registration and management

| Aspect | Specification |
| :--- | :--- |
| **Purpose of processing** | Domain registration and management, compliance with ICANN/SIDN regulatory requirements, DNS operations and security. |
| **Categories of data subjects** | Registrants (B2B and B2C), technical contact persons, administrative contact persons. |
| **Categories of data** | Identity data, contact data, domain registration data (domain name, registration/expiry date, nameservers), payment data, WHOIS data (shielded for B2C). |
| **Legal basis for processing** | Performance of a contract (Art. 6(1)(b) AVG (GDPR)) for registration and management; Legal obligation (Art. 6(1)(c) AVG (GDPR)) for WHOIS data and ICANN/SIDN requirements; Legitimate interest (Art. 6(1)(f) AVG (GDPR)) for DNS operations and security. |
| **Retention period** | Domain registration data: duration of registration + 1 year after expiry date; WHOIS data: in accordance with registry policy; Financial data: 7 years; Contact data: duration of customer relationship + 2 years. |

#### Table 3: Consulting services (ICT advice)

| Aspect | Specification |
| :--- | :--- |
| **Purpose of processing** | Project execution, project communication, invoicing, customer administration. |
| **Categories of data subjects** | Business customers (B2B), consumers (B2C), project contact persons at customers. |
| **Categories of data** | Identity data (initials, surname), contact data (e-mail address, telephone number, postal address), billing data, project communication (e-mails, messages, minutes). |
| **Legal basis for processing** | Performance of a contract (Art. 6(1)(b) AVG (GDPR)) for project execution, project communication and invoicing; Consent (Art. 6(1)(a) AVG (GDPR)) exclusively insofar as additional communication (newsletter) is requested. |
| **Retention period** | Customer data: duration of agreement + 5 years (B2B) or + 2 years (B2C); Project files: duration of agreement + 5 years (B2B) or + 2 years (B2C) (legitimate interest Art. 6(1)(f) AVG (GDPR) for defending against liability, with reference to articles 3:306/3:307 BW); Financial data: 7 years. |

*Note:* if Rule Step, in a concrete consulting assignment, processes personal data **on behalf of** the Customer (for example when advising on a data breach or analysing a customer database), Rule Step acts as **Processor** and the Customer as Controller. The arrangements are laid down in the Data Processing Agreement (DPA). This Policy concerns Rule Step's own administrative processing operations.

---

### Article 4: Legal bases for processing and B2B/B2C separation

4.1. The processing of personal data takes place exclusively on the grounds referred to in article 6(1) under a, b, c and f AVG (GDPR), as specified in the tables under article 3.

4.2. **B2C processing and unreasonable terms**: where the data subject is a Consumer (B2C), the processing is subject to the strict rules of Book 6 Section 3 BW (Dutch Civil Code) (articles 6:231 et seq.). General terms and conditions that conflict with reasonableness and fairness, or that constitute an unreasonable burden for the Consumer in the exercise of his AVG (GDPR) rights, are not binding on the Consumer. Consumer rights can never be excluded or limited by Rule Step B.V., neither by an appeal to performance of a contract, nor via general terms and conditions.

4.3. **Consent (Art. 6(1)(a) AVG (GDPR))**: where consent is used as a legal basis, it is given freely, specifically, informed and unambiguously prior to the processing. The data subject may withdraw this consent at any time and free of charge (article 7(3) AVG (GDPR)). The withdrawal of consent does not affect the lawfulness of the processing prior to the withdrawal.

---

### Article 5: Retention periods and data minimisation

5.1. Personal data are not retained longer than necessary for the realisation of the purposes for which they were collected (article 5(1)(e) AVG (GDPR)).

5.2. The specific retention periods are set out in the tables under article 3.

5.3. The retention period of seven years for accounting and financial data is based on article 193 of the Dutch Criminal Code (Wetboek van Strafrecht) and the limitation periods of article 3:307 BW.

5.4. For consulting services, a retention period of five years (B2B) or two years (B2C) applies after termination of the agreement, in view of the legitimate interest of Rule Step B.V. to be able to defend itself against possible liability claims within the applicable limitation period (article 3:306 BW for unlawful acts, article 3:307 BW for contractual claims). An interest balancing test pursuant to article 6(1)(f) AVG (GDPR) is documented.

5.5. After expiry of the retention periods, the personal data are deleted or anonymised without delay and securely, unless a statutory obligation to retain longer opposes deletion.

