Privacy Policy

1. Who we are and who is responsible

wbsoaanvraag.ai (hereinafter "we", "us" or "our") helps entrepreneurs prepare WBSO applications and the associated hour and project record-keeping, partly with the help of artificial intelligence (AI). This privacy policy explains which personal data we process, why, on what legal basis, with whom we share it, and what rights you have.

The controller responsible for the processing described in this policy is WBSO Aanvraag B.V., except where we act as a processor for your organisation (see section 10), operating under the name wbsoaanvraag.ai, located at Europalaan 93, 3526 KP Utrecht, the Netherlands, and registered with the Dutch Chamber of Commerce (KvK) under number 99786079. We are not legally required to appoint a Data Protection Officer and have not appointed one. For all privacy questions and requests, you can reach us via the contact details at the bottom of this policy.

2. Which data do we process and from whom?

We process only the data needed to deliver and improve our service. Depending on how you use our service, this includes:

• Data about you and your company: identification and contact details (such as company name, Chamber of Commerce number, contact person's name, email address, and phone number), the project information you enter (descriptions of technical innovations, bottlenecks, and other project details), account and login data, and billing data.
• Data you send us: when you fill in the contact form or schedule a meeting with us, we process your name, contact details and your message.
• Data about your employees: when you supply or connect hour and project data, we process personal data of your employees (such as name, email address, and hour records, and - only where legally necessary for WBSO realisation - the citizen service number (BSN)). We receive this data from you and not directly from the employees concerned; section 10 applies to it.
• Data about website visitors: when you visit our website, we process technical data (such as IP address and browser type) and, after your consent, data via cookies and similar techniques (see section 9).

3. For which purposes and on what legal basis do we process your data?

We process your personal data solely for the purposes described below and on the legal basis stated for each:

• Performance of the contract (GDPR Art. 6(1)(b)): preparing and delivering your draft WBSO application, maintaining the hour and project records, contacting you about it, and answering your questions before a contract is in place.
• Legal obligation (GDPR Art. 6(1)(c)): keeping accurate billing and accounting records, for which a statutory tax retention obligation applies.
• Legitimate interest (GDPR Art. 6(1)(f)): securing our systems and preventing misuse. You may object to processing on this basis (see section 8).
• Consent (GDPR Art. 6(1)(a)): placing analytics cookies and loading the Calendly meeting scheduler. You may withdraw your consent at any time (see section 9).

4. How does the AI work and how do we process your data with it?

To generate the draft application, we use large language models from OpenAI, which we obtain through Microsoft's Azure OpenAI service. These models run in an Azure environment in Sweden: your project information is processed within Microsoft's EU Data Boundary (data centres in the EU and EFTA countries) and is not sent to OpenAI. Microsoft processes this data solely on our behalf and according to our instructions, under the data processing agreement that applies to our Azure services, and does not use it to train AI models. Microsoft may retain inputs and outputs for a limited time to detect abuse; that data is stored in Sweden and can only be accessed by authorised Microsoft employees in the EEA. We ourselves also use your data solely to deliver the service to you and not to train or otherwise improve AI models.

No automated decision-making: the AI generates a draft that you, and where applicable our advisor, review, edit, and approve before anything is done with it. We never submit anything to the RVO automatically. We do not make decisions with legal or similarly significant effects based solely on automated processing (GDPR Art. 22). In plain terms: based on your own input, the model predicts wording that fits a WBSO application; it does not assess, rank, or score individuals and makes no decisions about your eligibility for the subsidy.

5. With whom do we share your data?

We do not sell your personal data, and we do not make it available to other parties for their own purposes unless we are legally required to do so. We do engage external parties who perform services for us and process personal data in doing so, solely on our behalf and under our instructions (our processors and sub-processors). These are:

• AI language models (Microsoft's Azure OpenAI, processing within Microsoft's EU Data Boundary) — generating the draft application text.
• Hosting and storage (Microsoft Azure) — running our application and storing data and files within the European Economic Area (EEA).
• Network and security (Cloudflare) — hosting our website and securely passing traffic between your browser and our application.
• Analytics (PostHog) — measuring and improving website usage; this is only deployed after your consent (see section 9).
• Meeting scheduler (Calendly) — scheduling a meeting via our contact page; it is only loaded after your consent (see section 9).
• Other processors: CRM (Pipedrive), billing (Bunni), email delivery (Google Workspace) and monitoring the operation of our systems (Pydantic Logfire).

We share only the data necessary for the relevant service, and a data processing agreement is in place with each processor. An up-to-date list of our (sub-)processors can be provided upon request. In addition, we may provide data to regulators, law enforcement, or other authorities, but only where there is a legal obligation to do so.

6. Transfers of data outside the EEA

Some of our processors are located in or process data outside the EEA, in particular in the United States. In that case we ensure the transfer complies with the GDPR by relying on an appropriate safeguard mechanism. Per processor, the following applies:

• Google, Microsoft, Cloudflare, Pipedrive, Pydantic (Logfire) and Calendly: insofar as these parties process data in the United States, we rely on the EU-US Data Privacy Framework (recognised by the European Commission as providing an adequate level of protection) where the party is certified under it, and otherwise on Standard Contractual Clauses.
• PostHog, Bunni and our storage with Microsoft Azure: are hosted within the EEA.
• Microsoft's Azure OpenAI: processes within Microsoft's EU Data Boundary (EU and EFTA countries). Insofar as that happens in Switzerland, the European Commission's adequacy decision for Switzerland applies.

