Privacy Statement
Last updated: 30 October 2026
This is a translation for information only. The Dutch version of this privacy statement is legally binding.
This privacy statement explains which personal data Element Offices processes, why we do so, with whom we share it and how long we keep it. It applies to visitors to our websites, contact persons, people who request a quote or a viewing, tenants of physical and virtual office space, tenants’ employees insofar as we process their data to provide our services to the tenant, and applicants who respond to a vacancy via our website.
1. Who is responsible?
Element Offices B.V.
Winthontlaan 200, 3526 KV Utrecht, the Netherlands
Chamber of Commerce number 60225823
Email: legal@elementoffices.nl
Phone: +31 30 750 88 88
Element Offices B.V. and the companies within the Element group that operate our locations are jointly responsible for the data we process through our websites, the member portal, the tenant portal and the tenant app, and when you use our physical and virtual office locations. Your agreement states which company operates your location. For any privacy question, contact legal@elementoffices.nl.
2. Which data do we process, why, and on what legal basis?
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Contact, quote and viewing requests (form, email, phone, chat) | Name, company name, email address, phone number, preferred location and service, your message | Performance of (steps prior to) a contract | 2 years after the last contact, unless a contract follows |
| Concluding and performing rental, membership and virtual office agreements | Name, company and billing details, Chamber of Commerce number, contact details, details of users and employees, contract and booking data | Performance of a contract | 2 years after the end of the agreement |
| Account for the member portal, the tenant portal and the tenant app (bookings, access, community) | Name, email address, phone number, company, account and booking data | Performance of a contract | 1 year after your account is closed |
| Messages via the tenant app (push notifications and WhatsApp) | Name, phone number, device and account data | Functional messages (such as a booking or payment confirmation): performance of a contract. Informative and commercial messages to customers: soft opt-in (art. 11.7(3) Dutch Telecommunications Act); you can always unsubscribe | As long as your account is active, or until you unsubscribe |
| Invoicing, payments, debt collection and reminders | Name, company and billing details, payment details, invoice and payment history | Performance of a contract; legal (tax) obligation; for reminders also legitimate interest | 7 years (statutory tax retention) |
| Customer due diligence under the Dutch Anti-Money Laundering Act (Wwft) (for virtual offices and registered addresses) | See section 3 | Legal obligation; for biometric verification your explicit consent | 5 years after the end of the business relationship |
| Answering questions via Elle, our AI assistant (website chat and phone) | Your questions and the answers (transcript), for phone calls also the voice recording and your phone number; name, email address and preferred location if you provide them | Legitimate interest (a quick answer, also outside office hours), or performance of a contract. The chat only starts after consent via the cookie banner | 30 days; if you ask to be contacted, we keep a summary as a contact request (see above) |
| Recording phone calls with our staff | Voice recording, your phone number, date and time of the call | Legitimate interest (quality of our services and staff training) | 30 days |
| Newsletter and commercial messages | Name, email address, company, interests | Consent, or soft opt-in for existing customers (art. 11.7(3) Dutch Telecommunications Act) | Until you unsubscribe |
| Job applications | CV, motivation letter, contact details and anything else you send us | Steps prior to an employment contract at your request; your consent for longer retention | 4 weeks after the end of the procedure, or 1 year with your consent |
| Security, fraud prevention and improving our services | Usage and technical data, such as IP address and log files | Legitimate interest | 13 months |
| Website statistics and advertising | Cookie and device data, IP address, browsing behaviour on our site | Consent via the cookie banner (necessary cookies: no consent required) | See the Cookie Statement |
| Camera surveillance and access registration at our locations | Camera images, access logs (who, where, when) | Legitimate interest (safety of people and property) | See the camera surveillance and access registration protocol at the location |
Data we need to conclude an agreement or to comply with a legal obligation is mandatory. Without it, we cannot provide our services to you.
3. Customer due diligence (Wwft) for a virtual office
If we provide you with a registered or postal address, the Dutch Anti-Money Laundering and Anti-Terrorist Financing Act (Wwft) requires us to carry out customer due diligence.
Which data. Identity data of you and of the directors, representatives and ultimate beneficial owners (UBOs) of your company, data from the Trade Register and the UBO Register, the results of screening against sanctions lists, politically exposed persons and adverse media, the verification of your identity, your answers in the onboarding portal, and the account from which the first payment was made.
Identity verification. We use a specialised service provider to verify your identity. This involves comparing a photo or short video of your face with the photo on your identity document (biometric verification and a liveness check). We only do this with your explicit consent (art. 9(2)(a) GDPR), which you give in the application. If you do not give this consent, please contact us for an alternative way to identify yourself.
