Privacy Notice | Engage Compliance

Engage Data Consulting B.V. (“Engage”, “us”, “we”, “our”) is a data protection and privacy services firm registered in the Netherlands (KvK 82538638). You can contact us at info@engagecompliance.co. This Privacy Notice describes how we collect, use, and share your personal information when you visit engagecompliance.co or use our services. It covers our customers (current or potential), partners, and website visitors (“you”, “your”), and our tools, consulting, and other services (“Services”).

Data we collect and what we use it for

In order to provide you with any requested products or services, we process the below information which is provided by you. This is either on the basis of your contract or per our legitimate interest if no contract is yet in place.

Contact details (name, email/phone, address, company details, etc.)
Other details you provide to us such as financial or company/customer information

We also may utilize your contact details (typically B2B) and analyze web/email/survey analytics to perform marketing activities (which will utilize your consent where appropriate, or legitimate interests otherwise) to help us best communicate with and provide relevant content to you.

Separately, we may obtain business contact information from third-parties for the purposes of communicating with potential customers, on the basis of legitimate interests.

When you complete our DPO readiness assessment or a pre-call questionnaire, we collect the answers you give about your organization, its data processing, and its risk profile, together with the contact details you provide. We use this to respond to your enquiry, prepare an indicative scope and quote, and, if you go on to purchase, to set up and perform your contract. The lawful basis is our legitimate interest in responding to your enquiry, and, where you become a customer, performance of our contract with you. We do not make any decision producing legal or similarly significant effects about you by solely automated means: an assessment result is a starting point for a conversation, not an automated decision.

Representative checker. If you enter your email address in our representative checker, we use it to send you your result and we may contact you about it, for example to offer a call. Our legal basis is our legitimate interest in replying to business enquiries. We send the email through our email provider and keep a record that it was sent for 12 months. The checker gives an estimate only and makes no decision about you.

Website visitor identification and business outreach

We use RB2B to identify business visitors to this website, and for the business outreach that follows. In the EU, the EEA, the UK and Switzerland, RB2B runs only if you accept cookies in our banner, and our legal basis for it there is your consent. Elsewhere, it runs unless your browser sends Global Privacy Control. When RB2B recognizes a visitor, we receive that person’s business profile (name, job title, employer, work email, LinkedIn profile and location) and the pages they visited. We use this to decide whether to contact someone about our services, on the basis of our legitimate interest in promoting those services to businesses that appear interested in them. We only consider people at companies of a size our services fit, and we never contact our customers, our partners, or anyone who has told us to stop.

Where we want to reach someone at a company but do not have a direct contact, we use a business contact data provider (BetterContact) to find the work contact details of the relevant decision maker. We contact business contacts at companies that visited our site by LinkedIn message (sent through HeyReach) and by email (sent through Instantly).

You can object at any time by replying “stop” to any message or by emailing info@engagecompliance.co. We will stop contacting you and keep only a record that you opted out, so that we do not contact you again. If we never contact someone, we delete the visit and profile data about them within 30 days.

First-party service and journey events

When you use our website or begin or complete a service journey, we create a first-party event record on Engage’s systems. The record can include the event and time, page path, a first-party session identifier, and service, market, and journey context. We use these operational fields to run, secure, troubleshoot, and measure our services. Our legal basis is our legitimate interest in operating and improving the service.

The record can also include a first-party visitor identifier, the referring URL, UTM campaign fields, and Google Ads click identifiers such as GCLID, GBRAID, or WBRAID. We use those fields to understand which campaigns lead to service activity and outcomes. In the EU, the EEA, the UK and Switzerland, we store them only if you accept analytics in our cookie banner, and our legal basis there is your consent. Elsewhere, we store them unless your browser sends Global Privacy Control, and our legal basis there is our legitimate interest in knowing which campaigns work. We do not currently upload the stored click identifiers to Google Ads.

