This page sets out how TIF Synergy collects, uses, retains and protects the personal data submitted through this website and our enquiry channels. It is written under the EU General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) and the Dutch Implementation Act (Uitvoeringswet AVG, UAVG).
This notice covers personal data submitted through this website and our enquiry channels. Personal data processed through the TIF Suite (TaxLex, TaxTrack, TaxTag and TaxMap) is covered by a separate privacy notice, published with the Suite terms of use, which names its own controller.
Last updated: 4 October 2026.
The data controller for personal data submitted through this website is Blauw Belastingen B.V., a private company incorporated in the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 58905375, VAT number NL853231886B01, with registered office at Oudezijds Achterburgwal 173, 1012 DJ Amsterdam, the Netherlands. Blauw Belastingen B.V. trades as TIF Synergy. TIF Synergy operates in the Netherlands and in Ireland (through TIF Synergy Ireland Limited) and principally within the European Union, the United Kingdom and the United States. Where TIF Synergy operates through more than one legal entity, Blauw Belastingen B.V. is the controller responsible for personal data submitted through this website; references to "TIF Synergy" or "the firm" in this notice are references to that entity. The adviser carrying out the work is personally registered with the Nederlandse Orde van Belastingadviseurs (NOB), the Dutch professional body for tax advisers. That registration binds the individual, not the company.
For any matter relating to your personal data (including questions, data-subject rights requests or complaints), write to info@tifsynergy.com. We treat data-protection enquiries with priority and aim to respond within two working days.
When you complete the contact form on this site, the following personal data is collected and stored:
Your name, email address, the organisation you represent (optional), the topic of your enquiry and the free-text message you send. We capture only what you choose to type into the form.
Your IP address, browser user-agent string and the HTTP Origin / Referer headers attached to your request. These are used to detect spam, abuse and automated submissions; they are not used for marketing or profiling.
The date and time at which the form was submitted, used to triage enquiries and to apply rate limits that protect the form from abuse.
If you register your interest through the launch-registration form on our launch page, we collect your name, email address and, if you choose to provide it, a phone number. We use these details to notify you when the Suite goes live and, where a phone number is given, to arrange a call, on the basis of our legitimate interest in responding to the interest you have registered (GDPR Article 6(1)(f)). If you opt in via the marketing consent box on the form, we also use your email address to send you TIF Weekly, our weekly digest of tax law and policy developments, and occasional product updates about the Suite. That marketing is carried out only on the basis of your consent (GDPR Article 6(1)(a)), which you can withdraw at any time without affecting the lawfulness of processing before withdrawal. We retain launch-registration data until the Suite launches or until you unsubscribe or ask us to delete it, whichever comes first, and newsletter subscription data until you unsubscribe. We do not use your details for any other purpose. We do not sell or share them with third parties for their own use. We send this email from our own Microsoft 365 mailbox. Microsoft B.V. acts as our processor for that mailbox under a data-processing agreement and handles your details only on our instructions.
If you complete the Tax Function Quick Scan, the Tax Data Check, the Tax Reporting Check or the Tax Technology Readiness Check, your answers are scored in your browser and are not sent to us or stored by us. We receive them only if you ask for a written reflection on your result. In that case we collect the name you give (a pseudonym is fine), your email address and, if you choose, your organisation, together with your answers and the result calculated from them, and we use them only to write that reflection. We process this on the basis of our legitimate interest in responding to an enquiry you have initiated (GDPR Article 6(1)(f)), the same basis as the contact form, because a request for a reflection is an enquiry. If you opt in via the marketing consent box, we also use your email address to send you TIF Weekly and occasional product updates about the Suite, on the basis of your consent (GDPR Article 6(1)(a)), which you can withdraw at any time. A reflection request reaches us through the same channel as a contact-form enquiry and is retained on the same terms: 24 months where the enquiry does not convert. The scoring is automated, but it scores your tax function, not you: we do not evaluate personal aspects of you and no decision about you is taken by automated means. We do not use it to train AI models, and we do not sell or share it with third parties for their own use.
We run privacy-first, cookieless analytics on this site using Microsoft Azure Application Insights, configured so that it sets no cookies and reads nothing from your device (see "Website analytics" below). We do not run advertising trackers, social-media pixels or third-party tag managers, and we do not use analytics data to profile you or to track you across other sites. We do not set cookies on the marketing pages. The only cookies set anywhere on the site are functional session cookies inside the Suite portal at /suite, which exist only when you are signed in and are required for the Suite to function.
We use Microsoft Azure Application Insights to understand how this website is used, so that we can improve it. The analytics are cookieless: the tool sets no cookies, writes nothing to your browser or device storage, and reads nothing back from it. It is first-party analytics running in our own Microsoft Azure tenant in the West Europe region; we do not share the data with any advertising network and we do not use it to profile you or to track you across other websites.
The analytics collect limited, pseudonymous usage data that we review only in aggregate. It includes the pages visited, the referring page, approximate load performance and general browser and device type. Your IP address is processed transiently by Azure to derive an approximate (country or city-level) location and to guard against abuse, and is then masked so that the full IP address is not stored. We do not attempt to identify individual visitors from this data.
We also record a small, fixed set of interaction events, so that we can see which pages lead people to get in touch and which do not. This says which events we record rather than asserting that we record nothing else: sending the contact form, registering for launch updates, requesting a written reflection from one of the self-checks, opening the booking link and following a link to the Suite, to a product page or to a download. Each event records only the page you were on and at most two short category labels, such as which subject you chose in the "What is this about?" list, which of the four Suite tools a link pointed at, or whether a submission succeeded or failed. No name, email address, organisation, phone number, message text, self-check answer or self-check result is ever included in an interaction event: what you type into a form reaches us through the form itself, described in the sections above, and never through the analytics. The events set no cookies and read nothing from your device, and they are held for the same 90 days on the same legitimate-interest basis set out below.
