Privacy notice

Who is responsible?

Roso Financiële Diensten B.V. is responsible for processing personal data in connection with our own services. Our address is Poststraat 1, 6135 KR Sittard, the Netherlands. We are registered with the Chamber of Commerce under number 87895714. You can reach us at contact@rosofd.nl or 085 - 400 76 46.

Ricardo Roso, the owner, is your privacy contact and handles our privacy requests. This notice covers clients, prospective clients and visitors to our website. Last updated: 25 October 2026.

Which data do we use?

For our client cases, we receive personal data from our clients. If a client provides information about a partner, child or another insured person, we process it only if that person is also a client. The information needed depends on your question and the agreed services. We use contact details, income information, mortgage and financing information, details of existing financial commitments, policy information and the identity documents required for the case. We also make written notes of in-person and telephone conversations. We use Ockto for the digital submission of income and identity information.

The citizen service number (BSN) is concealed on copies of identity documents. We do not receive or use BSNs outside these copies either. RFD does not itself receive or retain medical or criminal offence data. We do not record conversations or use office CCTV that records clients or visitors.

Share only the information needed for your question. For confidential client documents, agree with your adviser which documents are required and how to provide them securely. We use WhatsApp Business solely for brief questions and appointments.

What do we use your data for?

We use your data to discuss your question, arrange appointments, hold advice meetings online, sign documents digitally, make advice calculations and carry out the agreed advisory, intermediary and ongoing management work. We also need data for our administration and to maintain an accurate record of your case.

The legal reason for processing data is called the legal basis. We use the following legal bases, insofar as they apply to the processing concerned:

• Preparing and performing our agreement: information needed for the service you request, including appointments, advice calculations, applications and related client contact.
• Legal obligation: information we must record or retain for our financial administration and under the statutory rules that apply to our services.
• Legitimate interests: data needed to answer other questions, secure our systems, investigate misuse or protect our rights in a specific dispute. We must weigh your privacy interests in doing so.
• Consent: if we ask for consent for additional processing, we explain its purpose beforehand. You can withdraw that consent; this does not make earlier lawful processing unlawful.

Data needed for your case

You decide which data you provide. Without information that is necessary for advice, an application or a legal obligation, we may be unable to carry out that part of the service. We discuss with you which data are needed in your situation.

Who do we share data with?

For your case, we may share necessary data with mortgage lenders, credit providers, business finance providers, insurers and service providers. For our financial administration, we share the information needed for that purpose with our accountant. Which party receives information depends on your application or the work concerned; not every party receives your entire file.

Parties such as mortgage lenders, credit providers, business finance providers and insurers may also be responsible for their own data processing. Their privacy information explains that processing. We make data processing arrangements with suppliers that process personal data on our behalf.

The systems and suppliers we use

We use GetMoreSystems for client files and the Digikluis client portal. We use Hypact Advisor by Yellowtail for advice calculations. We use Microsoft 365 and TransIP for business email; our email is stored at TransIP. TransIP Webhosting Core hosts this website.

Our accountant keeps our accounts in Exact Online. We use WhatsApp Business through the official WhatsApp Desktop app for brief questions and booking appointments. We do not send newsletters or offers by email, text message or WhatsApp.

We use Ockto for the digital submission of income and identity information. Within the Ockto process, you can see which data you are sharing and actively approve this. RFD uses the data received for the agreed services. Ockto's privacy notice explains processing within that service. Advice meetings can take place online, for example through Microsoft Teams.

WhatsApp Business and international processing

When you contact us through WhatsApp Business, we process your telephone number and the content of your brief question or appointment message. Do not use this channel for payslips, policies, identity documents or other confidential client documents. You can also call or email. We do not make cloud backups of our WhatsApp conversations.

WhatsApp also processes data under its own terms and privacy policy. WhatsApp describes processing in the United States and other countries. For European customer contact data, WhatsApp Ireland's data transfer terms refer to safeguards including the EU-US Data Privacy Framework and, where applicable, standard contractual clauses. Personal data may be processed outside the European Economic Area (EEA) as a result.

