Privacy policy

1. Controller

Astropel International Consulting B.V., Jarmuiden 27K, 1046 AC Amsterdam, the Netherlands, email [email protected] is the controller within the meaning of the GDPR. Data protection enquiries: [email protected].

2. What we process and why

Order data (name, contact details, address, service details, uploaded documents, identity data where required) – to perform the contract (Art. 6(1)(b) GDPR) and to comply with statutory duties (Art. 6(1)(c) GDPR).

Communication data (emails, contact-form messages, notes on your enquiries) – to answer enquiries and manage your request (Art. 6(1)(b) and (f) GDPR).

Website usage data (server logs: IP address, time, requested page, user agent) – to operate and secure the website (Art. 6(1)(f) GDPR). Logs are deleted after 7 days.

We do not use marketing cookies or tracking. Only technically necessary cookies (session for the staff panel) are set; they require no consent (§ 25(2) TDDDG).

2a. Cookies, consent and local storage

We set only technically necessary cookies without consent (§ 25(2) TDDDG): your language choice, your cookie decision, the draft of your request and the staff login session. Functional and statistical cookies are used only after you consent in the cookie banner; you can withdraw consent at any time via “Cookie settings” in the footer. The full list with names and storage periods is in our cookie policy.

Statistics: we use Google Analytics 4 (Google Ireland Limited, Dublin) to measure page views and submitted requests. In the EU/EEA, the UK and Switzerland it sets cookies only after your consent, otherwise runs cookieless, and choosing “Reject” switches it off; elsewhere “Reject” limits it to cookieless measurement. Details, cookie names and storage periods are in our cookie policy.

Order form: we count anonymously how many browser sessions reach each step of the order form (no IP address, no cookies, only the form's own session number). When you start a request we ask for your email address first; we use it to send you the quote and, if you leave the request unfinished, a single email with a link to continue it. Legal basis: steps prior to a contract at your request (Art. 6(1)(b) GDPR). You can object at any time by replying to that email.

3. Recipients

Independent notaries and court-sworn translators (to perform the service you requested).

Competent authorities (for apostilles and legalisations).

Shipping providers (DHL / Deutsche Post) for physical delivery.

Hosting provider: Serverplance Bilişim ve Telekomünikasyon Hizm. Ltd. Şti., Bursa, Türkiye (order processing agreement; transfer to a third country safeguarded by the EU standard contractual clauses, Art. 46 GDPR).

Transactional email provider: ZunaSend (Zunapro), Türkiye – transfer safeguarded by the EU standard contractual clauses (Art. 46 GDPR).

Payment provider: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland – receives the amount, order reference, your email address and your chosen payment method; card and bank details are entered on Stripe’s encrypted checkout and never reach us. Stripe may also process data in the USA (Stripe, Inc.) under the EU–US Data Privacy Framework and standard contractual clauses.

4. Storage periods

Identity document copies: deleted once the check is complete, at the latest after 30 days.

Uploaded documents and results: 90 days after delivery.

Order data, timeline and email log: 3 years after completion.

Invoices and accounting records: 7 years (statutory retention under Dutch tax law).

5. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR), and the right to lodge a complaint with a supervisory authority, e.g. the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority of your country of residence. Contact: [email protected].

To exercise a right, email [email protected] from the address you used with us or write to the postal address above. We answer within one month (Art. 12(3) GDPR). Withdrawing a consent does not affect processing before the withdrawal.

Automated decision-making: we do not make decisions based solely on automated processing (Art. 22 GDPR). Identity verification with your phone (QR code, ID document and selfie) is reviewed by a member of staff.

6. Security

TLS encryption in transit, encrypted storage, access logging and role-based access for staff.