Privacy Policy

Last updated: 24 September 2026

‍

1. Who we are

DuckDuckGoose B.V. (“DuckDuckGoose”, “DDG”, “we” or “us”) is responsible for the personal data processing described in this Privacy Policy.

‍

DuckDuckGoose B.V.
Molengraaffsingel 29
2629 JD Delft, The Netherlands
Chamber of Commerce number: 80296297
Email: info@duckduckgoose.nl

‍

This policy explains how we handle personal data when you visit our websites, contact us, request a demonstration or dataset sample, subscribe to updates, or communicate with us as a business contact. It applies to duckduckgoose.ai, duckduckgoose.nl and other DDG pages that link to this policy.

‍

This policy provides information about personal data processing. Reading it, using our website or accepting contractual terms does not constitute consent to optional marketing, tracking or international data transfers.

‍

2. Our role and the scope of this policy

For the website, business contact and sample-request activities described here, DDG acts as a data controller: we determine why and how the relevant personal data is processed.

‍

Where we process personal data on behalf of a customer through our detection services, the customer’s instructions, the applicable service agreement and any data processing agreement govern that processing. The customer is generally responsible for informing the individuals concerned. This policy does not replace those arrangements.

‍

The use of datasets and free samples is governed by the applicable dataset licence. This Privacy Policy does not grant rights to use those materials.

‍

3. Personal data we collect

Depending on how you interact with us, we may collect:

‍

Contact and professional details, such as your name, business email address, telephone number, organisation and job title.
Information you provide in messages, forms, meeting requests, support enquiries or feedback.
Sample-request information, including the requested pack, your organisation, stated evaluation needs and delivery details.
Records of contractual acceptance, including the terms version, acceptance date and information identifying the person accepting.
Access and download records, such as request identifiers, timestamps, download status, IP address and browser information.
Communication preferences and records of marketing consent, withdrawal or objection.
Technical website information, such as pages visited, device and browser information, and cookie or similar identifiers, subject to applicable consent requirements.

‍

We obtain this information from you, from your interactions with our systems and, where relevant, from your organisation when it appoints you as a contact.

‍

Fields marked as required are needed to handle the relevant request or provide the requested function. Without them, we may be unable to respond, arrange access or deliver samples. Optional information and marketing consent are not conditions for receiving a sample.

‍

Please do not submit genuine identity documents, sensitive personal information or other people’s personal data through general enquiry or sample-request forms unless we have agreed an appropriate process with you.

‍

4. Why we use personal data and our legal bases

‍

Responding to enquiries and arranging demonstrations

We use contact details and correspondence to answer questions, arrange meetings and discuss requested services. We rely on our legitimate interests in responding to business enquiries and maintaining business relationships.

‍

Where the processing is necessary to take steps at your request before entering into a contract with you personally, we rely on that contractual basis.

‍

Delivering samples and administering agreements

We use request, acceptance and delivery information to assess and fulfil sample requests, issue download links, provide necessary communications and administer the applicable licence.

‍

Where you act for an organisation, we rely on our legitimate interests in managing that organisation’s request and agreement, verifying authority and maintaining evidence of the agreed terms. Where you are personally a party to the agreement, we rely on the necessity of performing that agreement.

‍

Protecting access and preventing misuse

We use relevant technical, access and download records to secure our systems, manage access, investigate delivery problems, prevent fraud or misuse and protect our rights. Our legal basis is our legitimate interests in operating secure services and protecting our business, users and rights holders.

‍

Marketing and optional tracking

We rely on your consent to send newsletters and promotional emails and to use cookies or similar technologies where consent is required.

‍

Legal obligations and claims

We process personal data where necessary to comply with applicable legal obligations, including responding to valid data protection requests. We may also retain and use relevant records for our legitimate interests in establishing, exercising or defending legal claims.

‍

When relying on legitimate interests, we assess the necessity of the processing and balance those interests against your rights and reasonable expectations.

‍

5. Emails and marketing choices

Requesting a demonstration or downloading a dataset sample does not automatically subscribe you to marketing.

‍

We send newsletters and promotional emails only after a separate opt-in. Marketing consent is optional and is not bundled with acceptance of a dataset licence or other contractual terms.

‍

You can unsubscribe using the link in our marketing emails or by contacting info@duckduckgoose.nl. Withdrawing consent does not affect the lawfulness of earlier processing.

‍

We may still send messages necessary to handle your request, deliver a sample, address an access or security issue, or administer an existing agreement. These communications do not depend on marketing consent.