The applicable safeguards depend on the service and the processing. You can ask for information about our suppliers and the applicable transfer safeguards at contact@rosofd.nl. The links at the bottom of this page include the WhatsApp terms.

How long do we retain data?

We apply the retention periods below. The period for a client file is our retention policy; seven years is not a general statutory retention requirement for every item of personal data. We must not retain data that are no longer needed for longer than necessary.

• Client files: seven years after the client relationship ends. They are deleted automatically at the end of this period.
• Information requests that do not lead to a client relationship: two years after the last contact with the prospective client.
• WhatsApp conversations about brief questions and appointments: no more than two years after the last WhatsApp contact with the client. They are deleted automatically at the end of this period.
• Financial administration: the applicable tax retention requirement. For basic accounting records, this is generally seven years from the time the data are no longer current. This is a different period from the period measured from the end of a client relationship.
• Technical website data: only as long as needed to deliver and secure the website and investigate specific faults or misuse. The hosting service also determines technical storage and deletion arrangements.

Access and security

Within RFD, only the adviser for the client concerned and back-office staff have access to client files. We use two-step verification for access: an additional code or app is required alongside a password.

We use access restrictions and supplier agreements to protect personal data. Do not send an identity document, BSN, medical information or a complete financial file to the general email address without being asked. First discuss the documents needed and the submission route with your adviser.

A message through the contact form

For the contact form, we use your name, email address, telephone number if provided, selected subject and message to handle your question. You cannot send attachments. Do not use the form for identity documents, medical information, payslips, complete client files or claim documents.

The website submits your message to Microsoft 365 over a secure connection for delivery to contact@rosofd.nl. Your email address is used as the reply-to address so that we can answer your question. The form module does not retain the message content in a separate website database or in browser storage.

To secure the form and limit misuse, we use a temporary session token and a protected key derived from the IP address. The security files contain no message content or readable IP address. The hosting and email services may process their own technical data. Their actual logging and retention arrangements remain part of our supplier checks.

A question that does not lead to a client relationship falls under the period of two years after the last contact with the prospective client. If correspondence becomes part of the necessary client file, we assess its retention within that file. Acceptance for sending by the email service is not proof that a message has reached the inbox.

Website visits, cookies and external links

RFD does not use its own analytics or advertising module on this website. There is no client account or upload function within the website itself. The contact form is intended for general questions. To deliver a page, the web server receives technical request data, such as an IP address. The host may process technical logs for the operation and security of the hosting service.

You book an appointment through the external Microsoft booking service. You report a claim through the existing PolisApp service. The Log in button opens the Digikluis provided by GetMoreSystems. These services open only when you follow their links; their privacy information applies to their own processing. An external route does not remove our responsibility for our own services.

When the contact form is available, it uses a functional session cookie to protect against unwanted requests. The form does not save your message in browser storage. Our cookie page explains this technology in more detail. If a measurement service or another integration is added later, we will update this information accordingly.

We automatically load a rating image from Advieskeuze on the homepage. Your browser connects to cdn.advieskeuze.nl for this purpose; that service receives technical request data, including your IP address and browser information, and may use its own cookies. No external script or frame is loaded for this image. We do not send contact form or mortgage data to Advieskeuze. Clicking the image opens the Advieskeuze website, which has its own information and settings. You can close the widget using the cross. Only that choice to close it is retained in sessionStorage for the tab session, under the name rfd_advieskeuze_closed. The image is then not loaded again when you reload or return in the same tab. Closing it does not undo earlier requests to the service.

Human assessment

Hypact Advisor supports our advice calculations. RFD does not itself make fully automated decisions about clients without human assessment. A mortgage lender, credit provider, business finance provider or insurer assesses an application under its own procedures; consult the relevant provider's information for that processing.

Your privacy rights and how to make a request

You can ask to access your personal data, correct inaccurate data, have data erased or restrict processing. Where the relevant right applies, you can ask for data portability or object to processing based on legitimate interests. You can withdraw consent. Erasure is not always possible, for example if we are legally required to retain certain data.

