Privacy statement

This is a translation of the Dutch original. In case of any discrepancy, the Dutch version prevails.

1. Who we are

Procesbrein is responsible for the processing of personal data as described in this privacy statement.

• Company name: Procesbrein
• Dutch Chamber of Commerce (KvK) number: 42091045
• E-mail (privacy): privacy@procesbrein.nl
• Website: https://procesbrein.nl

We attach great importance to careful handling of personal data and comply with the General Data Protection Regulation (GDPR / Algemene Verordening Gegevensbescherming, AVG) and the Dutch GDPR Implementation Act (Uitvoeringswet AVG).

2. Two roles: controller and processor

Procesbrein processes personal data in two different capacities:

• As controller (verwerkingsverantwoordelijke) — for data that we collect ourselves via our website, the contact and request process and our own business operations. This privacy statement describes those processing activities.
• As processor (verwerker)— when, on the instructions of a client, we analyse that client's systems during a scan or build project. The client is then the controller; we process that data solely in accordance with the arrangements in a data processing agreement (verwerkersovereenkomst).

3. Which data we process and why

We do not collect more data than necessary and do not use it for purposes other than those stated above.

4. Retention periods

• Contact and request data of prospects who do not become clients: a maximum of 12 months after the last contact.
• Intake and scan data of clients: for the duration of the assignment and a maximum of 24 months thereafter, unless longer retention is required by law.
• Administration and invoices: 7 years (statutory tax retention obligation).
• Analytics data: see the cookie policy (section 9).

5. Processors and third parties

For our services we engage service providers that process data on our behalf as processors. We conclude a data processing agreement (verwerkersovereenkomst) with each of them. The main ones:

We do not sell personal data and do not share it with third parties for commercial purposes.

6. Transfers outside the EEA

Some of the parties named above are established in the United States. Transfers outside the European Economic Area take place solely with appropriate safeguards, such as the European Commission's standard contractual clauses and, where applicable, the EU-US Data Privacy Framework. For the AI processing we select a model provider per assignment; that provider does not use input and output for model training and retains them for a short period at most, for abuse detection. We inform you in advance which provider we use for your assignment.

7. Security

We take appropriate technical and organisational measures to protect personal data, including encryption of access tokens, encrypted connections (TLS), access restriction at database level and the principle of data minimisation. Access to client systems is exclusively read-only and only after the client's explicit consent.

8. Your rights

You have the right to:

• access, rectify or erase your data;
• have the processing restricted or object to it;
• receive your data in a commonly used format (data portability);
• withdraw consent previously given.

Send your request to privacy@procesbrein.nl. We respond within the statutory period. If you disagree with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

9. Cookies

Our website uses the following cookies:

On your first visit we display a notice that we work with cookies. A full description can be found in our cookie policy. You can manage or delete cookies via your browser settings.

10. Advertising and conversion measurement

We advertise via Google Ads. To measure whether our advertisements work, we record when a visitor who came in via an advertisement submits a form or views the site attentively (conversion measurement). In doing so, data that you enter yourself, such as your e-mail address, may be shared with Google in hashed (rendered unreadable) form in order to improve the measurement ("enhanced conversions"). Google cannot trace this data back to the original input and uses it solely for conversion measurement. Legal basis: legitimate interest (6.1.f) for the measurement itself; section 9 applies to the associated cookies.

11. Changes

We may amend this privacy statement. The current version is always available at procesbrein.nl. In the event of substantial changes, we will inform you actively.