---

### Article 6: Data transfer outside the European Economic Area (EEA)

6.1. The primary infrastructure for the online services is hosted at hosting partners within the EEA; accordingly this processing takes place within the EEA.

6.2. Where personal data are transferred to third countries (for example to ICANN in the United States for gTLD coordination), Rule Step B.V. provides appropriate safeguards in accordance with articles 44-49 AVG (GDPR).

6.3. These safeguards consist of:

  (a) the conclusion of Standard Contractual Clauses (SCCs) in accordance with Implementing Decision (EU) 2021/914;
  (b) the execution and documentation of a Transfer Impact Assessment (TIA) per transfer;
  (c) the application of the EU-US Data Privacy Framework (2023) where applicable; in the event of invalidation of the DPF, SCCs and supplementary measures are applied automatically;
  (d) the implementation of supplementary measures in accordance with EDPB Recommendations 01/2020, such as strong encryption of which the keys remain within the EEA.

6.4. For domain services, ICANN regulations require the transfer of WHOIS data. For B2C Consumers, WHOIS data are shielded by default (AVO Art. 4.5). Publication of WHOIS data requires separate, active and specific consent (opt-in), which is not bundled with other conditions.

6.5. For consulting services, in principle no transfer outside the EEA takes place. If this is necessary in a specific assignment, the same safeguards as in paragraph 6.3 apply.

---

### Article 7: Sub-processors

7.1. Rule Step B.V. makes use of reliable processors and sub-processors that provide sufficient guarantees for the implementation of appropriate technical and organisational measures, in accordance with article 28 AVG (GDPR).

7.2. A detailed and current register of the sub-processors is included in Annex 1 of this Policy.

7.3. **Authorisation mechanism**: in the event of a proposed change or addition of a sub-processor, Rule Step B.V. notifies the Customers (contracting parties) thereof in advance. This right belongs to the Controller (Customer) on the basis of article 28(2) AVG (GDPR). Data subjects have no independent right to object to sub-processor changes under the AVG (GDPR); their rights are safeguarded via their own controller. If a Customer refuses the authorisation, Rule Step seeks alternative solutions or ceases the processing to the extent that the sub-processor is needed for it.

---

### Article 8: Security measures

8.1. Taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, as well as the risk of varying likelihood and severity for the rights and freedoms of data subjects, Rule Step B.V. takes appropriate technical and organisational measures (article 32 AVG (GDPR)).

8.2. **Data Processing Agreement**: insofar as Rule Step B.V. acts as processor within the meaning of article 28 AVG (GDPR), the processing of personal data on behalf of the controller is regulated in a separate Data Processing Agreement (DPA). A Service Level Agreement is insufficient to meet the requirements of article 28(3) AVG (GDPR).

8.3. **Online services**:
  - Encryption of personal data 'at-rest' (AES-256) and 'in-transit' (TLS 1.2 or higher);
  - Role-based access control (RBAC);
  - Multi-factor authentication (MFA) for all administrative access;
  - Documented and periodically tested incident response procedures;
  - Regular vulnerability scans and penetration tests;
  - Continuous security monitoring and logging;
  - Physical security via the data centre provider;
  - Minimum 4-eyes principle for critical operations.

8.4. **Domain services**:
  - Application of DNSSEC where supported by the respective top-level domain;
  - Encrypted WHOIS data transfer (TLS);
  - Strict access controls and authentication for domain management;
  - Incident response procedures and secure credential storage.

8.5. **Consulting services**:
  - Encrypted storage and communication (TLS);
  - Access controls on project material;
  - Secure communication channels;
  - Confidentiality obligation for all persons engaged (see AVC Art. 7);
  - Logging of access to project data.

8.6. **NIS2 / Cybersecurity Act (Cyberbeveiligingswet, Cbw)**: security measures in accordance with the Cbw, exclusively insofar as Rule Step B.V. qualifies as an essential or important entity within the meaning of that legislation and insofar as the Cbw has entered into force. In the event of significant incidents, an early warning is also issued within 24 hours to the competent CSIRT.

---

### Article 9: Personal data breach notification

9.1. In the event of a personal data breach, Rule Step B.V. acts without delay in accordance with the internal procedures.