The campaign labels in a link you click (UTM fields such as the source and the campaign name) and the name of the website that sent you to us are kept for the length of your visit, whether or not you accept analytics. They are saved with an order or a booking you make, so that we can tell which campaign led to it. They describe the link and not you. This is separate from the event record described above. Our legal basis is our legitimate interest in knowing which campaigns work.

We advertise in Google and ChatGPT. To see which ads work, we let Google and OpenAI know when someone books a call or makes a purchase, and its value. We don’t give them your name or contact details. If you arrived from one of our ads, we include the ad’s click reference so the result can be matched to the ad. In the EU, the EEA, the UK and Switzerland, Google’s tags set no cookies and no click reference is sent until you accept; elsewhere, both happen unless your browser sends Global Privacy Control.

Our website hosting and database providers process these records for us. We delete test event rows after 7 days. We remove Google click identifiers, the first-party visitor identifier, and the referring URL after 90 days. We remove UTM campaign fields after 395 days. We delete the remaining operational event record after 760 days.

We share your information with third parties only to run our business: to provide our services, store data, manage customers, measure our website and measure our ads. Our sub-processors do not process your information for their own purposes. Advertising platforms (Google, Reddit and OpenAI) may also use the measurement data we send them under their own terms.

Any transfers of information sourced from the European Economic Area (EEA) or the UK to outside these regions (which is rare) will only be done under adequate and compliant measures, utilizing standard contractual clauses (with the UK Addendum for UK data), the EU-US Data Privacy Framework and its UK Extension, transfer impact assessments, sufficient technical and organizational controls, and/or other adequacy measures.

Sub-processors

Sub-processor list last updated: 30 October 2026.

We use the following sub-processors and tools in operating this website and delivering our services. For each we list the provider, the service it provides, and where it is located. Providers marked “website only” only ever process data about our own website, scheduling and marketing, and never personal data a customer has entrusted to us:

Vercel Inc (EU, Frankfurt region, and USA): website hosting and delivery.
Neon Inc (EU, Frankfurt): serverless Postgres database for our application; covered by Standard Contractual Clauses.
GitHub, Inc. (USA): hosts the source code for our website and systems, and holds encrypted backups of our databases for seven days.
Anthropic, PBC (USA): AI tooling used in content production and operations.
Voyage AI (USA): AI tooling (text embeddings) used in content production and operations.
OpenAI Ireland Ltd (Ireland): AI tooling used in content production and operations. Our contracting entity is EEA-established, so OpenAI’s Data Processing Addendum makes OpenAI Ireland Ltd the contracting party and Ireland the location of processing; where OpenAI Ireland Ltd transfers EEA data outside the EEA it does so under Standard Contractual Clauses or a European Commission adequacy decision.
Formspree Inc (USA): contact form processing. Website only.
Captain Compliance (USA): cookie consent management platform; covered by a Data Processing Agreement and Standard Contractual Clauses. Website only.
Google LLC, GA4 (USA): website analytics; consent-gated in the EU, the EEA, the UK and Switzerland; elsewhere it runs unless Global Privacy Control is on. Website only.
Google Cloud EMEA Limited (Ireland): Google Workspace business email and correspondence, and AI translation checks on Google Cloud (EU region).
Gemini (via Google Workspace), Google Cloud EMEA Limited (Ireland): AI assistant features within Google Workspace.
Calendly LLC (USA): appointment booking.
HubSpot Inc (USA): customer relationship management, business contact details and deal records.
Stripe Payments Europe, Ltd (Ireland): payment processing and subscription billing for the DPO and EU Representative services.
Resend (USA): transactional and notification email.
RB2B (USA): identifying business visitors to this website, and the business outreach that follows; consent-gated in the EU, the EEA, the UK and Switzerland; elsewhere it runs unless Global Privacy Control is on. Website only.
HeyReach (Estonia, HeyReach Inc OÜ): LinkedIn outreach automation for business contacts. Website only.
Instantly (USA, Foo Monk, LLC): sending business emails to business contacts. Website only.
BetterContact (France, BETTERCONTACT, a French simplified joint stock company): looking up business contact details of decision makers at companies that fit our services. Website only.
OpenAI Ads (USA, OpenAI): advertising measurement through the OpenAI Ads pixel and Conversions API; every purchase and booking is reported with no name or contact details; the pixel and the click reference are consent-gated in the EU, the EEA, the UK and Switzerland, and elsewhere off when Global Privacy Control is on. Website only.
Google Ireland Limited, Google Ads (Ireland): advertising conversion measurement; consent-gated in the EU, the EEA, the UK and Switzerland; elsewhere it runs unless Global Privacy Control is on. Website only.
Reddit, Inc. (USA): advertising measurement through the Reddit Pixel; consent-gated in the EU, the EEA, the UK and Switzerland; elsewhere it runs unless Global Privacy Control is on; Limited Data Use applied where sale or sharing has not been agreed. Website only.
Ahrefs Pte. Ltd. (Singapore): website analytics; consent-gated in the EU, the EEA, the UK and Switzerland; elsewhere it runs unless Global Privacy Control is on. Website only.
OtterlyAI GmbH (Austria): AI-crawler analytics; our edge middleware forwards AI-crawler request data (the requested URL, the user agent, the timestamp, and the referrer where one is sent); named AI crawlers only, never ordinary visitor traffic. Website only.
SCANDO-UP GLOBAL LEGAL S.L. (Spain): named Article 27 representative for customers who choose the Spain option.
DeepL SE (Germany): automated translation of representative correspondence. Processed in the EU; texts are not stored after translation or used for training.

