F-Register
F-Register privacy notice
Learn which personal data F-Register processes for its website, trial applications and platform, and what choices and rights you have.
Version 2026-10-29. Final, effective from 29 October 2026.
Responsibility and contact
F-Register, Banjaard 19, 2134 WS Hoofddorp, Netherlands, Chamber of Commerce 92549705, VAT NL004966153B65, controls personal-data processing for its website, applications, billing and business relationship. Contact info@f-register.nl or +31 23 707 0080; privacy/security incidents: privacy@f-register.nl.
For an installation business’s customer environment, that business normally determines the purposes and F-Register processes on its instructions. If it processes for another business operator, the contractual chain reflects that. For installation-file rights requests, contact the relevant installation business first; we assist on its instructions.
Data, purposes and legal bases
- Contact/demo: name, company, email, telephone and message to answer and follow up, based on contract preparation/performance or legitimate business communication.
- Trial applications: business/legal name, representative and capacity, address, contact, registration/VAT number, package, proposed domain and any supplied certificate details, to assess and deliver the requested service. Mandatory fields are needed for that purpose; certificate details are optional unless relevant to the chosen request.
- VAT and payment: VIES VAT-check result, necessary business/contact information sent to Mollie, payment status and mandate references. We do not receive full card details; limited account/card information may be available through Mollie. Bases are contract preparation/performance and applicable statutory obligations.
- Accounts/security: account, role, login, security and proportionate technical records to administer access, investigate misuse and secure the service, based on performance and our legitimate security interest.
- Tenant content: customer/employee/contact, location, installation, work-order, planning, photo/document and related records on the installation business’s instruction under the DPA.
- Marketing/mail: necessary contact and consent/preference records for the actual communication channel. Marketing and individual open tracking requiring consent are optional; withdrawing consent does not undo prior lawful processing. You may always object to direct marketing.
- Technical fault reports: necessary technical diagnostics and limited identifying information to investigate faults and secure service. We minimise free text, URLs, attachments and other unnecessary personal data. Limited technical analysis may use OpenAI; we limit data, recipients and retention to the configured business processing arrangement rather than sending whole customer environments.
- WhatsApp: when you use its link, your number and message are processed to answer you. WhatsApp/Meta also processes under its own terms. Do not provide unnecessary sensitive information.
Cookies and choices
Necessary functions work without marketing permission. We store your cookie choice locally. Analytics and advertising services, including Google Analytics/Ads and Meta Pixel, load only after the applicable consent. You can withdraw or change your choice through Cookie settings in the footer. These providers explain their processing in their own privacy notices.
Recipients and locations
F-Register manages its website, business email, application, access and security itself on Dutch server infrastructure. Worldstream supplies hardware, without management access to server content or a server-backup service for the described arrangement. Customer documents/photos and encrypted offsite backups use TransIP Object Store, Amsterdam, Netherlands, AMS2, with separate tenant projects and a separate backup project. The DPA lists the instructed subprocessors.
Mollie acts as an independent controller for its payment service; VIES is used for VAT verification. Brevo receives only necessary data for the mailing services actually used, under its terms including its DPA; it does not store full tenant dossiers for us. Customer-selected integrations are not automatically mandatory providers for every customer.
Google, Meta, WhatsApp and other external services may process data or allow access outside the EEA. Where applicable we require a valid transfer mechanism: the EU-US Data Privacy Framework only if the exact recipient is actively certified and the processing is covered, otherwise an applicable safeguard such as Commission standard contractual clauses with necessary assessment and supplementary measures. EEA storage alone does not rule out foreign access. Contact us for the safeguards actually applicable to a service.
Security and retention
Measures include isolated environments, roles, HTTPS, validation, maintenance, limited logs, backups and restore procedures. Monitor MFA is mandatory. Tenant MFA is voluntary per account and off by default. Temporary support requires customer approval and an active MFA-authenticated monitor session. The DPA describes restricted emergency recovery. No measure guarantees absolute security.
| Category | Retention |
|---|---|
| Contact/demo without follow-up | 12 months after handling |
| Rejected/expired application | 12 months after definitive rejection/expiry; necessary contract/payment evidence separately |
| Fiscal core administration | Normally seven years under applicable fiscal rules, with the correct statutory starting date |
| Temporary payment/checkout links | Until no longer necessary after expiry/handling; fiscal fields separately |
| Fault reports/mailbox | 12 months from receipt; technical working copies removed as soon as no longer necessary after handling |
| Login snapshots and security/web logs | At most 90 days, except a documented targeted investigation |
| Individual mail-open records | 90 days after sending, only with tracking consent |
| Marketing profile | While needed for permitted communication, reviewed annually; after opt-out erase the profile and keep only necessary suppression data |
| Suppression email hash | While needed to prevent unwanted re-import/sending, reviewed annually; a hash is not automatically anonymous |
| Minimal support/emergency-recovery evidence | Two years after closure; access/secrets end at expiry or revocation |
| Minimal rights-request/incident file | Three years after closure, reviewed for necessity annually; longer only with a documented legal need |
| Tenant content/exit export | Customer instruction and DPA; ordinary termination: one calendar month and at least 30 days from agreed end, and at least 30 days after a switching transition; then erasure subject to narrow statutory exceptions |
| Backups | Offsite 14 days; local at most five daily copies, with deletion instructions reapplied after restore |
Retention exceptions identify the necessary fields, legal ground, access and review period. They do not justify retaining whole dossiers indefinitely.
Rights and application decisions
You may request access, correction, erasure, restriction or portability and object where applicable; consent can be withdrawn. Contact info@f-register.nl. We verify identity proportionately and do not routinely demand an ID copy. We normally respond within one month and explain any lawful extension within that month. You can complain to the Dutch Data Protection Authority or the competent authority.
After email verification, valid EU VAT check, actual terms/DPA acceptance and successful payment authorisation, a trial may be provisioned automatically. Missing checks, duplicates or technical restrictions lead to manual assessment. You may request human review or explanation at info@f-register.nl. Material changes to this notice are dated and communicated where required; subscription and switching rights also follow the terms and DPA.