9.2. **Notification to the supervisory authority**: Rule Step B.V. notifies the Autoriteit Persoonsgegevens [Dutch Data Protection Authority] of a personal data breach no later than 72 hours after it has become aware thereof, unless the breach is unlikely to result in a risk to the rights and freedoms of data subjects (article 33(1) AVG (GDPR)).

9.3. **Notification to data subjects**: when a personal data breach entails a high risk for the rights and freedoms of data subjects, Rule Step B.V. notifies the data subjects of the breach without undue delay (article 34(1) AVG (GDPR)).

9.4. **Notification to Customer (Processor role)**: if Rule Step has a personal data breach relating to personal data that it processes on behalf of a Customer, Rule Step notifies the Customer without delay, but no later than within forty-eight (48) hours, in accordance with the Data Processing Agreement (DPA Art. 7).

9.5. **Personal data breach register**: Rule Step B.V. documents all personal data breaches, their causes, the consequences and the measures taken in an internal personal data breach register (article 33(5) AVG (GDPR)).

9.6. **NIS2 / Cbw**: in the event of significant incidents, an early warning notification is also issued within 24 hours to the competent CSIRT (Computer Security Incident Response Team), insofar as Rule Step qualifies under the Cbw.

---

### Article 10: Rights of data subjects

10.1. Data subjects have the following rights under the AVG (GDPR), which can be exercised at any time free of charge:

  (a) **Right of access** (article 15 AVG (GDPR));
  (b) **Right to rectification** (article 16 AVG (GDPR));
  (c) **Right to erasure** (article 17 AVG (GDPR), "right to be forgotten"), unless the processing is necessary for a legal obligation or for the establishment, exercise or defence of legal claims;
  (d) **Right to restriction of processing** (article 18 AVG (GDPR));
  (e) **Right to data portability** (article 20 AVG (GDPR));
  (f) **Right to object** (article 21 AVG (GDPR)), including profiling; in the event of objection by the Consumer (B2C), the processing stops, unless there are compelling legitimate grounds that outweigh;
  (g) **Rights regarding automated decision-making** (article 22 AVG (GDPR)): the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects the data subject.

10.2. **Procedure description**:
  - Requests are submitted in writing or electronically via privacy@rulestep.com.
  - Rule Step B.V. verifies the identity of the requester by means of appropriate identity verification before providing or making changes.
  - Rule Step B.V. responds without delay, but no later than within one month after receipt of the request. In the case of complex requests, this term may be extended by two months, subject to notification within the first month (article 12(3) AVG (GDPR)).
  - Information is provided free of charge, unless the request is manifestly unfounded or excessive (article 12(4) AVG (GDPR)).

10.3. **Right to complain**: data subjects have the right to lodge a complaint with the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) or with another supervisory authority in an EU Member State.

---

### Article 11: Automated decision-making and profiling

11.1. **Online services — hosting**: automated domain suspension due to violation of the AUP is applied, with always an option for human review at the request of the registrant. Other automated decision-making with legal effects is currently not applied. If future systems (fraud detection, automated account suspension, profiling) are implemented, this will be clearly and transparently disclosed in this Policy, with human review (article 22(3) AVG (GDPR)).

11.2. **Domain services**: automated domain suspension due to violation of the AUP is applied, with an option for human review upon request. Other profiling or automated decision-making with legal effects is not applied.

11.3. **Consulting services**: no automated decision-making with legal effects or similarly significant consequences is applied.

---

### Article 12: Data Protection Officer (FG/DPO)

12.1. J.J. van Grondelle, director of Rule Step B.V., has been appointed by board resolution as Functionaris voor Gegevensbescherming [Data Protection Officer] (FG/DPO), Privacy Officer and Information Security Officer. This appointment is permitted pursuant to article 38(6) AVG (GDPR) (a solely/independently authorised director may be DPO for small organisations).

12.2. For hosting services and domain services, the necessity of a DPO is assessed annually on the basis of article 37 AVG (GDPR). If Rule Step remains below the 'large-scale' threshold, this is documented internally with a reasoned assessment of why a DPO is not legally required.

12.3. Regardless of whether a DPO is legally required, all questions regarding data protection may be addressed to privacy@rulestep.com.

---

### Article 13: Data Protection Impact Assessment (DPIA)

13.1. When a processing is likely to result in a high risk to the rights and freedoms of data subjects, Rule Step B.V. carries out a Data Protection Impact Assessment (DPIA) prior to the processing (article 35(1) AVG (GDPR)).

