Privacy Policy

Version 2.0 — last updated on 23 August 2026. This version replaces all previous versions.

1. Who are we?

Offyce is responsible for the processing of personal data as described in this privacy statement. We are the data controller under the General Data Protection Regulation (GDPR).

We have not appointed a Data Protection Officer (DPO) as we are not legally required to do so. For all your questions regarding data protection, you can contact the person mentioned above.

2. What does this statement apply to?

This privacy statement applies to all personal data we process in the context of:

• your visit to our websites offyce.nl and offyce.eu, including the forms, quote requests, and configurators placed thereon;
• our commercial contacts and prospecting;
• the execution of our assignments: advice, design, delivery, and installation of interior solutions, acoustic solutions, lactation and concentration rooms, and related services;
• our newsletters and other communications;
• applications.

This statement does not apply to personal data we process solely on behalf of a client — for example, responses from employees in an employee survey. The client is the data controller in such cases, and we act as the processor. See point 8.

3. What data do we process, why, and on what basis?

Below, you will find, per processing activity, which data we use, for what purpose, on what legal basis, and how long we retain it.

3.1 Contact and quote requests

3.2 Webshop and online quote requests (WooCommerce)

3.3 Execution of tasks and customer management

3.4 Photos of Realizations and References

3.5 Newsletter and Commercial Emails

Every commercial email includes a clear, free unsubscribe link. Unsubscribing works immediately and has no impact on the services you receive from us.

3.6 Website statistics and measuring our reach

3.7 Identification of business website visitors (lead identification)

We highlight this processing separately and in detail because it goes beyond ordinary statistics.

a) Company-level recognition (Leadinfo)

b) Person-level recognition (Snitcher)

What this means for you in concrete terms. If we have come to know you in this way and then contact you directly, then:

• we explicitly state in that very first message how we obtained your data via our website and through which service;
• we refer to this privacy statement;
• we also provide you with a direct way to object and to have your data erased in that same message;
• after submitting an objection or not responding to our opt-out, we will never contact you again.

We do not sell these data, share them with other advertisers, or use them to build profiles outside the purpose described above.

3.8 Applications

3.9 Security, fraud prevention, and disputes

We process log files, data from our spam filters, and Google reCAPTCHA to secure our systems and prevent abuse of our forms. When necessary, we process data to enforce our rights in or outside of court. The legal basis is always our legitimate interest in protecting our business (Art. 6.1.f GDPR). We retain log files for a maximum of 12 months and dispute files for up to 5 years after final resolution.

4. We do not request special categories of data

We do not ask for data regarding your health, religious or philosophical beliefs, sexual life, or other special categories as defined in Article 9 of the GDPR. Our club and relaxation spaces are designed based on spatial and organizational data — such as quantities, surfaces, and usage frequency — not on data about individual employees. Please do not provide us with such information unsolicited. If we receive it anyway, we will delete it.

5. Who do we share your data with?

We never sell your data. We only share it with parties that need it to provide our services, always under a data processing agreement with the necessary safeguards.

We keep this list up to date. If you want to know which processors we engage at a specific time, please ask us via privacy@offyce.nl.

6. Transfer outside the European Economic Area

Some of our service providers are based in the United States or use American infrastructure. Data transfer only occurs when one of the following safeguards applies:

• the recipient is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (this applies, among others, to Google and HubSpot); or
• Standard contractual clauses of the European Commission have been established, supplemented with technical and organizational measures following an assessment of the consequences of the transfer.

You can request a copy of the implemented safeguards from us.

7. Automated Decision-Making

We do not make decisions with legal consequences or similarly significant consequences that are solely based on automated processing. However, we do use the behavior on our website to prioritize commercial follow-up. This may lead to the decision of whom we contact first — a human always decides whether and how this happens.

8. When we act as a data processor

For certain assignments — including employee surveys, workplace research, and designing a workplace concept — we process personal data of employees on behalf of our client. In such cases, the client is the data controller, and we act as the processor.

We document this in a data processing agreement and generally operate as follows:

• Questions are conducted anonymously where possible, and results are only reported in groups large enough to prevent individuals from being identifiable (guideline: a minimum of five responses per reportable group);
• We do not provide individual responses to the client unless the participant explicitly opts in for this.
• we never use this data for our own purposes, nor for our own marketing;
• We will delete or retain the data after completing the assignment, at the customer’s discretion.

Are you an employee and do you have questions about such an inquiry? Please contact your employer first. We will refer you and do not provide access without instruction from the data controller.

9. How do we secure your data?

We implement appropriate technical and organizational measures, including:

• encrypted connections (TLS/SSL) on all our websites and forms;
• two-factor authentication and a password policy on our business accounts;
• access to data based on necessity, limited by role;
• regular backups and updated software;
• confidentiality obligations for our employees and subcontractors;
• an internal procedure for reporting and assessing data breaches. We report breaches posing a risk to you within 72 hours to the Data Protection Authority and, where required, to you.

10. Your rights

You have the following rights. You can exercise them free of charge via privacy@offyce.nl.

• Access — knowing if and which data we process about you, and obtaining a copy of it.
• Rectification — correcting inaccurate data or completing incomplete data.
• Wissing — your data will be deleted unless we are legally required to retain it or need it for an ongoing dispute.
• Restriction — suspend processing while a dispute is ongoing.
• Portability — receiving or having forwarded the data you provide to us in a common digital format.
• Objection — objecting to processing based on our legitimate interest, for reasons related to your specific situation.
• Absolute objection to direct marketing — if you object to the use of your data for direct marketing, including related profiling, we will immediately and without assessment cease doing so (Art. 21.2 GDPR).
• Withdrawal of consent — where we request your consent, you may withdraw it at any time. This does not affect the lawfulness of what was done prior to withdrawal.

We respond within one month. For complex or multiple requests, we may extend this period by two months; we will inform you promptly. To prevent abuse, we typically send copies to the email address we already have on file. If we doubt your identity, we may request additional information — never a copy of your ID with all details visible.

11. Complaints

If you disagree with how we handle your data, let us know first via privacy@offyce.nl. If we cannot resolve it together, you can file a complaint with the competent supervisory authority:

You may also file a complaint with the supervisory authority of your own place of residence within the EEA.

12. Cookies

Our websites use cookies and similar techniques. You can find out exactly what they are, what they are used for, and how long they remain active in our cookie policy. You can also adjust or revoke your choices at any time.

13. Changes

We update this privacy policy when our services, systems, or regulations require it. The latest version is always available on this page, with the date of the last update at the top. If a change significantly affects data we already hold about you, we will notify you by email.

14. Contact

Offyce — Huidevettersstraat 13/3, 2300 Turnhout, Belgium Company number BE 0698.645.666 info@offyce.nl