Why you got an email from us

You are probably reading this because you received an email from Dormetrics that you did not ask for. This page explains where we got your address, what we do with it, and how to make it stop. It is the information we owe you under Article 14 GDPR, which applies whenever personal data is collected from somewhere other than the person it belongs to.

This notice covers only our business-to-business outreach. If you are a Dormetrics user, the notice that applies to you is the privacy policy.

Who is responsible

Dormetrics is a trade name of DoArt, a Dutch sole proprietorship (eenmanszaak) registered with the KVK under 58598464 and based in Helmond, Netherlands. DoArt is the data controller for everything described here. There is no data protection officer — we are not required to appoint one and have not done so. You can reach a human at hi@dormetrics.com.

Where we got your details

From your organisation's own public website — a contact page, a staff or department page, or a published directory entry on your own domain. Every contact we hold was copied from a page we actually fetched, and we record the URL it came from.

We want to be equally clear about what we did not do:

• We did not buy a list, and we do not use contact-database or lead-scraping services.
• We did not take anything from LinkedIn or any other personal profile.
• We did not guess an address. We never construct firstname.lastname@ or info@ from a pattern — if your organisation did not publish an address, we do not have one.
• We prefer a general inbox over a named person wherever your site publishes one.

What we hold

• About the organisation: its name, website, sector, the reason we thought it was relevant, short public quotes from its own pages with the URL they came from, and our own notes and score. The score is about the organisation, not about any person.
• Contact routes:the published email address, and the role it was published under (for example “international office”).
• Messages: what we sent you, and — if you write back — your reply, in full, as you wrote it.
• Delivery events: whether a message was delivered, bounced, was replied to, or was unsubscribed.

We do not measure you. There is no tracking pixel, no click tracking and no link rewriting on our mail, so we do not know whether you opened a message or read it. That is a setting we hold off deliberately, and our system refuses to send if it detects that it has been switched on.

Why we are allowed to do this

Our legal basis is legitimate interests, Article 6(1)(f) GDPR. The interest is reaching the organisations best placed to put a free rental-scam check in front of international students and expats before they pay a deposit to someone who does not own the property. We have written down the balancing test behind that and we will provide it on request.

We should say plainly that this is a commercial interest with a public-benefit side, not the other way round: we are contacting you to propose something we also sell. Unsolicited email to published business addresses is permitted in the Netherlands under Article 11.7 of the Telecommunicatiewet, provided every message identifies the sender and offers a working way to object. Every message we send does both.

The right you should use first: object

You have an absolute right to object to direct marketing (Article 21(2) GDPR). There is no balancing test and nothing for us to weigh — if you object, we must stop, and we do.

Just reply to the email and say so.Any wording works (“stop”, “niet meer mailen”, “remove me”) and you do not have to give a reason. You can also email hi@dormetrics.com.

Your address then goes on a permanent suppression list, which is checked again at the moment of sending rather than only when a batch is prepared. We keep that suppression record indefinitely, on purpose. It has to outlive the data it suppresses — if we deleted the record of your objection along with everything else, nothing would stop us emailing you again the next time your organisation appeared in a list. Keeping your address on a do-not-contact list is the only way to honour the objection you made.

How long we keep the rest

Everything except that suppression record is on a clock:

• Your contact details — removed 24months after the last time we contacted you, or after we added you if we never did. The organisation's non-personal details (name, website, sector) may be kept longer.
• Your reply, if you sent one — the text is deleted after 12 months. It goes sooner than our own messages because it is your words, not ours, and we did not choose what is in it.
• The messages we sent you — the text is deleted after 24 months. We keep the bare fact that we contacted you and what came of it, because that record is what stops us contacting you again.
• Delivery and bounce events — deleted after 12 months.
• An objection — kept indefinitely, for the reason above.

Who else sees it

We use service providers, each under a data processing agreement, and none of them may use your data for their own purposes:

• Instantly.ai (contracting entity Foo Monk LLC, United States) — the platform that actually sends the mail and returns delivery and reply events. It receives the contact record and the message text.
• Google (Workspace) — the mailbox the mail is sent from and replies arrive in.
• Anthropic (United States) — its Claude models draft the message from the organisation record. If you reply and we use it to help draft an answer, your reply text is sent to Anthropic too. Anthropic does not train on it.
• Supabase — the database, hosted in the EU (Frankfurt).
• Vercel and Hetzner Online GmbH (Germany) — hosting for the software that prepares the messages.

We do not sell your data, share it with other advertisers, or add it to any product. Instantly.ai, Anthropic and Vercel are US companies, so data reaches the United States; those transfers run on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework. The current provider list is maintained internally and available on request.

Automated decisions

We use AI to write, not to decide. Claude drafts the message and sorts replies into rough buckets so a human reads the right ones first. Every message is approved by a person before it goes out, and nothing here produces a legal or similarly significant effect on you within the meaning of Article 22 GDPR.

Your other rights

You can ask for a copy of what we hold about you (Article 15), have it corrected (16), have it deleted (17), have its use restricted (18), and object (21). Email hi@dormetrics.com and we will answer within one month. There is no self-service portal for this — the list is small and a person handles each request.

One honest caveat on erasure: if you have objected, we will delete everything else but keep your email address on the do-not-contact list, because deleting that is what would let us contact you again. If you want that record gone too, say so explicitly and we will remove it — and we will no longer be able to stop a future list from including you.

If you are not satisfied, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) — autoriteitpersoonsgegevens.nl.