Privacy statement

Who we are

Kovicta B.V. is the controller for the processing described in this statement. We have not appointed a data protection officer. Questions about privacy are answered by the person responsible for it at Kovicta, at privacy@kovicta.com.

Name

Kovicta B.V.

Address

Nijverheidsweg 23E, 3641 RP Mijdrecht, the Netherlands

Chamber of Commerce (KvK)

42195911

VAT number

NL870132234B01

Email

info@kovicta.com

What we process, why, and for how long

For each purpose, the list below shows which data we use, the legal basis under the General Data Protection Regulation (GDPR), and how long we keep it. After that period we delete it.

Cookies

This website sets no cookies and stores nothing in your browser. We count visits with our own statistics, on our own server (see ‘Website statistics’ above). They need no cookies, share nothing with other parties and do not follow you to other websites. Statistics like these, with little impact on your privacy, need no consent under Dutch law (Article 11.7a of the Telecommunications Act). We use no advertising or social media pixels, and we load nothing from other parties: fonts, images and scripts come from our own server. That is why we do not ask for cookie consent. If this changes, we will update this statement and ask for consent where the law requires it.

Who receives your data

We do not sell your data and do not give it to others for their own purposes. We only share it when the law requires us to, for example with the Dutch Tax Administration, or with the accountant who prepares our annual accounts.

We use service providers that process data on our behalf. We have a data processing agreement with each of them, and they may only use your data for what we ask of them:

• Hosting of this website, its statistics and the stored form requests
• Email and calendar
• Accounting and invoicing
• The system in which we keep track of requests and client contacts

Where your data is stored

This website, its statistics, the form requests and the system in which we keep track of requests run on our server in Falkenstein, Germany. For other service providers, we choose storage in the European Economic Area (EEA) where we can. Some service providers we use, for example for email, belong to a company outside the EEA. Where data may leave the EEA as a result, or be accessed from outside it, this only happens with an appropriate safeguard under the GDPR: an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or the European Commission’s standard contractual clauses. You can ask us for a copy of the safeguard.

How we protect your data

We take appropriate technical and organisational measures: encrypted connections, access only for people who need the data for their work, and systems we keep up to date. How we secure client platforms is described on the security page. If a personal data breach does occur, we report it to the Dutch Data Protection Authority within 72 hours where the law requires it, and we inform you if it poses a high risk to you.

Data in client platforms

Inside the platforms we build and host for clients, we process data on behalf of that client: for example data about its employees, customers or suppliers, and, if the client wants one, the log of who opened which page. The client is the controller for that data and Kovicta the processor. We use it only as agreed in the data processing agreement with the client, never for our own purposes and never to train language models. We do count, per platform, the number of users and the tokens the assistants use, because the monthly fee depends on them. If the platform has an assistant, the questions people ask it and the data needed to answer them are processed by the provider of the language model, Anthropic, in the United States, under the European Commission’s standard contractual clauses.

If your data is in such a platform and you want to see, correct or delete it, contact the organisation that uses the platform. If your request reaches us, we forward it to that organisation as soon as possible.

Your rights

You have these rights:

• Access: an overview and a copy of the data we hold about you
• Correction of data that is wrong
• Deletion of your data
• Restriction of processing, for example while we assess an objection
• Portability: your data in a common file format, for yourself or for another party
• Objection to processing based on our legitimate interest
• Withdrawal of consent you gave, with effect for the future

Email your request to privacy@kovicta.com. It is free. We respond within one month. For a complex request that can be extended by two months, and we will tell you so within the first month. We may ask you to confirm who you are, so that we do not give your data to the wrong person.

If you disagree with how we handle your data, please tell us first. You always have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

What is required, and what we do not do

You are not obliged to give us any data. Without a name, email address and company, however, we cannot answer a request for a discovery call. We take no decisions about you based solely on automated processing, we build no profiles of visitors, and we send no newsletters or marketing emails.

Changes to this statement

When the way we process personal data changes, we update this statement. The date at the top shows when that last happened. If a change affects you directly, we let you know.