Legal
Privacy Policy
This Privacy Policy explains how GambitGrid ("we", "us", "our") collects, uses, and protects your personal data when you visit our website or use our services. We are transparent about what we hold, we only use analytics that earn their keep, and we handle your data in line with the EU General Data Protection Regulation (GDPR).
Who we are
GambitGrid is an AI-enhanced marketing and automation agency based in the Netherlands. For the personal data described in this policy, GambitGrid is the data controller: we decide what data is collected and why. You can reach us through the contact page on this website, and our Chamber of Commerce (KvK) and VAT registration details are shown on our invoices and available on request.
Data we collect
We collect the information you choose to give us, plus technical and usage data. Through the contact form we receive your name, email, company, and message. Through the free AI scan we receive your email, website, company size, sector, and goal. When you book a call we use Calendly, which processes your name, email, and scheduling details. Our hosting and analytics tools record technical and usage data such as approximate location, device and browser type, pages viewed, and how you move through the site. Some of this analytics data is collected through cookies, as explained in our Cookie Policy. We do not use this data to build advertising profiles of visitors.
How we use your data
We use your data to respond to your enquiries, deliver the services you request, prepare and email your AI scan roadmap, send relevant updates (only if you opt in), keep our website and systems secure, and understand in aggregate how the site is used so we can improve it. We never sell your data.
Legal basis for processing
Under the GDPR we rely on: your consent (for example, marketing emails you opt into); the performance of a contract or steps taken at your request before entering one (responding to enquiries and delivering services); our legitimate interests (running, securing, and improving our website and business, balanced against your rights); and legal obligations (such as tax and accounting record-keeping).
Who we share data with
We share data only with the service providers that help us run our business, and only as needed. These include our hosting and security provider (Cloudflare), our scheduling tool (Calendly), our email provider, and our analytics providers: Ahrefs Web Analytics and our own first-party analytics (both cookieless), together with Google Analytics and Mixpanel (which use cookies to measure usage). Each acts as our processor under a data processing agreement. We may also disclose data where the law requires it. We do not sell or rent your data to third parties.
International data transfers
Some of our providers, including Google Analytics and Mixpanel, are based in the United States and may process data outside the European Economic Area. Where that happens, we rely on safeguards recognised under the GDPR, such as the EU Standard Contractual Clauses or an adequacy decision, so that your data keeps an equivalent level of protection.
How long we keep data
We keep personal data only as long as we need it. Enquiry and scan data is kept for a limited period unless it turns into a client relationship. Client and financial records are kept for as long as Dutch law requires (generally seven years for accounting records). When data is no longer needed and no legal obligation applies, we delete or anonymise it.
How we protect data
We use encryption in transit (HTTPS), access controls, and reputable EU-aligned providers to protect your data against loss, misuse, and unauthorised access. No system is perfectly secure, but we take reasonable technical and organisational measures to keep your data safe.
Cookies
We use a mix of cookieless analytics (Ahrefs and our own first-party analytics) and cookie-based analytics (Google Analytics and Mixpanel). We do not use advertising or cross-site tracking cookies. Where a cookie needs your consent, we set it only on that basis, and you can change or withdraw your choice at any time. See our Cookie Policy for the full detail.
Your rights
Under the GDPR you have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw any consent you have given. Contact us to exercise these rights and we will respond within the statutory timeframe. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Changes to this policy
We may update this policy from time to time as our services or the law change. The current version is always available on this page, with the date of the latest update shown below.
Contact
For any privacy question or to exercise your rights, contact us through our contact page and we will get back to you.
Last updated: July 2026