Privacy policy

1. Data controller

PrediqtSafe B.V. (in formation) is the data controller within the meaning of Article 4(7) GDPR for data collected via prediqtsafe.nl.

Contact for privacy matters: [email protected]. This address is currently handled directly by the founders — no formally appointed Data Protection Officer (DPO) is required yet given our current scale.

2. What data we collect

Only data you submit yourself through one of the public forms, plus limited technical metadata needed to process the form securely.

DataSource

Name

You — required field

Business email

You — required field

Company name

You — required field

Phone number (optional)

You

Role, sector, company size

You — dropdown selection

Free-text message

You — optional

Language indicator (nl/en)

Derived from the URL

Hashed IP address (SHA-256 + salt)

Cloudflare cf-connecting-ip — hashed immediately, no raw storage

User-agent (browser string)

Automatic — for spam analysis

Submission timestamp

Automatic

We set no analytics cookies, no tracking pixels, and no Facebook/Google pixel. The only cookie potentially set is from Cloudflare Turnstile, solely to verify you are not a bot (strictly necessary).

3. Why we process this data

For every field above the basis is either your explicit consent (Article 6(1)(a) GDPR — ticked before you submit), or our legitimate interest in pre-contract contact processing (Article 6(1)(b) in conjunction with 6(1)(f) GDPR).

Concrete purposes: to call or email you back personally within two business days; to evaluate your request for the design-partner program; to send a confirmation to your inbox; to protect the form from spam and abuse.

We do not use your data for automated decision-making or profiling within the meaning of Article 22 GDPR.

4. How long we keep data

Form submissions are kept for 2 years by default, counted from the last point of contact. This term is calibrated to the typical duration of an enterprise HSSEQ-software procurement cycle.

If you withdraw consent earlier, we remove your submission within 30 days. The deletion audit log itself remains (hash-only, no personal data) for legal demonstrability.

After 2 years, unused submissions are automatically deleted by a scheduled retention job. The job itself is under construction — until it's live, rows are cleaned up manually when they pass the threshold.

5. Sub-processors and recipients

We do not share your data with third parties for marketing, advertising, or analytics purposes. The only third parties with technical access to your data are our sub-processors — vendors we use to operate the service.

Sub-processorRole · location

Cloudflare, Inc.

Form-worker runtime, rate-limit store (KV), audit database (D1 — pinned to EU data centres). DPA with Standard Contractual Clauses in place.

Mailjet SAS (Sinch group)

Transactional email — lead notification to [email protected] and your confirmation email. EU-hosted in Paris (France). No transfer to non-EU countries.

If we add or change a sub-processor in the future, we update this list at least 30 days in advance so you can object or withdraw your consent.

6. Where your data is stored

Your form submission and all derived metadata (audit row, hashed IP, rate-limit counter) are processed exclusively on infrastructure within the European Union: Cloudflare D1 is explicitly pinned to EU data centres, Cloudflare KV runs on EU edge nodes, and Mailjet hosts in Paris.

No data replication to the United States or other non-EU jurisdictions takes place. We therefore do not rely on the EU-US Data Privacy Framework or Standard Contractual Clauses for transatlantic transfer — that transfer simply does not occur.

7. Your rights

Under the GDPR you have the following rights. To exercise any of these, email [email protected], including your request reference (from the confirmation email) if possible. We respond within 30 days, usually much sooner.

1. Art. 15AccessA copy of all data we hold about you, delivered machine-readable.
2. Art. 16RectificationCorrection of inaccurate or incomplete data — for example a misentered job title.
3. Art. 17ErasureFull deletion of your submission. We confirm the deletion by email.
4. Art. 18RestrictionPausing processing, for example while you dispute the accuracy of data.
5. Art. 20PortabilityAn export in a structured format (JSON or CSV) to use elsewhere.
6. Art. 21ObjectObject to processing based on legitimate interest. We will stop unless there are compelling grounds to continue.
7. Art. 7(3)Withdraw consentWithdraw your consent at any time. This does not affect the lawfulness of earlier processing.

You can also lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl), or with the supervisory authority in your own EU member state. We appreciate it if you contact us first so we can address any concern directly.

8. Security

Transport is encrypted via TLS 1.3 from your browser to our processing layer. The audit database is encrypted at-rest by Cloudflare. IP addresses are salted-hashed with SHA-256 before storage — a raw IP never leaves our processing.

Access to the audit database is limited to the founders and runs via Cloudflare's SSO-based dashboard with MFA. Every access is logged on Cloudflare's side.

Should a data breach occur that involves your data, we notify the Dutch DPA within 72 hours, and inform you directly if the breach poses a high risk to your rights and freedoms (GDPR Articles 33-34).

9. Changes to this policy

This policy may change when our service or underlying infrastructure changes. The date of the last revision is shown at the top of this page. Material changes (new sub-processor, longer retention, new processing purposes) are announced at least 30 days in advance via email to active contacts.

10. Contact

Questions or requests about this policy or your rights: [email protected]. For anything else, you can use this address too — at our current scale there is no separate DPO mailbox.