Privacy Policy

We may collect:

• identity and contact details, including your name, address, email and telephone number;
• company, director, representative and ultimate beneficial owner information, KVK records and documents needed to verify identity, authority, eligibility and compliance;
• application, agreement, service, invoice, payment and transaction information;
• mail-handling records, such as sender information, envelope images, scans and forwarding or destruction instructions;
• account, login, device, security and support records;
• messages sent through contact forms, callbacks, email, WhatsApp or Zoffis Assistant;
• workspace or meeting-room bookings, visitor and access records when those services are used; and
• website usage, cookie choices and technical data. Non-essential cookies are used only where permitted and according to your choices.

We process personal data to assess applications, enter into and perform agreements, allocate and operate business-address services, handle mail, provide accounts and support, process payments, manage workspace bookings, protect our customers and locations, prevent misuse and fraud, comply with tax, accounting, KVK, court, regulatory and other legal requirements, improve our services, and send service or marketing communications where allowed.

Our legal bases are performance of a contract or steps requested before a contract, compliance with legal obligations, our legitimate interests in running and protecting Zoffis, and consent where the law requires it. You may withdraw consent at any time without affecting earlier lawful processing.

We share only what is reasonably necessary with service providers that support hosting, security, customer accounts, email and communications, payments, document handling, mail and courier services, analytics, professional advice, compliance checks, workspace operations and the Zoffis Assistant. We may also disclose data to landlords or location partners where needed to provide the contracted service, and to authorities where required by law or necessary to protect legal rights.

Providers process data under appropriate contractual duties. If data is transferred outside the European Economic Area, Zoffis uses a lawful transfer mechanism and appropriate safeguards, such as an adequacy decision or approved standard contractual clauses.

Zoffis Assistant helps answer questions and may use the text you choose to submit. Do not enter passwords, payment-card details or identity documents into the assistant. Assistant conversations are not used by themselves to make decisions that produce legal or similarly significant effects. Applications, compliance questions and activation decisions include human review where appropriate.

We keep personal data only for as long as needed for the purpose collected, an active relationship, security, disputes and applicable legal duties. Contract, invoice and core administration records are generally retained for the applicable Dutch tax retention period. Compliance and identity records are retained for the period required by applicable law. Unsuccessful or abandoned application data, support messages, assistant records, mail scans and access records are deleted or anonymised according to documented schedules unless a longer period is required for a legal claim, fraud prevention or another legal obligation.

Current cookie durations are shown in the cookie settings. You may ask Zoffis for more information about the period that applies to a particular record.

Depending on the circumstances, you may request access, correction, deletion, restriction or portability of your personal data, object to processing based on legitimate interests or direct marketing, and withdraw consent. Contact us using the email above. We may ask for proportionate information to verify your identity and normally respond within one month.

You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). We would appreciate the opportunity to address your concern first.

Zoffis uses organisational and technical safeguards designed for the nature of the data and the risks involved. No internet service is completely risk-free, so please protect your login details and notify us promptly of suspected misuse.

Our services are intended for adults acting for a business or organisation, not for children. We may update this policy when our services, suppliers or legal duties change. Material changes will be communicated through the website, account or email as appropriate. The effective date above identifies the current version.