Legal

Privacy Statement

How Eucade handles personal data under the GDPR. Last updated September 2026.

This Privacy Statement explains how Eucade processes personal data of website visitors and prospective and current clients. Eucade is based in the Netherlands and complies with the General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”) and the Dutch implementing act.

Data controller

Eucade, the trading name of Gerben Bijmholt, sole proprietorship registered in the Netherlands (KvK 98799037), is the data controller for personal data processed in connection with its services. Contact: [email protected].

What data we collect

Website visitors

The eucade.eu website does not use advertising trackers, behavioural cookies, or cross-site tracking of any kind. We use Cloudflare Web Analytics to count page views and see which pages and referrers bring people here. It sets no cookies, stores no identifier on your device, and cannot follow you to other websites. Standard server logs (IP address, timestamp, user agent, requested URL) may be retained by our hosting provider (Cloudflare) for the purpose of security and abuse prevention.

Intake form submissions

When you submit an intake form, we collect the information you provide, which may include:

• Your name, email address, and organisation
• A description of your sector, technology, and funding interest
• Any additional context you choose to share

Client engagement data

If you engage Eucade for paid services, we additionally process:

• Billing information (company address, IBAN, VAT number where applicable)
• Communication records (emails, signed agreements)
• Application-related materials you share with us for grant preparation

Business outreach by email

We sometimes email people at companies that may be eligible for an EU funding call, without being asked first. This section explains what we use for that and why.

What data we use

• Your name and job title
• Your business email address
• Company details: name, website, country, and what the company works on

Where it comes from

• Public company websites
• Public EU project databases, such as CORDIS, which list the organisations that took part in EU-funded projects
• A business contact database (Lusha)

Legal basis

Legitimate interest (GDPR Art. 6(1)(f)): our interest in telling a business about a funding call that may be relevant to its work. We write to business email addresses only.

Link clicks

Links in our outreach emails pass through our own link address. When you click one, we record for your email address that the link was clicked, and when. We use this only to decide whether and when to follow up.

How long we keep it

If you do not reply, we delete your data 12 months after our last contact with you.

Your right to object to our outreach

You can object to our outreach at any time, free of charge and without giving a reason (GDPR Art. 21). Use the unsubscribe link at the bottom of our emails, or email [email protected]. We then put your email address on a block list and do not email you again. We keep only that address on the block list, for as long as it is needed to make sure you are not contacted again.

Purposes and legal bases

We process personal data for the following purposes:

• Responding to intake inquiries, legal basis: pre-contractual measures at your request (GDPR Art. 6(1)(b))
• Delivering services under a Service Agreement, legal basis: performance of contract (Art. 6(1)(b))
• Tax and accounting records, legal basis: legal obligation (Art. 6(1)(c))
• Business outreach by email, legal basis: legitimate interest (Art. 6(1)(f))
• Security and abuse prevention, legal basis: legitimate interest (Art. 6(1)(f))

Sub-processors

Eucade uses service providers in the following categories, each of which acts as a sub-processor:

• Website hosting, content delivery and security
• Email hosting
• Intake form processing
• Electronic signing of agreements
• Payment processing
• Productivity, AI-assisted drafting and workflow automation tooling

The current list of sub-processors, with their names and locations, is set out in the Data Processing Annex to our agreement and is available on request. Each sub-processor has its own privacy practices and may be located outside the EU. All cross-border transfers rely on standard contractual clauses or equivalent safeguards.

How long we keep your data

• Intake submissions that do not lead to engagement: deleted within 24 months
• Business outreach contacts who do not reply: deleted 12 months after our last contact. An address on our block list is kept for as long as needed to honour your objection
• Client records: retained for the duration of engagement, plus the statutory retention period (7 years for Dutch tax records)
• Server logs: as retained by Cloudflare, typically 30 days

Your rights

Under the GDPR you have the right to access, rectify, erase, or restrict processing of your personal data, to object to certain processing, and to data portability. You may exercise these rights by emailing [email protected]. You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) if you believe your rights have been violated.

Changes to this statement

We may update this Privacy Statement from time to time. The current version is always available at eucade.eu/privacy. Material changes will be communicated by email to current clients.