Send your request to contact@rosofd.nl, for the attention of Ricardo Roso. Describe the data or situation your request concerns. We may check your identity in an appropriate way; do not send a complete copy of your identity document without being asked.

We respond without undue delay and no later than one month after receipt. For a complex request or multiple requests, the period may be extended by up to two months. We will tell you within the first month why more time is needed. If we cannot fulfil a request, we explain the reason and how you can challenge that decision.

A privacy complaint or a change to this notice

Discuss a privacy complaint with Ricardo Roso at contact@rosofd.nl. You can also complain directly to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP). A link to the AP is provided below.

If our procedures or the services we use change, we update this notice. The date at the top states when it was last updated.

Mortgage calculator and contact after your estimate

The mortgage calculator runs in your browser. You can download the calculation as a PDF without providing your name, email address or telephone number. Calculating and downloading do not send your income, commitments, property details or mortgage estimate to RFD. The tool does not write your calculation inputs to cookies or browser storage. You save the downloaded PDF on your own device.

For the automatic calculation interest rate, RFD retrieves public rates from hypotheek-rentetarieven.nl and uses rente.nl as a verified backup source. This takes place through the server and a cache; the rate sources do not receive your calculation inputs or contact details. A daily task checks the interest rate at 09:00 Dutch time. A later check may update the cache. Retrieved interest rate data are used for no more than 48 hours; the tool rounds the average down to two decimal places for the calculation.

You can also expressly request that the PDF be sent to your own email address. Our server and Microsoft 365 then process your email address, your name if entered and the calculation inputs to check the calculation again and send the PDF. This happens at your request as part of this service. Without selecting the contact checkbox, the email goes only to the address provided, with no copy to RFD; this route does not save the PDF as a file on the web server or in Sent Items. The email service does process the delivery and technical data. The received PDF remains in your own mailbox until you delete it.

When requesting the PDF by email, you can separately select a checkbox allowing RFD to contact you about the result. Only then are your first name, surname, telephone number and email address required for contact, and contact@rosofd.nl receives these details with the calculation as a PDF. Without the checkbox, these four contact fields are not sent. Your request does not create a newsletter subscription or other subscription.

After receiving an estimate, you can voluntarily ask to be contacted. Only when you select the contact checkbox and submit the request do you share your name, email address, telephone number and the calculation inputs for the displayed calculation with RFD. These include the income, commitments, property value and energy label entered, the selected interest rate and the associated calculation data. The contact checkbox states that the calculation will be included. The purpose is to handle your contact request and discuss the calculation with you; this does not subscribe you to a newsletter or provide marketing consent.

The website receives your request over a secure connection, checks the calculation inputs and recalculates the estimate. It creates a PDF attachment for the email to contact@rosofd.nl through Microsoft 365. The website does not store the PDF or calculation inputs in its own database or as a file on the web server. The message with the PDF is processed in our email environment. You cannot upload your own files through this route.

The contact request uses the same functional session cookie and security as the general contact form. For a prospective client, we retain the request and included calculation under our stated policy for no more than two years after the last contact. If this correspondence becomes part of the necessary client file, we assess its retention within the retention period described for that file. The configuration and final privacy review remain subject to separate checks.

Counting use of the mortgage calculator

To assess calculator use, our own module counts successfully completed calculations. It receives only an event name, a new random deduplication code for each calculation and a temporary security token. This module does not retain calculation inputs, contact details, IP addresses, browser characteristics or the referring page. The hosting service does process technical data for web requests under its own configuration.

We retain daily totals for no more than 90 days, hashes of deduplication codes for no more than 48 hours and short-lived security counters. Data are cleared during use and by the scheduled reporting task. No cookie, browser storage or code is used to recognise visitors across multiple calculations. A deliberately started new calculation counts again; these are not counts of unique people. RFD receives the daily counts by email each week. These reports contain no calculation inputs or contact details.

Frequently asked questions

Read more