13.2. A DPIA is in any event required when the processing falls under the criteria of article 35(3) AVG (GDPR) or the list of the Autoriteit Persoonsgegevens.

13.3. If the DPIA shows that the processing entails a high risk that cannot be mitigated, Rule Step consults the Autoriteit Persoonsgegevens prior to the processing (article 36 AVG (GDPR)).

---

### Article 14: Applicable law and competent court

14.1. This Privacy Policy and all agreements and legal relationships arising therefrom are governed exclusively by Dutch law.

14.2. **B2B**: for B2B parties, the court in the arrondissement [judicial district] in which Rule Step B.V. has its statutory seat (Amsterdam) has jurisdiction to hear disputes.

14.3. **B2C**: for Consumers (B2C), the competent court in the Consumer's place of residence is also competent, in accordance with Regulation (EU) 1215/2012 (Brussels I bis) — in particular article 18(1) — and article 6:231 et seq. BW. This choice does not affect the jurisdiction of the supervisory authorities in other Member States of the European Union.

---

### Article 15: Amendments and entry into force

15.1. Rule Step B.V. reserves the right to amend this Privacy Policy. Amendments enter into force on the date of entry into force stated in the document.

15.2. Material amendments that affect the rights and freedoms of data subjects are communicated in good time and in an appropriate manner (e-mail, notification on the website). For Consumers (B2C), a materially detrimental amendment enters into force only after express notification and with a reasonable period of at least thirty days.

---

### Signing

Thus adopted by the Controller:

Rule Step B.V.
Place: Amsterdam
Date: 30 September 2026

Name: J.J. van Grondelle
Position: Director (alleen/zelfstandig bevoegd [solely/independently authorised]) / Functionaris voor Gegevensbescherming (FG/DPO) [Data Protection Officer] / Privacy Officer / Information Security Officer
Signature: ___________________________

---

### Annex 1: Sub-processor Register

This register is kept up to date and can be requested at any time from Rule Step B.V. via privacy@rulestep.com. The overview below shows the current sub-processors per service category.

#### Table 4: Sub-processors Online services — Hosting

| Sub-processor Name | Place of establishment | Service/Processing | Purpose of processing | Location of processing | Transfer outside EEA? |
| :--- | :--- | :--- | :--- | :--- | :--- |
| Hosting partners (EU) | Germany (and other EEA) | Data centre operator | Physical data centre infrastructure, network | Germany (EEA) | No |
| Realtime Register B.V. | Netherlands | Domain reseller, Registrar | Domain name registration and management | Netherlands | No |
| Proxmox Server Solutions GmbH | Austria | Virtualisation infrastructure | Server virtualisation and management | Austria (EEA) | No |
| Billing partner (per assignment) | Determined per assignment | Invoicing and customer management | Invoicing, payment processing, customer portal | Depending on choice | Yes, if outside EEA (SCCs + TIA) |

#### Table 5: Sub-processors Online services — Domain registration

| Sub-processor Name | Place of establishment | Service/Processing | Purpose of processing | Location of processing | Transfer outside EEA? |
| :--- | :--- | :--- | :--- | :--- | :--- |
| Realtime Register B.V. | Netherlands | Registrar | Domain name registration | Netherlands | No |
| TransIP B.V. | Netherlands | Registrar | Domain name registration and management | Netherlands | No |
| Gandi SAS | France | Registrar | Domain name registration and management | France (EEA) | No |
| ICANN | United States | Registry coordination | gTLD registry management (WHOIS) | United States | Yes (SCCs + TIA; ICANN **not** DPF-certified) |
| SIDN | Netherlands | ccTLD registry | .nl domain registry management | Netherlands | No |
| Payment processor (per assignment) | Netherlands/EU | Payment processing | Processing of financial transactions | EU/EEA | No (provided EU processor) |

#### Table 6: Sub-processors Consulting services

| Sub-processor Name | Place of establishment | Service/Processing | Purpose of processing | Location of processing | Transfer outside EEA? |
| :--- | :--- | :--- | :--- | :--- | :--- |
| (For own administrative processing: see Table 4 for hosting/invoicing.) | | | | | |

*Note*: for consulting services, no additional sub-processors are engaged beyond the parties listed for online services, unless agreed otherwise in a concrete assignment. If this is nevertheless necessary, the Customer is informed in advance in accordance with the authorisation mechanism of article 7.3.

*End of document*