IMAAN OPERATIONS
Privacy Statement
Last updated: 14 October 2026
Imaan Operations · Koperwerf 31, 2544 EM The Hague, Netherlands · Chamber of Commerce 42181964 · VAT ID NL005564469B79
This notice explains the personal data we process, why we process them, and how to exercise your privacy rights.
1. Who is responsible?
Imaan Operations, Koperwerf 31, 2544 EM The Hague, Netherlands, Chamber of Commerce 42181964, VAT ID NL005564469B79, is the controller for personal data it processes for this website, enquiries, business communications and its own administration. Contact: info@imaanoperations.com. For personal data processed strictly on a client’s behalf, the actual GDPR role depends on the engagement; see section 4.
2. What information and why?
For enquiries, we may process names, business details, roles, contact information and the information you provide to respond and discuss possible engagements. During work we may process correspondence, project contacts, engagement records, invoice/payment details and limited project information necessary for the agreed service. Depending on the circumstances, processing is based on legitimate interests in business correspondence, taking steps towards or performing an agreement with the data subject, or legal obligations for record keeping.
3. Website, hosting, forms and links
This version of the website contains no embedded advertising or website analytics trackers. Cloudflare hosting and security may process technical connection data such as IP addresses and logs to keep the site secure and available, and may use strictly necessary security cookies. Enquiries link to an external Microsoft Forms form; submitted data are then processed in our Microsoft business environment. Visiting LinkedIn or WhatsApp via a link is subject to those services’ privacy practices.
4. Processing on behalf of clients
Project support can involve the names and contact details of employees, suppliers and other stakeholders. When Imaan Operations processes personal data solely under a client’s instructions, the parties assess their actual roles and enter into a data processing agreement in advance where required. The client is responsible for its purposes and instructions, while Imaan Operations follows applicable terms and retains its own statutory security and processor obligations.
Where Imaan Operations acts as a processor, personal data are handled according to the client’s documented instructions. Where required by law, a separate data processing agreement is entered into beforehand; this notice does not replace it. Sub-processors are only used with the authorisation and safeguards required for that role.
5. Recipients and security
Necessary service providers may process data, including Cloudflare for hosting and Microsoft for Forms, email and business storage; authorised administration providers may be used for invoicing. We do not sell personal data. Access is restricted to what is needed, business accounts are protected and sharing is limited to lawful purposes. Any transfers outside the EEA must meet applicable GDPR transfer requirements and safeguards.
6. Retention
Standalone business enquiries and contact details are normally retained for up to twelve months after the last substantive contact, unless an engagement starts or a documented reason requires longer retention. Accounting records are generally retained for seven years or as otherwise required by law. Client project data are handled in line with the engagement, any data processing agreement, reasonable security and backup measures, and legal retention obligations.
7. AI and automation
Imaan Operations may use AI and automation for supporting tasks such as drafting, summarising, organising, analysing and preparing action lists. Sensitive, confidential or identifiable client information is not sent to external AI services without appropriate safeguards, agreements and a lawful basis where required. We use data minimisation or anonymisation where practicable, review outputs in line with the task and do not use AI for solely automated decisions producing legal effects for individuals.
Before using external AI services for client-confidential information or personal data, we assess whether appropriate contractual, technical and organisational safeguards exist. For processor activities, client instructions, any sub-processor authorisations and rules for transfers outside the EEA apply. Not every digital tool is appropriate for every category of information.
8. Your rights
Where Imaan Operations is the controller, applicable rights may include access, correction, erasure, restriction, portability and objection. Requests can be made to info@imaanoperations.com and will be addressed within statutory time limits. You may also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
9. Updates
This notice may be updated if the services, suppliers or processing materially change. The current version is available on this website. Additional contractual and privacy agreements may apply to client work.