Privacy statement
This page is maintained by PRØTOCOL and explains what personal data we collect, why we collect it, and the rights you have under the GDPR.
Who is responsible
PRØTOCOL (theprotocol.nl) is the controller for the personal data described here. Contact: info@theprotocol.nl.
What we collect
- 01Contact and order data — name, email address, chosen programme, amount paid, order status.
- 02Programme data you share with us — intake answers, lab and test results, wearable or glucose readings, notes from sessions.
- 03Technical data — IP address and basic request data logged by our hosting and payment providers for security and fraud prevention.
Health-related programme data is special category data. We only process it because you actively provide it to us for the programme you purchased (explicit consent), and you can withdraw that consent at any time.
Why we use it
Who processes data for us
- 01Mollie B.V. — payment processing (Netherlands, EU).
- 02Our cloud backend and hosting provider — website hosting, database and order records (EU region).
- 03Laboratories and test partners — only the data needed to run the test you ordered.
We do not sell personal data and we do not use it for advertising profiling.
How long we keep it
- 01Invoices and payment records: 7 years (Dutch tax law).
- 02Programme and test data: for the duration of your programme plus 24 months, unless you ask us to delete it sooner.
- 03Support email: up to 24 months.
Your rights
You can request access, correction, deletion, restriction, a portable copy of your data, or object to processing. Email info@theprotocol.nl — we respond within 30 days. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Questions about this document? Email info@theprotocol.nl and we respond within 5 working days.