Privacy Policy

1. Data controller

PRIVAN is a trade name of NUMEO B.V., located at Nieuwe Prinsenkade 4, 4811VC Breda, the Netherlands. Chamber of Commerce number: 84039868.

NUMEO B.V. is responsible for the processing of personal data as described in this privacy policy. Have questions? Contact us via our contact form.

2. What data we collect

Data you provide yourself

• Contact form: name, email address, subject, and message.
• Risk analysis: the website URL you enter to be analysed. When you start it, we also note the page you arrived on and the website that referred you (the referrer).
• Intro call: name and email address, and on the request form also your organisation, website and an optional message. If you request the intro call from a risk analysis, we link your request to the analysed website and its outcome. With every request we also note the page you arrived on and the website that referred you (the referrer).
• Outcome by email: your email address, if you ask during the risk analysis to have the outcome emailed to you.
• Account: your business email address, your password (only as an irreversible hash), your organisation's details and the email addresses of colleagues you invite. We don't ask for your name.

Data collected automatically

• Visitor statistics: we use Simple Analytics for anonymized statistics on the website and the application. Simple Analytics does not collect personal data, does not place cookies, and does not store IP addresses.
• Use of your account: when you log in and when you make important changes to your account, we record a shortened IP address and the type of browser. That is how we secure your account and detect misuse.
• Server logs: our hosting provider and our CDN record standard technical log data (such as IP address and request timestamp) for security and availability. These are automatically deleted.
• Abuse protection: when you submit a form or start a risk analysis, the server counts how many requests arrive per IP address within 24 hours. That count is kept only in the server's working memory and disappears about a day after your last request.

Websites we review

For a risk analysis, website review or assurance, our platform looks at a website the way an anonymous visitor sees it. We don't process any data about that website's visitors. The report does include a screenshot of the homepage. If someone's name or photo is publicly shown there, it will also appear in the screenshot.

3. Purposes and legal basis

We process personal data exclusively for the following purposes:

We use AI for a number of supporting tasks in reviewing websites and reporting on them. Your account details never go to an AI model, and we don't have AI models trained on your data or on the websites we review. We don't make automated decisions about people (Article 22 GDPR).

4. Retention periods

• Contact form: up to 12 months after the last contact.
• Risk analysis: the results up to 30 days after the analysis. The internal notification that an analysis was started, with the website, landing page and referrer, is kept for up to 12 months.
• Intro call requests: up to 12 months after the last contact.
• Outcome by email: your email address is only held in the server's working memory until the email has been sent, usually within a few minutes, and is then erased. We don't store it in a database or add it to a mailing list. Brevo keeps a sending log (address, subject and time), which is deleted after 30 days.
• Account: until you delete your account. You can do that yourself in the application. We delete an invitation to a colleague no later than 30 days after it has expired. We keep invoices for 7 years, as Dutch tax law requires.
• Results of a website review or assurance, including the screenshot: for as long as your account exists.
• Security data for your account (shortened IP address and type of browser): up to 12 months.
• Messages the application sends you: we keep a copy for up to 90 days after sending.
• Server logs: in accordance with our hosting provider's retention policy.

After these periods expire, the data is deleted.

5. Processors and third parties

We only share your data with parties that are necessary for our services. We have appropriate agreements in place with all processors or use their standard processing terms.

Bunny.net is a European company based in Slovenia and falls under the GDPR. You get our pages from a Bunny server near you, so your browser talks to Bunny and not directly to our own server. That shields our server from direct traffic, such as attempts to overload or abuse it. Bunny sees your IP address in the process, like any server that delivers a web page, and uses it only to deliver that page and to secure traffic.

6. Security

We take appropriate technical and organizational measures to protect your data:

• Encrypted connections (TLS/SSL) on all pages
• Hosting with an ISO 27001-certified provider within the EU
• A European CDN (Bunny.net) between your browser and our server, so our server is not directly reachable by visitor traffic
• Access control and the principle of least privilege
• Regular security updates

7. Your rights

Under the GDPR, you have the following rights:

• Access: request which data we process about you
• Rectification: have incorrect data corrected
• Erasure: have your data deleted. You can also delete your account yourself in the application
• Restriction: temporarily halt processing
• Data portability: request your data in a structured format
• Objection: object to processing based on legitimate interest

Submit your request via our contact form. We will respond within 30 days.

8. Cookies

PRIVAN only uses functional cookies: to remember your language choice, to keep you logged in to the application and to secure the application. We do not place any tracking, advertising, or analytics cookies. For visitor statistics, we use Simple Analytics, which works entirely without cookies.

A full overview of the cookies we use, including name, purpose, and duration, can be found in our Cookie Policy.

9. Changes

We may update this privacy policy, for example when adding new features or when legislation changes. The most current version is always available on this page. We will notify you via the website of any material changes.

10. Complaint or question

Have a question or complaint about how we handle your data? Please contact us via our contact form.

If we cannot resolve the matter together, you have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). More information can be found at autoriteitpersoonsgegevens.nl.