Legal
Privacy Policy
Last updated: October 5, 2026
1. Data controller
PRIVAN is a trade name of NUMEO B.V., located at Nieuwe Prinsenkade 4, 4811VC Breda, the Netherlands. Chamber of Commerce number: 84039868.
NUMEO B.V. is responsible for the processing of personal data as described in this privacy policy. Have questions? Contact us via our contact form.
2. What data we collect
Data you provide yourself
- Contact form: name, email address, subject, and message.
- Risk analysis: the website URL you enter to be analysed. When you start it, we also note the page you arrived on and the website that referred you (the referrer).
- Intro call: name and email address, and on the request form also your organisation, website and an optional message. If you request the intro call from a risk analysis, we link your request to the analysed website and its outcome. With every request we also note the page you arrived on and the website that referred you (the referrer).
- Outcome by email: your email address, if you ask during the risk analysis to have the outcome emailed to you.
- Newsletter: your email address, if you signed up for the newsletter.
Data collected automatically
- Visitor statistics: we use Simple Analytics for anonymized website statistics. Simple Analytics does not collect personal data, does not place cookies, and does not store IP addresses.
- Server logs: our hosting provider and our CDN record standard technical log data (such as IP address and request timestamp) for security and availability. These are automatically deleted.
- Abuse protection: when you submit a form or start a risk analysis, the server counts how many requests arrive per IP address within 24 hours. That count is kept only in the server's working memory and disappears about a day after your last request.
3. Purposes and legal basis
We process personal data exclusively for the following purposes:
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Responding to your inquiry via the contact form | Name, email, message | Legitimate interest |
| Performing the risk analysis you request, and keeping track of which page requests come in through | Website URL, landing page and referrer | Legitimate interest (you request the risk analysis yourself) |
| Planning and preparing the intro call you request, and our contact about it | Name, email, organisation, website, message, the linked risk analysis, landing page and referrer | Legitimate interest |
| Emailing the outcome of your risk analysis, if you ask for it | Email, the linked risk analysis | Legitimate interest (you ask for the email yourself) |
| Sending the newsletter | Consent (you sign up yourself and can unsubscribe at any time) | |
| Improving and securing the website | Server logs, request count per IP address | Legitimate interest |
4. Retention periods
- Contact form: up to 12 months after the last contact.
- Risk analysis: the results up to 90 days after the analysis. The internal notification that an analysis was started, with the website, landing page and referrer, is kept for up to 12 months.
- Intro call requests: up to 12 months after the last contact.
- Outcome by email: your email address is only held in the server's working memory until the email has been sent, usually within a few minutes, and is then erased. We don't store it in a database or add it to a mailing list. Brevo keeps a sending log (address, subject and time), which is deleted after 30 days.
- Newsletter: until you unsubscribe.
- Server logs: in accordance with our hosting provider's retention policy.
After these periods expire, the data is deleted.
5. Processors and third parties
We only share your data with parties that are necessary for our services. We have appropriate agreements in place with all processors or use their standard processing terms.
| Party | Purpose | Location |
|---|---|---|
| Scalingo | Hosting of website and application | EU (ISO 27001) |
| Bunny.net (BunnyWay d.o.o.) | Fast and secure delivery of the website and the application (CDN) | EU (Slovenia) |
| Brevo | Sending email (contact form, intro call requests, the outcome of a risk analysis if you ask for it, internal notifications and newsletter) | EU (France) |
| Soverin | Receiving and storing email (contact form, intro call requests and internal notifications) | EU (Netherlands) |
| Simple Analytics | Anonymized visitor statistics | EU |
Bunny.net is a European company based in Slovenia and falls under the GDPR. You get our pages from a Bunny server near you, so your browser talks to Bunny and not directly to our own server. That shields our server from direct traffic, such as attempts to overload or abuse it. Bunny sees your IP address in the process, like any server that delivers a web page, and uses it only to deliver that page and to secure traffic.
6. Security
We take appropriate technical and organizational measures to protect your data:
- Encrypted connections (TLS/SSL) on all pages
- Hosting with an ISO 27001-certified provider within the EU
- A European CDN (Bunny.net) between your browser and our server, so our server is not directly reachable by visitor traffic
- Access control and the principle of least privilege
- Regular security updates
7. Your rights
Under the GDPR, you have the following rights:
- Access: request which data we process about you
- Rectification: have incorrect data corrected
- Erasure: have your data deleted
- Restriction: temporarily halt processing
- Data portability: request your data in a structured format
- Objection: object to processing based on legitimate interest
Submit your request via our contact form. We will respond within 30 days.
8. Cookies
PRIVAN only uses functional cookies: to remember your language choice, to keep you logged in to the application and to secure the application. We do not place any tracking, advertising, or analytics cookies. For visitor statistics, we use Simple Analytics, which works entirely without cookies.
A full overview of the cookies we use, including name, purpose, and duration, can be found in our Cookie Policy.
9. Changes
We may update this privacy policy, for example when adding new features or when legislation changes. The most current version is always available on this page. We will notify you via the website of any material changes.
10. Complaint or question
Have a question or complaint about how we handle your data? Please contact us via our contact form.
If we cannot resolve the matter together, you have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). More information can be found at autoriteitpersoonsgegevens.nl.