Source. Data you do not provide to us yourself, such as data from the Trade Register and the UBO Register and the results of sanctions and PEP screening of directors, representatives and UBOs, comes from the relevant public register or from the service provider that carries out the screening for us (art. 14(2)(f) GDPR).
Purpose and legal basis. Solely the prevention of money laundering and terrorist financing. The legal basis is a legal obligation (art. 6(1)(c) GDPR, in conjunction with art. 3 Wwft). We do not use this data for any other purpose (art. 34a Wwft).
Mandatory. Providing this data is a statutory requirement for entering into or continuing the business relationship. Without it, we are not allowed to provide a virtual office or any other service to you (art. 13(2)(e) GDPR).
Recipients. A specialised service provider for identity verification and a specialised service provider for register data and sanctions, PEP and adverse media screening, with whom we have a data processing agreement. In addition, the Financial Intelligence Unit Netherlands and the Dutch Tax Administration/Wwft Supervision Office, insofar as the law requires us to, including reporting unusual transactions (art. 16 Wwft).
Retention period. Up to 5 years after the end of the business relationship (art. 33 Wwft). After that, we delete the data.
Your rights. You can exercise the rights in section 9. These rights may be limited insofar as the Wwft requires. Questions about customer due diligence can be sent to compliance@elementoffices.nl.
4. With whom do we share your data?
We do not sell your data. We only share it where necessary, with these categories of recipients:
- IT and hosting providers, including the suppliers of our CRM system, our email and document environment and the hosting of the website in the Netherlands;
- the provider of our booking and portal software (member portal, tenant portal and tenant app);
- our payment service provider and the supplier of our accounting system;
- the providers of our AI assistant Elle;
- providers of identity verification and screening for the Wwft (see section 3);
- the provider of our camera and access control system;
- an external debt collection agency, if a payment remains outstanding;
- our accountant and other professional advisers;
- the companies within the Element group involved in your agreement;
- authorities, where the law requires us to.
We conclude a data processing agreement with our processors. Would you like to know exactly which parties these are? Request the overview via legal@elementoffices.nl.
For statistics and advertising we work, only after your consent via the cookie banner, with Google (Tag Manager, Analytics and Ads), Meta and LinkedIn. We record your consent with Cookiebot (Usercentrics). See the Cookie Statement.
5. Elle, our AI assistant
On the website and by phone you can talk to Elle. Elle is an AI assistant, not a person, and says so at the start of every conversation (art. 50(1) EU AI Act). Elle answers questions about our locations and services and can arrange a viewing or a call-back for you. If you ask for information by email or to be contacted, Elle creates a task for a colleague, who will get in touch with you.
- Elle does not make decisions about you. A quote, contract or assessment is always handled by a member of staff.
- Prefer to speak to a person? Tell Elle, call during office hours or email info@elementoffices.nl.
- Do not share sensitive data in the conversation, such as your citizen service number, passwords or medical information.
- Your conversations are not used to train other parties’ AI models.
- We keep chats and phone recordings with Elle for 30 days.
6. Transfers outside the EEA
Some service providers are based outside the European Economic Area or store data there. This only happens with appropriate safeguards, such as the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses. You can request a copy of the safeguards via legal@elementoffices.nl.
7. Cookies
Our website uses cookies. We only place analytical and marketing cookies with your consent. You can always change your choice via “Cookie settings” at the bottom of every page. More information is in our Cookie Statement.
8. Security
We take appropriate technical and organisational measures to protect your data, such as encrypted connections, encrypted passwords, access management with two-factor authentication and role-based access. Only staff who need your data for their work can access it. No one can fully guarantee the security of data sent over the internet.
9. Your rights
You have the right to:
- access your data;
- have incorrect data corrected or completed;
- have your data deleted, insofar as we are not legally required to keep it;
- have the processing restricted;
- object to processing based on legitimate interest and to direct marketing;
- receive your data in a common format (data portability);
- withdraw consent at any time.
Send your request to legal@elementoffices.nl. We respond within four weeks. To make sure the request comes from you, we may ask you to verify your identity. Never just send a copy of your passport; we will tell you what is needed.
You can always unsubscribe from our newsletter and app messages via the unsubscribe link in every email or via the settings in the app.
10. Complaints
Not satisfied with how we handle your data? Let us know via legal@elementoffices.nl. You can also file a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).
11. Changes
We update this privacy statement when our services or the law change. The date at the top shows when it was last changed. The current version is always available on our website.