Privacy Policy: Cross-border Planning & Advisory

Last Updated: September 1st, 2026 

1. Introduction

Cross-border Planning & advisory (hereinafter "we," "us," or "our") is committed to protecting your privacy and handling your personal data with the highest level of confidentiality. This Privacy Policy explains how we collect, use, and safeguard your information in compliance with the EU General Data Protection Regulation (GDPR) and the Dutch Data Protection Act (Uitvoeringswet Algemene verordening gegevensbescherming - AVG).

Company Details:

Legal Name: Cross-border Planning & Advisory

Address: Memorielaan 3, 6226DB, Maastricht, NL

KvK Number: 42044056

BTW Number: NL005453023B16

2. Data We Collect

We collect personal and financial information necessary to provide our advisory services, limited to what is strictly necessary for the advisory services,  including:

• Contact Information: Name, email address, and phone number.

• Relocation Details: Planned or actual date of relocation and status of the 30% Ruling.

• Financial Information: Overview of assets (real estate, stocks, pensions, RSUs, crypto, and business ownership).

• Professional Context: Information about your current accounting or legal support.

3. Purpose of Data Processing

We process your data for the following purposes:

• To prepare for and conduct strategic financial planning sessions.

• To communicate with you regarding your inquiries and bookings.

• To provide operational "soft landing" guidance.

• To use AI-assisted tools (including Anthropic's Claude) to review, analyse, and summarise the financial and tax documents you provide, in preparation for and during advisory sessions.

3.1 Legal Basis for Processing

We process your personal data based on:

• Contractual necessity (Art. 6(1)(b) GDPR) - to provide advisory services

• Legitimate interests (Art. 6(1)(f) GDPR) - limited to scheduling, communication, and efficienct delivery of services. 

• Legal obligations (Art. 6(1)(c) GDPR) - Dutch tax/accounting record-keeping

• Consent (Art. 6(1)(a) GDPR) - where explicitly obtained (e.g., marketing)

4. Data Storage and Third-Party Service Providers

To provide a seamless and secure experience, we utilize professional third-party service providers. By using our services, your data may be processed through the following processors as part of the service delivery :

4.1 Third-Party Processors

• Tally.so (form processor): Data Processing Agreement in place, EU servers.

• Google Workspace (email/docs): EEA Standard Contractual Clauses, EU/EEA storage.

• Calendly/TidyCal: EEA Data Processing Addendum, EU servers when available.

• Fathom AI (session recording & transcription): Standard Contractual Clauses (Art. 46 GDPR); data stored on AWS servers in the United States and Canada. Fathom is SOC2 Type II certified and GDPR compliant. Fathom's AI sub-processors (including Anthropic, OpenAI, and Google) are not permitted to use recordings to train their models; however, Fathom may use de-identified recording data to improve its own proprietary AI models, an option we have not opted out of. A visible bot joins the session, ensuring transparency to all participants.

• Anthropic (Claude) - AI-assisted document review and analysis: Used under Anthropic's Consumer Terms of Service; no Data Processing Agreement is in place at this service tier. Model training is switched off in our account settings, and data submitted is not used to train Anthropic's models. Data is processed on Anthropic's US servers under the Standard Contractual Clauses referenced in Anthropic's Privacy Policy. Unlike the processors listed above, this processing is not currently covered by a signed Data Processing Agreement.

All processors are contractually bound by GDPR Article 28 agreements, with the exception of Anthropic (Claude) as noted above. We do not sell, rent, or share your personal data with third parties for marketing purposes.

4.2 International Data Transfers

Google Workspace data may be processed outside EEA under EU Standard Contractual Clauses (Art. 46 GDPR). Fathom AI data (session recordings and transcripts) is stored on AWS servers in the United States and Canada, transferred under Standard Contractual Clauses (Art. 46 GDPR). Fathom does not transfer data to other third-country recipients.  Anthropic (Claude) processes data on servers in the United States under the Standard Contractual Clauses referenced in Anthropic's Privacy Policy; as noted in Section 4.1, this is not covered by a Data Processing Agreement at our current service tier.

4.3 Session Recording - Consent & Rights 

Where the Consultant uses Fathom AI to record and/or transcribe a session, the following applies:

• Prior consent: The client will be informed that the session may be recorded at or before the point of booking (via the Tally intake form). Recording will only proceed with the client’s explicit consent. The client may withdraw consent at any time before the session begins by notifying the Consultant in writing. 

• Purpose & use: Recordings and transcripts are used solely for the Consultant’s internal reference (note-taking, session summaries, quality of service). They are not shared with third parties, sold, or used to train AI models.

• Retention: Recordings and transcripts are retained for the duration of the Consultant's active Fathom account. You may request deletion of your specific recording at any time by contacting the Consultant, who will action the request within 30 days.

• Your rights: You may at any time request access to, correction of, or deletion of your recording or transcript by contacting the Consultant. Requests will be handled within 30 days in accordance with GDPR Article 17.  

4.4 AI-Assisted Document Review (Claude) - Use & Rights 

• Purpose & use: Documents you provide (e.g. tax returns, pension or investment statements, bank/brokerage statements) may be reviewed and analysed with the assistance of Anthropic's Claude to prepare for and support your advisory session. Outputs are for the Consultant's internal use only and are not shared with third parties.

• No model training: Model-improvement/training is switched off on the account used; your data is not used to train Claude.

• No DPA at this tier: This processing is not currently covered by a signed Data Processing Agreement, unlike our other processors.

• Retention: Uploaded documents and conversation history remain in our Claude account until deleted; once deleted, Anthropic removes them from its back-end within 30 days.

• Your rights: You may request that we not use AI-assisted review for your documents, or request deletion of a specific upload, by contacting the Consultant. Requests are actioned within 30 days.

5. Data Retention

• Intake/contact data: deleted 6 months after last contact unless engagement starts

• Engagement data: 7 years from engagement end (Dutch tax retention requirement)

You may request earlier deletion subject to legal retention periods.

6. Your Rights under GDPR

• Right of Access: You can request a copy of the data we hold about you.

• Right to Rectification: You can request that we correct inaccurate information.

• Right to Erasure ("Right to be Forgotten"): You can request the deletion of your data, subject to legal retention requirements.

• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.

• Right to data portability: You can request to receive your personal data in a structured, commonly used format and have it transferred to another service provider where technically feasible.

• Right to Restrict Processing: You can request that we temporarily limit the use of your data, for example while a correction request is being reviewed.

• Right to Object: You can object to the processing of your personal data where it is based on legitimate interests, unless we have compelling overriding grounds to continue processing. 

7. Security Measures

We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, or alteration. This includes using encrypted platforms and secure access controls and secure storage environments.

8. Contact & Complaints

• GDPR rights / complaints: SternCPA@gmail.com

• Dutch DPA: www.autoriteitpersoonsgegevens.nl