Privacy Policy

1. Which data do we process and for what purpose?

wbsoaanvraag.ai (hereinafter "we" or "us") helps entrepreneurs generate WBSO subsidy applications using artificial intelligence. To deliver this service, we process some personal data that you provide via the application form, including:

We use this data solely for the following purposes: (a) preparing and delivering a draft WBSO application to you, and (b) improving our services (for example through anonymized analysis of common questions or to support our AI models). Data is not used for purposes other than those described here.

  • Identification and contact details: such as the company name, Chamber of Commerce number, contact person name, email address, and phone number. These details are needed to prepare the application in the right context and to contact you about your application.
  • Project information: descriptions you enter about technical innovations, bottlenecks, and other project details. This information is necessary for the AI to generate a relevant and substantively correct draft application document.
  • Other provided data: any additional information you send to us or enter as part of the WBSO application.

2. How do we process your data (including use of OpenAI)?

To generate the subsidy application, we use an AI engine, namely OpenAI GPT-4, via an external API. This means that the project information and relevant data you enter are temporarily sent to our processor OpenAI, which analyzes the textual content and drafts a concept application text. OpenAI processes your data solely on our behalf and according to our instructions, for the purpose of delivering the requested AI functionality. We have entered into a data processing agreement with OpenAI to safeguard your privacy. Among other things, this agreement stipulates that OpenAI may not use your data for its own purposes, such as training AI models, and that it takes appropriate security measures.

Data transfer outside the EU: OpenAI has an office in Ireland (OpenAI Ireland Ltd.) for services within the EEA. However, it is possible that during processing, data is transferred to OpenAI servers or affiliated entities in the United States. We ensure that such transfers comply with the GDPR. Standard Contractual Clauses or comparable safeguards are included in the processing agreement with OpenAI, so that your data is processed at an adequate level of protection outside the EEA as well.

3. On what legal basis do we process your data?

We process your personal data to provide the service you request. This processing is necessary for the performance of the agreement that is formed when you use our tool (GDPR Art. 6(1)(b)). This includes, for example, processing your input through the AI to generate the subsidy application and contacting you about the application if needed.

In addition, we may use a limited portion of the data to improve and analyze our services. For this secondary processing, we rely on our legitimate interest (GDPR Art. 6(1)(f)), namely optimizing our service and AI technology. Where possible, we will pseudonymize or aggregate data for this purpose to maximize your privacy. You of course have the right to object to processing based on our legitimate interest (see points 5 and 8 below).

4. How long do we retain your data?

We do not retain your personal data longer than necessary for the described purposes. In practice, this means the following:

After the retention period ends, personal data is deleted or irreversibly anonymized. Note: OpenAI as processor may temporarily cache or store content processed via the API (up to 30 days) for abuse detection and service integrity, in line with their own policies. This temporary storage by OpenAI is covered by our processing agreement.

  • Application data: data entered to prepare the WBSO application is retained until the draft application document has been delivered and any follow‑up steps or support have been completed. By default, we delete or anonymize this data within [e.g. 1 year] after submission, unless legal retention obligations require a longer period or you request earlier deletion.
  • Account or contact data: if you create an account or are on the waitlist, we keep your contact details as long as your account is active or you remain on the waitlist. Inactivity for 12 months will result in deletion of your account and associated personal data.
  • Improvement data: anonymized or aggregated data used for analysis and improvements may be kept longer, but is no longer attributable to an individual.

5. What are your rights?

Under the GDPR you have various rights regarding your personal data. You may at any time (free of charge) exercise the following rights:

  • Right of access: you may request which personal data we have about you and receive a copy.
  • Right to rectification: you may correct or complete inaccurate or outdated data.
  • Right to erasure: also known as the right to be forgotten. You may request deletion of your personal data. We will comply unless a legal obligation or our overriding interest (e.g. fraud prevention) prevents it.
  • Right to restriction of processing: in certain cases you can ask us to restrict processing of your data (for example during an objection or correction request).
  • Right to data portability: you have the right to receive the personal data you provided in a structured, commonly used, machine-readable format, so that you can transfer it to another service.
  • Right to object: you may object to processing based on our legitimate interest. In that case we will stop processing unless we have compelling legitimate grounds that override your interests.

6. What security measures do we take?

We take the protection of your personal data seriously. We have implemented appropriate technical and organizational measures to prevent misuse, loss, unauthorized access, and unwanted disclosure. These measures include:

  • Encryption: data exchange with our website and the OpenAI API occurs over encrypted connections (SSL/TLS) to prevent eavesdropping.
  • Restricted access: only authorized employees and processors have access to your data, and only for the purposes described in this statement. Access rights are periodically reviewed.
  • Processing agreements: we have entered into processing agreements with all external service providers who process personal data on our behalf (such as OpenAI), including strict confidentiality and security requirements and prohibiting unauthorized use.
  • Monitoring and audits: we keep our systems up to date and conduct security audits or tests where necessary. Potential suspicious activities or data breaches are actively monitored.

7. Do we share data with third parties (processors and sub-processors)?

We do not sell personal data to third parties. We do work with external parties who perform services for us and process personal data solely on our behalf and under our instructions. These are our processors (or sub-processors). The main ones are:

These parties may not use your data for their own purposes. We ensure that each processor provides adequate privacy and security safeguards. An up-to-date list of sub-processors can be provided upon request.

In some cases we may be legally obliged to provide data to third parties, for example to regulators, law enforcement, or other authorities. This only occurs when there is a legal obligation to do so.

  • OpenAI (AI service provider): as described above, we use OpenAI to generate text (via the GPT-4 API). OpenAI Ireland Ltd. acts as our processor. OpenAI may use systems in the US (OpenAI, Inc. and affiliated entities) to deliver its services. A valid processing agreement is in place and appropriate safeguards are applied for any transfers outside the EEA.
  • Microsoft Azure (web hosting and infrastructure): our application runs on Microsoft Azure, which uses data centers within the European Economic Area (EEA). A processing agreement is in place with Microsoft Azure.
  • Google Analytics (website analytics): we use Google Analytics to understand how visitors use our website and to optimize it. Google Analytics uses cookies and may collect data such as IP addresses, browser type, and visited pages. This data is anonymized where possible and not used for marketing purposes without your explicit consent.

8. Objections or complaints

Do you have questions or concerns about how we process your personal data? Please contact us first - we will do our best to address any objections. If you still disagree with our approach, you have the right to file a complaint with the supervisory authority.

For the Netherlands this is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP). You can find information on how to file a complaint on their website (www.autoriteitpersoonsgegevens.nl). Filing a complaint does not affect your right to raise objections with us or to claim damages.

9. Contact details of the controller

The controller responsible for the processing described in this privacy policy is WBSO Aanvraag B.V., operating as wbsoaanvraag.ai.

For questions or requests regarding privacy, you can contact us at:

  • Email: contact@wbsoaanvraag.ai

WBSO SUBSIDY

Curious if you qualify?

Do the WBSO Check