Privacy Policy
Last updated:
Cortiscale respects your privacy. This policy explains how we collect, use, store, share and protect personal data when you visit our website or contact us.
1. Scope and responsibility
This policy applies where Cortiscale acts as the data controller: where we determine the purposes and means of processing your personal data. In this policy, ‘we’, ‘us’ and ‘our’ refer to Cortiscale, based in the Netherlands.
We process personal data in accordance with the General Data Protection Regulation (GDPR, known in Dutch as the AVG), the Dutch GDPR Implementation Act (Uitvoeringswet AVG) and applicable Dutch privacy and electronic communications law.
This policy covers our public website and enquiries. Processing carried out on behalf of a client is governed by the relevant client agreement and, where required, a separate data processing agreement.
2. Personal data we collect
We collect only the personal data needed for the purposes described in this policy. Depending on how you interact with us, this includes:
- Enquiry data: your name, email address, company if supplied, message, and any choices you make about your current AI use or the services you are interested in.
- Correspondence data: information you provide when we respond to your enquiry or discuss a potential collaboration.
- Technical data: IP address, request information, browser and device information, and security or delivery records needed to operate and protect the website.
- Usage and performance data: pages visited, referring website, approximate location, device and browser information, and page-loading measurements.
3. How we collect your data
You provide enquiry and correspondence data directly when you fill in our contact form or otherwise communicate with us. Technical, usage and performance data are collected when you access the website, through our hosting and monitoring services.
Providing personal data is voluntary. We need your name, email address and message to handle a contact-form enquiry. Without those details, we cannot process the form or respond to you. Company and enquiry-context fields are optional. Please do not include sensitive personal data or information you are not authorised to share.
4. Purposes and legal bases
We will only use your personal data when the law allows us to. Under Article 6(1) GDPR, we rely on the following legal bases:
- Responding to enquiries and maintaining business correspondence: our legitimate interest in communicating with people who contact us and developing business relationships (Article 6(1)(f)). Where you personally request steps towards a contract with us, the legal basis is taking those steps at your request (Article 6(1)(b)).
- Operating, maintaining and protecting the website, preventing abuse and troubleshooting delivery: our legitimate interest in a secure and reliable website (Article 6(1)(f)).
- Understanding website usage and improving performance: our legitimate interest in improving our website using limited analytics and performance information (Article 6(1)(f)), subject to your interests and rights. Where consent is required for a technology or processing activity, we rely on your consent (Article 6(1)(a)).
- Complying with applicable legal obligations: compliance with the obligation concerned (Article 6(1)(c)).
6. International transfers
Our service providers may process personal data outside the European Economic Area, including in the United States. Where this happens, the transfer must be protected under Chapter V GDPR, for example by an applicable European Commission adequacy decision or the European Commission’s standard contractual clauses, together with supplementary safeguards where required.
You can contact us to request information about the safeguards applicable to your data and a copy of the relevant safeguards, subject to necessary protection of confidential information.
7. Data retention
We retain enquiry and correspondence data for two years after our last contact with you. Technical and monitoring data are retained for no longer than two years and may be deleted sooner under the service provider’s retention schedule.
We retain personal data for longer only where a legal obligation requires it or where necessary to establish, exercise or defend a legal claim. In that case, we limit the data retained to what is needed and delete it when that obligation or need ends. Information that has been irreversibly anonymised is no longer personal data.
8. Your privacy rights
Subject to the conditions and exceptions in the GDPR, you have the following rights:
- Access: request a copy of your personal data and information about how we process it.
- Rectification: request correction of inaccurate or incomplete personal data.
- Erasure: request deletion of your personal data where the legal conditions are met.
- Restriction: request that we limit processing in the circumstances set out in the GDPR.
- Portability: receive data you provided in a structured, commonly used, machine-readable format where processing is automated and based on consent or a contract.
- Objection: object, on grounds relating to your particular situation, to processing based on legitimate interests. You may object to direct marketing at any time.
- Withdrawal of consent: withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
9. Requests and complaints
To exercise a privacy right, use our contact form and state which right you wish to exercise. We may ask for information reasonably necessary to verify your identity. Please do not send a copy of an identity document unless we specifically request an appropriate, limited verification method.
We respond without undue delay and within one month of receiving your request. If a request is complex or you make several requests, we may extend this period by up to two further months; we will explain the extension within the first month. Requests are normally free of charge. Where permitted by the GDPR, manifestly unfounded or excessive requests may be refused or subject to a reasonable fee.
You may lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens, or with the supervisory authority in the EU/EEA country where you live, work or believe an infringement occurred. This does not affect your right to seek a judicial remedy.
11. Data security
We use appropriate technical and organisational measures to protect personal data against accidental loss, misuse, unauthorised access, alteration and disclosure. Access is limited to people and service providers who need it for the purposes described in this policy. No internet transmission or storage system can be guaranteed completely secure.
12. Automated decisions
We do not use website enquiries or visitor information to make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you. Automated security checks may limit abusive traffic to protect the website.
13. Children’s privacy
Our website is intended for professional audiences and is not directed at children under 16. If you believe a child has provided us with personal data, please contact us so we can address the matter and delete data where appropriate.
14. Changes to this policy
We may update this policy from time to time. The current version is published on this page with its last-updated date. Where required by law, we will provide additional notice of material changes. A change to this policy does not itself authorise a new processing purpose or replace any consent required by law.
15. Contact us
If you have a question about this policy or how Cortiscale handles your personal data, use our website contact form. Include ‘Privacy request’ in your message so we can direct it appropriately.
This document was adapted from a free template by SEQ Legal.