A copy of the safeguards applied can be provided upon request.

7. How long do we retain your data?

We do not retain your personal data longer than necessary for the purposes for which we process it. In practice, we apply the following principles:

• Application, project and hour data: we process this on behalf of your organisation (see section 10) and retain it in line with the data processing agreement: for the duration of the agreement and afterwards for as long as needed for the statutory retention obligation of the WBSO records (at least seven years). After the agreement ends, your organisation can request an export of this data.
• Account and contact data: we retain this for as long as your account exists. Upon termination or at your request, we delete your account and the associated personal data.
• Data from the contact form and the meeting scheduler: we retain this no longer than needed to handle your question and follow up on the contact that results from it.
• Billing and accounting data: we retain for 7 years, in line with the statutory tax retention obligation.
• Technical log files: we retain in principle for no more than 90 days, unless they are needed to investigate a security incident.
• Data processed by Azure OpenAI may be retained by Microsoft in Sweden for a limited time for abuse detection.

8. What are your rights?

Under the GDPR you have various rights regarding your personal data:

• Right of access: you may request which personal data we process about you and receive a copy.
• Right to rectification: you may have inaccurate or incomplete data corrected or completed.
• Right to erasure (the right to be forgotten): you may request deletion of your personal data, unless a legal obligation or an overriding interest prevents it.
• Right to restriction of processing: in certain cases you can ask us to restrict processing of your data.
• Right to data portability: you may receive the data you provided in a structured, commonly used, and machine-readable format.
• Right to object: you may object to processing based on our legitimate interest.
• Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time, as easily as you gave it.

You may exercise these rights free of charge by contacting us via the contact details at the bottom of this policy. We will in principle respond to your request within one month. To protect your privacy, we may ask you to identify yourself before we act on a request. If your request concerns data we process on behalf of your employer or a client (see section 10), we coordinate handling it with that organisation.

9. Cookies and tracking

Our website uses cookies and similar techniques. We distinguish between:

• Essential cookies: necessary for the functioning and security of the website; no consent is required for these.
• Analytics cookies (PostHog): help us understand how the website is used so we can improve it. PostHog processes this data within the EEA. We record sessions only on our public website, never in the portal or on other pages that show your own data.
• Meeting scheduler (Calendly): on our contact page you can schedule a meeting through Calendly. Calendly places its own cookies and processes data in the United States (see section 6). The scheduler is only loaded after you give consent.

We place non-essential cookies only after you have given consent. Rejecting is as easy as accepting, and we do not use a cookie wall: you can use the website without giving consent. You can change or withdraw your choice at any time via "Cookie settings" at the bottom of the website or in the portal menu.

10. Data you provide about others (employees and hours)

To prepare the WBSO records and application, we process personal data of your employees (such as name, email address, and hour records). We receive this data not directly from the employees concerned, but from you and from the systems you connect or supply data from, such as Simplicate, Harvest, Jira, Linear, Plane, Wrike, GitHub, GitLab and Azure DevOps, and via manual upload (for example a CSV or hour file). Where legally necessary for WBSO realisation and final settlement, we also process employees' citizen service number (BSN). We process the BSN solely for that statutory purpose, never send it to an AI provider, and surround it with appropriate safeguards.

For this data we act as a processor and you are the controller. This means you are responsible for ensuring there is a valid legal basis and that your employees are informed that their data is provided to us and for what purpose (GDPR Art. 14). The arrangements for this data are set out in the data processing agreement that forms part of our licence agreement. We use this data solely to deliver the service you request and not for our own purposes.

11. What security measures do we take?

We take the protection of your personal data seriously and have implemented appropriate technical and organisational measures to prevent misuse, loss, unauthorised access, and unwanted disclosure. Some of these measures are:

• Encryption: data exchange with our website and with our processors takes place over encrypted connections (TLS). Data is stored encrypted; access tokens for connections to your systems are additionally encrypted separately.
• Hosting in the EEA: our application, database and file storage run in Microsoft Azure data centres within the EEA.
• Restricted access: data is separated per organisation and access is role-based. Only staff who need it for their work have access to your data.
• Data processing agreements: we have entered into data processing agreements with the external parties that process personal data on our behalf, with confidentiality and security requirements.
• Maintenance and logging: we keep our systems and software libraries up to date and record security-relevant events in our infrastructure.

12. Objections or complaints

Do you have questions or concerns about how we process your personal data? Please contact us first; we will do our best to address any objections. If you still disagree with our approach, you have the right to file a complaint with the supervisory authority.

For the Netherlands, this is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP). On the AP's website (www.autoriteitpersoonsgegevens.nl) you can find information on how to file a complaint. Filing a complaint does not affect your right to also raise objections with us or to claim damages.

13. Changes to this privacy policy

We may update this privacy policy from time to time, for example when our services, our processors or laws and regulations give reason to do so. You can always find the most current version on this page, with the date of the last change and the version number at the top. In the event of significant changes, we will actively inform you where possible.

14. Contact details

For questions or requests regarding privacy, you can contact us at:

• Email: privacy@wbsoaanvraag.ai
• Post: WBSO Aanvraag B.V., Europalaan 93, 3526 KP Utrecht, the Netherlands