Privacy
Privacy Policy
OROS Agency, owned and managed by Daniel Orosz, is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR / AVG).
Data controller
OROS Agency (Daniel Orosz), Kievitstraat 25, 6469 XX Kerkrade, Netherlands (postal address).
Email: info@oros.agency
KvK: 98242482 · BTW: NL005319090B91
What data do we collect?
We collect personal data that you provide via the contact and review forms on our website: your name, email address, phone number (optional), and any additional information you choose to share. If you consent to analytics or marketing cookies, we also collect pseudonymous usage data via Google Analytics (GA4), Microsoft Clarity (heatmaps and session recordings) and Google Ads. Clarity does not start until you allow analytics, and it masks the text you type into form fields.
If you become a client, we also process the details needed for quotes and invoices: your (company) name, address, KvK and VAT number where applicable, and payment records. If you pay online, Mollie or Stripe processes the payment. We receive the payment status, the amount and the details needed for bookkeeping, never your full card number.
Purpose of processing
We process your personal data exclusively to:
- Respond to your enquiries and contact requests.
- Deliver and communicate about our services.
- Send quotes and invoices and process payments.
- Understand how visitors use our site (analytics, only with consent).
- Measure and optimise advertising performance (only with consent).
Legal basis
Processing of contact form data is based on your consent (Art. 6(1)(a) GDPR) and/or the necessity to perform pre-contractual obligations (Art. 6(1)(b) GDPR). Quotes, invoices and payments are based on the performance of the contract (Art. 6(1)(b) GDPR) and on our legal obligation to keep accounting records (Art. 6(1)(c) GDPR). Analytics and marketing data processing is based exclusively on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
Service providers and recipients
These service providers process data on our behalf (processors), under their data processing terms:
| Processor | Purpose | Country | Safeguard |
|---|---|---|---|
| Netlify, Inc. | Website hosting & form delivery | US | EU–US Data Privacy Framework (DPF) |
| Google LLC (Analytics) | Usage statistics — only with consent | US | EU–US Data Privacy Framework (DPF) |
| Microsoft Corporation (Clarity) | Heatmaps and session recordings — only with consent | US | EU–US Data Privacy Framework (DPF) |
| Telegram (messaging) | Internal form notification delivery | varies | Standard Contractual Clauses (SCCs) |
These parties receive data from or through us, but act as an independent controller for their own processing. They decide themselves how they use that data, for example for fraud prevention and legal obligations. Their own privacy policy applies to that processing:
| Party | Purpose | Country | Safeguard |
|---|---|---|---|
| Mollie B.V. (privacy policy) | Online payments | NL | Within the EU |
| Stripe Payments Europe, Ltd. (privacy policy) | Online payments | IE (Stripe, Inc. in the US for some processing) | Within the EU; US transfers under the EU–US Data Privacy Framework (DPF) |
| Google LLC (Ads) | Conversion tracking — only with consent | US | EU–US Data Privacy Framework (DPF) |
Your data is not sold, rented, or shared with any other third parties.
Cookies
We use cookies only as described below. Analytics and marketing cookies are placed only after your explicit consent via our cookie banner. You can change your preferences at any time using the button.
| Cookie name | Purpose | Duration | Provider | Category |
|---|---|---|---|---|
oros_consent | Stores your cookie consent preferences | 6 months | oros.agency (first party) | Necessary |
_ga | Google Analytics — distinguishes users | 2 years | Google LLC | Analytics |
_ga_* | Google Analytics 4 — session state | 2 years | Google LLC | Analytics |
_clck, _clsk | Microsoft Clarity — pseudonymous visitor ID and session connection | As set by Clarity, see the Microsoft cookie list | oros.agency (first party) | Analytics |
CLID, ANONCHK, MR, MUID, SM | Microsoft Clarity — user identification and synchronisation across Microsoft domains | As set by Microsoft, see the cookie list above | Microsoft Corporation (third party) | Analytics |
_gcl_aw | Google Ads — conversion tracking | 90 days | Google LLC | Marketing |
Data retention
Contact form data is retained for as long as necessary to fulfil your request and any related follow-up, typically no longer than 2 years unless a contractual relationship requires longer retention. Quotes, invoices and payment records are kept for 7 years, as Dutch tax law requires. Analytics data is governed by Google's retention settings (default 14 months); Clarity recordings by the retention settings of our Microsoft Clarity project. You may request deletion at any time.
Your rights
Under the GDPR / AVG you have the right to:
- Access your personal data (Art. 15),
- Rectify inaccurate data (Art. 16),
- Erasure ("right to be forgotten") (Art. 17),
- Restriction of processing (Art. 18),
- Data portability (Art. 20),
- Object to processing (Art. 21),
- Withdraw consent at any time without affecting prior processing.
To exercise your rights, contact us at info@oros.agency. We will respond within 30 days.
Complaints
If you believe we are processing your data unlawfully, you have the right to lodge
a complaint with the Dutch data protection authority:
Autoriteit Persoonsgegevens
Website: autoriteitpersoonsgegevens.nl
Telephone: +31 70 888 85 00