Privacy Notice

Who is the Controller for the processing of your Personal Data?

The entity responsible for your Personal Data is Custodea B.V. (Utrecht, the Netherlands) which operates the Custodea Platform. Custodea B.V. will be the responsible “Controller” for the Personal Data we collect. In this Privacy Notice, "Custodea", "we", "us" and "our" refers to Custodea B.V. In addition, when Custodea provides its services, it will act as a "Processor" for your company data it processes on your behalf.

Why and under which lawful basis do we process your Personal Data?

We process your Personal Data when you visit our Website and make use of our services for the following purposes and based on one of the following lawful bases:

We may use your Personal Data, for our other legitimate commercial interests such as to operate and expand our business activities; to analyze, develop and improve or modify our services; to protect and defend our (and others’) rights, property or safety; to prevent abuse and fraud related to online sale of our products and to monitor the compliance with our internal rules for the use of our Website(s) and Platform(s); to generate aggregated statistics about the users of our services; to facilitate our business operations; to operate company policies and procedures; to enable us to manage corporate transactions, such as any merger, sale, reorganization, transfer of Custodea’s assets or businesses, acquisition, bankruptcy, or similar event; or for other legitimate business purposes permitted by applicable law.

We may also use anonymized data for benchmarking, AI-supported analysis and product improvement purposes.

To comply with our legal obligations: Any Personal Data we collect may be used to comply with a legal obligation to which we are subject, such as supervisory bodies, fiscal authorities or investigation bodies.

When and how we share your information with others

We may share your information with other third parties (such as Processors engaged by us) for the purposes described below. We will only disclose your Personal Data to those with a legitimate business need and after we have taken steps to ensure that your Personal Data is processed in a manner consistent with this Privacy Notice.

These include:

• Our Service Providers: Your Personal Data may be disclosed to our service providers who perform services on our behalf. They act as a hosting and infrastructure provider for your data. These service providers process Personal Data on our instructions and are subject to appropriate contractual safeguards, including data processing agreements, to ensure the protection and confidentiality of your Personal Data
• Other third parties when necessary pursuant to regulatory obligations: We may disclose your Personal Data with third parties to comply with court orders or other legal obligations (such as with other organizations for fraud prevention and detection).

We do not sell Personal Data to anyone and only share it with third parties when this is necessary.

Transfers outside the European Economic Area

All Personal Data is primarily stored and processed within data centers located in the EEA. We may transfer Personal Data to service providers or subprocessors located outside the EEA where this is necessary for the provision of our services. Where we transfer Personal Data to Switzerland, we rely on the European Commission’s adequacy decision for Switzerland pursuant to article 45 GDPR, which recognises that Switzerland provides an adequate level of protection for Personal Data.

Any transfers to the United Kingdom or other countries outside the EEA and Switzerland will only take place on an exceptional and temporary basis, where necessary, and will be subject to appropriate safeguards in accordance with applicable data protection laws, such as the European Commission’s Standard Contractual Clauses, where required.

Data subject rights

Subject to applicable laws, you are entitled to a number of rights over the processing of your Personal Data. You may exercise these rights at any point by contacting us here privacy@custodea.eu. We will consider all such requests and, in accordance with the applicable laws, will provide our response within a reasonable period, or within the period prescribed by law. We may request you to provide us with information necessary to confirm your identity before responding to any request you make.

You have the following rights:

• The right to access: subject to exceptions, you have the right to request access to the Personal Data we hold about you;
• The right to rectification: if the Personal Data we hold is inaccurate you are entitled to have it updated or rectified;
• The right to deletion: subject to exceptions, you can ask us to delete your Personal Data. Please note that if you ask us not to contact you by email at a certain email address, we will retain a copy of that email address on our “master do not send” list in order to comply with your no-contact request;
• The right to object: under certain circumstances, you have the right to ask us to stop processing your Personal Data. For example, you may object to processing for direct marketing activities (for example, by clicking on the unsubscribe link in our emails) and where we are relying on ours or a third party’s legitimate interests to process the Personal Data (unless we can demonstrate compelling legitimate grounds to continue processing your Personal Data);
• The right to withdraw consent: where we rely on your consent to process Personal Data, you have the right to withdraw consent at any time;
• The right to restriction of processing: under certain circumstances you have the right to restrict the processing of your Personal Data such as if you believe (i) the Personal Data we have about you is accurate; (ii) the Personal Data is not being processed lawfully, but instead of deleting the Personal Data, you would prefer us to restrict processing instead; or (iii) we no longer need your Personal Data for the purposes we collected it, but you require the data in order to establish, exercise or defend legal claims;
• The right to data portability: under certain circumstances you have the right to obtain Personal Data you've provided us with (in a structured, commonly used and machine-readable format) and to reuse it elsewhere or to ask us to transfer this to a third party of your choice; and
• The right to lodge a complaint with a supervisory authority: you also have the right to file a complaint to the data protection authority in the country where you usually live or where the alleged infringement of applicable data protection laws has taken place. In the Netherlands, the designated supervisory authority is the Autoriteit Persoonsgegevens. More information can be found at: https://autoriteitpersoonsgegevens.nl/

We will consider and act upon any request based on the abovementioned rights in accordance the applicable data protection rules. In response to a request, we may ask you to verify your identity by, for instance, providing additional information. Whenever reasonably possible and required under applicable laws, we will strive to respond to your requests within one month. If we do not comply with your request within such time frame, we will explain why.

How do we protect Personal Data?

We have implemented adequate technical and organizational measures to safeguard the Personal Data we process. We update and test our security technology on an ongoing basis. In addition, we restrict access to your Personal Data to employees on a need-to-know basis and train all staff about the importance of confidentiality and maintaining the privacy and security of your information. Nevertheless, if you suspect unauthorized use or access of your accounts, you must inform us immediately by e-mail at privacy@custodea.eu.

How long do we keep and store your Personal Data?

We will not retain your Personal Data longer than necessary in relation to the purposes for which the data are processed. In principle, we will retain your data for a maximum of two years after the end of your customer relationship with us, unless we are required by statutory obligations to retain your Personal Data for a longer period of time. We may retain your Personal Data for a longer period where necessary in connection with complaints, claims or disputes, including where this is required to establish, exercise or defend legal claims or to protect our rights and interests and/or those of third parties.

Changes to this Privacy Notice

We may change this Privacy Notice from time to time by posting the updated version of the Privacy Notice on our Website. We will give you reasonable notice on our Website of any material change. The “effective date” at the top of this Privacy Notice indicates when such changes will take effect. We encourage you to visit frequently to stay informed about how we use your Personal Data.

Questions, concerns or complaints

To ask questions or comment about our Privacy Notice and our privacy practices, you can contact our Privacy Officer at privacy@custodea.eu.

Cookie Notice

Please refer to our Cookie Notice available at custodea.eu/cookies for more information on our use of cookies on this Website or Platform.