Privacy explained
Your customers and the GDPR
This is an explanation in broad lines, not legal advice. Not all the sources below have been read through yet. When in doubt, ask the Data Protection Authority or your adviser.
What personal data is
Anything that lets you recognise someone: a name, a phone number, an address, but also a note like ‘prefers no e-mail’. A card about a business often holds it too, because a contact person is on it.
The GDPR (the European privacy law) and the Belgian privacy law of 2018 apply to a small business with a card index as well.
You are the controller
You decide which customers you keep and why. That makes you the controller. Kaartenbak is a tool on your device: nealvdv never sees your cards.
It also means: when a customer asks what you keep about them, you are the one who answers.
Why you may keep a card
You need a reason to keep data. For a customer you work with or who asked for a quote, that is usually the contract or the customer’s own request. For other purposes, such as advertising, stricter rules apply.
So write down what you need to help the customer, and no more.
Only what you need
A card needs a name, a way to reach someone and what you agreed. Sensitive matters such as health, religion or political views do not belong on it.
Write notes in a way you would dare show the customer.
Your customer’s rights
A customer may ask what data you hold about them, and have it corrected or erased. In Kaartenbak you show the card, change it or remove it with one click.
Answer within a reasonable time. The exact deadlines are in the GDPR and at the Data Protection Authority.
How long to keep a card
No longer than needed. If someone has not been a customer for years and you no longer need the data for anything, remove the card. Invoices have their own retention rules: they belong in your bookkeeping, not in your card index.
Now and then, sort by ‘Recently changed’ to tidy up old cards.
E-mail and advertising
Writing to a customer about their own request or quote is not the same as sending advertising. For advertising by e-mail you generally need consent beforehand, with an exception for your own customers and similar products, and always a way to unsubscribe.
Kaartenbak sends no e-mail itself and makes no mailing lists.
What Kaartenbak does
Your cards are in your own browser’s storage, on this device. There is no account and no server that receives them. An export or backup is an ordinary file: keep it safe and do not pass it around.
Do not leave your device open unattended, and wipe what you no longer need with Forget everything.
Further reading
Kaartenbak helps you keep track of your customers and what you agreed. For the rules themselves we refer to the official sources below; what has not been read through yet says so.
- OfficialVerordening (EU) 2016/679 (algemene verordening gegevensbescherming, AVG)
- OfficialWet van 30 juli 2018 betreffende de bescherming van natuurlijke personen met betrekking tot de verwerking van persoonsgegevens
- OfficialKmo's en de AVG
- OfficialUw rechten (inzage, verbetering, wissing)
- OfficialDirect marketing
- OfficialOngevraagde reclame per e-mail (spam)
Explanation last read through on 21 October 2026
Kaartenbak explains in broad lines and gives no legal advice. What applies to your business depends on what you do with the data: when in doubt, ask the Data Protection Authority or your adviser.