Transfers to providers outside the EU and UK are covered by the EU-US Data Privacy Framework where the provider is certified, and otherwise by Standard Contractual Clauses with supplementary measures.

For a complete and up-to-date sub-processor list, contact us at info@engagecompliance.co.

Data security and retention

We have put into place robust technical and organizational security measures (such as encryption of data at rest and in transit, need-to-know access controls) to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed.

Personal data is stored in the EU/UK and/or the US, with any provider located outside the EU/UK authorized to hold it under GDPR (via Standard Contractual Clauses and/or the EU-US Data Privacy Framework). We keep personal data only as long as necessary for the purpose it was collected for, and to comply with any legal, regulatory, or tax obligations. For more information on retention specifics, please contact us.

Cookies and tracking technologies

If you visit from the EU, the EEA, the UK or Switzerland, we show a cookie banner. Our analytics and advertising tools wait until you accept them, and our legal basis for them there is your consent. These are Google Analytics, Google Ads, the Reddit pixel, the OpenAI pixel, RB2B, Ahrefs and our own attribution cookie. If you visit from anywhere else, we show no banner and these tools run when the page loads. Our legal basis there is our legitimate interest in understanding our website and measuring our ads. To switch them off, turn on Global Privacy Control in your browser. You can also change your choices with the Cookie Preferences button in the footer, or email info@engagecompliance.co to object.

Your rights

You always have the right to revoke prior consent. You also may have the right to:

Access, correct, delete, object or restrict the use of, and obtain a list of third-parties who have access to your personal data
Opt out of the sale or sharing of your information. We do not sell your personal information. Outside the EU, the EEA, the UK and Switzerland, our advertising pixels may count as “sharing” under some US state laws. Turn on Global Privacy Control or email us to opt out.
Opt-out of automated decision-making, profiling, marketing, and targeted advertising
Complain to a data protection authority, such as the Autoriteit Persoonsgegevens in the Netherlands, the Information Commission (ICO) in the UK, or the authority in your own country.

To exercise these rights, please see our contact details below.

Contact us

For any questions on the processing of your personal data, to reach our data protection officer, or for additional information on this privacy notice please contact us at info@engagecompliance.co.