‍

We do not disclose your contact details to business partners for their own marketing without your separate permission.

‍

6. Who receives personal data

We disclose personal data only where necessary for the purposes described in this policy. Depending on the activity, recipients may include:

‍

Providers of website hosting, forms, meeting scheduling, customer relationship management, email delivery, cloud storage, IT support and security services.
Analytics or advertising providers where the relevant processing is covered by your choices and any required consent.
Professional advisers, such as lawyers, accountants and auditors, where needed for their work.
Authorities or other parties where disclosure is legally required or necessary for legitimate legal claims.
Prospective purchasers and their advisers in a business transaction, subject to appropriate confidentiality, access restrictions and data protection safeguards.

‍

Providers acting as our processors must process personal data under appropriate contractual instructions and security obligations. Where a recipient acts as an independent controller, we identify that role where necessary and ensure there is a lawful basis for the disclosure.

‍

7. International transfers

Some service providers may process personal data outside the European Economic Area.

‍

Where this occurs, we ensure that a lawful transfer mechanism applies. Depending on the recipient and destination, this may be an applicable European Commission adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, together with any necessary additional measures.

‍

Submitting information, accepting our terms or reading this policy does not by itself authorise an international transfer.

‍

You can contact info@duckduckgoose.nl for information about the destinations and safeguards applicable to your personal data, including how to obtain a copy of relevant safeguards.

‍

8. How long we keep personal data

We limit retention according to the purpose of the processing and distinguish routine operational records from evidence needed for legal obligations or claims.

‍

Enquiries and correspondence: we retain these while handling the enquiry and any ongoing discussion. After it closes, we retain only information needed for an existing business relationship, a specific legal obligation or a relevant legal claim.
Sample requests and delivery records: we retain these while handling delivery, access and the evaluation. Afterward, we retain only the records needed to document the licence, investigate a specific issue or address legal claims.
Licence and agreement evidence: relevant acceptance records may be retained for the applicable legal claims period and, if a dispute arises, until it is finally resolved.
Technical and security logs: retention depends on the function of the log, the period needed to detect and investigate access or security incidents, and whether a particular record is needed as evidence. Routine logs are deleted or anonymised when that need ends.
Marketing records: we retain subscription details while the subscription remains active. After withdrawal or objection, we retain limited suppression information to respect that choice and any evidence needed to demonstrate compliance.
Records subject to legal retention duties: these are retained for the applicable statutory period.

‍

The dataset evaluation period and the retention of personal data are separate matters. The end of an evaluation does not necessarily require deletion of the minimum evidence needed to demonstrate the licence or handle legal claims.

‍

9. Cookies and similar technologies

Our websites may use cookies, pixels and similar technologies to operate the website, remember choices, understand usage and support marketing.

‍

Strictly necessary technologies may be used without consent where legally permitted. Technologies that require consent are activated only after you make the relevant choice.

‍

Where we request consent, the cookie information provided with that choice identifies the relevant purposes, providers and durations. You can refuse optional technologies and withdraw consent through the website’s cookie controls.

‍

Accepting a dataset licence or other terms does not constitute cookie consent. You can also manage cookies through your browser, although blocking necessary cookies may affect some website functions.

‍

10. Security

We use technical and organisational measures appropriate to the nature and risks of the processing, including controls intended to prevent unauthorised access, disclosure, alteration and loss.

‍

No system can eliminate every security risk. If a personal data breach occurs, we assess it and notify the relevant authority and affected individuals where required by law.

‍

11. Your rights

Depending on the circumstances, you can request access to your personal data, correction, deletion, restriction of processing or a portable copy.

‍

You may object to processing based on legitimate interests for reasons relating to your particular situation. You may object to direct marketing at any time.

‍

Where processing depends on consent, you can withdraw it at any time without affecting processing that was lawful before withdrawal.

‍

To exercise your rights, contact info@duckduckgoose.nl. We may request proportionate information to verify your identity. We normally respond within one month. If a lawful extension is necessary, we will explain the reason within that initial month.

‍

You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, at https://www.autoriteitpersoonsgegevens.nl, or to the competent supervisory authority where you live or work. You do not need to contact us first.

‍

If your request concerns information that we process on behalf of a customer, we will assist that customer in handling it as required by the applicable arrangements and law.

‍

12. Changes to this policy

We update this policy when our processing changes or clarification is needed. The date at the top identifies the latest revision.

‍

We provide additional notice of material changes where required. Updating this policy does not create consent for a new purpose. Where consent is required, we request it separately.