We process this analytics data on the basis of our legitimate interest under GDPR Article 6(1)(f) in understanding and improving how our site performs. We have weighed that interest against your interests and rights and consider the impact minimal: the analytics are cookieless, IP-masked, not used for profiling or cross-site tracking, confined to our own tenant and reviewed only in aggregate. Because the analytics set nothing on and read nothing from your device, they do not require your consent under Article 11.7a of the Dutch Telecommunications Act (the cookie rule); we still give you the information here and the right to object below.
Analytics telemetry is retained for 90 days and is then deleted automatically. You have the right to object to this processing at any time under Article 21 GDPR; write to info@tifsynergy.com and we will stop processing your data for analytics.
We process the personal data you submit on the basis of our legitimate interest under GDPR Article 6(1)(f) in responding to an enquiry that you have initiated. We do not require your consent to do this because you have made the enquiry yourself; processing the contents of that enquiry is what allows us to reply.
We use the data submitted through the contact form only to:
We do not use contact-form enquiry data for marketing, profiling, automated decision-making or to train AI models, except that, if you tick the marketing-consent box on the contact form, we use your email address to send you TIF Weekly and occasional product updates about the Suite on the basis of your consent (GDPR Article 6(1)(a)), which you can withdraw at any time. Launch-registration data is likewise used for marketing only where you have given consent on the launch form, as described above. We do not sell or share your data with third parties for their own use.
Personal data collected through the contact form or a self-check reflection request is retained for 24 months from the date of submission, after which it is deleted from our active systems and from any backups within the standard backup-rotation period. This period reflects the typical B2B sales-cycle length for professional-services engagements (where follow-ups commonly recur at the next budget cycle) and gives effect to the storage-limitation principle in Article 5(1)(e) GDPR. Where you have consented to receive TIF Weekly through this form, your email address is retained as newsletter subscription data until you unsubscribe, independently of the 24-month enquiry-retention period above.
Exception: if your enquiry becomes a client engagement, your data is then held under the terms of that engagement (typically a signed engagement letter). The seven-year retention obligation for administrative records under article 52, paragraph 4, of the Dutch General State Taxes Act (Algemene wet inzake rijksbelastingen) constitutes a legal retention obligation within the meaning of Article 17(3)(b) GDPR and therefore overrides the 24-month default for any record falling within its scope.
You can ask us to delete your data sooner. See "Your rights" below.
Enquiry submissions are stored in the European Union (Microsoft Azure, West Europe region) and are accessible only to authorised personnel under role-based access controls. We do not transfer enquiry data outside the EU/EEA in the ordinary course of business. Launch-registration data is held in the same Microsoft Azure environment. When we send you the emails described above, your name and email address are also processed in our Microsoft 365 mailbox. We do not state a data location for that mailbox, because a Microsoft 365 tenant's data location is a per-service setting; we will tell you the current location on request.
We use the following processors (sub-processors), each governed by appropriate data-processing terms:
Where a processor, or a sub-processor engaged by it, is located outside the EU/EEA, the transfer is covered by a European Commission adequacy decision or, where no adequacy decision applies, by the Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914 of 4 June 2021, together with, where applicable, supplementary technical and organisational measures consistent with the Schrems II judgment of the Court of Justice of the European Union (Case C-311/18, 16 July 2020).
Client-tenant deployments. Where TIF Synergy delivers a system that is deployed into the client's own Microsoft Azure tenant, the personal data processed by that system resides in the client's tenant, not in TIF Synergy's. In those engagements, the client is the controller (and where applicable the processor) for the data the system processes; TIF Synergy acts as the implementer and, after handover, only as an adviser on request. The engagement letter sets out the allocation of controller / processor responsibilities for the duration of the work.
As a data subject under the GDPR, you have the following rights regarding personal data we hold about you:
To exercise any of these rights, write to info@tifsynergy.com. We will respond within one month, as required by Article 12(3) GDPR; the period may be extended by a further two months for complex requests, in which case we will tell you within the first month and explain why.
Personal data submitted through the contact form is transmitted over HTTPS (TLS 1.2 or higher), stored encrypted at rest in Microsoft Azure, and accessible only to authorised personnel under role-based access controls.
Our infrastructure follows the principles set out in Article 32 GDPR: confidentiality, integrity, availability and resilience of processing systems.
The TIF Suite is covered by its own privacy notice and its own data processing schedule, not by this notice. Where TIF Synergy operates the Suite as a service, it is hosted in Microsoft Azure regions in the European Economic Area, mainly West Europe; where AI processing runs and what leaves the EEA are set out at clause DP7 of the data processing schedule. There is one schedule per contracting entity: the TIF Synergy Ireland Limited schedule applies unless your organisation is established in the Netherlands and has accepted the Blauw Belastingen B.V. terms, in which case the Blauw Belastingen B.V. schedule applies. Microsoft's ISO/IEC 27001 certification and SOC 1, SOC 2 and SOC 3 reports cover its infrastructure, not TIF Synergy's application or operations. TIF Synergy holds no ISO 27001 certification and no SOC 2 report.
In the event of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the Autoriteit Persoonsgegevens within 72 hours and, where the risk is high, will notify affected data subjects directly without undue delay (Articles 33 and 34 GDPR).
We may update this page when our processing activities change, for example if we add a new processor, change retention defaults or alter the lawful basis for a category of processing. Any material change will be reflected in the "Last updated" date at the top of this page; substantive changes that affect previously-collected data will be communicated separately where required.