Privacy policy
How Repertio processes personal data, which parties it is shared with, and what rights you have.
This privacy policy explains how Repertio processes personal data when you visit our website or use our service. We process as little data as possible, and only where it is needed to deliver the service or to make the website work.
1. Who is responsible for your data
The controller is:
- Repertio, established in the Netherlands
- Email: hello@repertio.nl
We have not appointed a data protection officer. That is not required for an organisation of this size and nature. You can reach us with any question at hello@repertio.nl.
2. What data we process
We process the following categories of data:
- Data you provide yourself: your name, company name, email address, telephone number and the content of your message when you contact us or take out a subscription.
- Data needed to deliver the service: your company's web address, your sector, your service area and the queries we put to AI answer engines on your behalf.
- Billing data: company name, address, Chamber of Commerce number, VAT number and payment details.
- Technical data your browser sends automatically: IP address, browser type, device type, and the pages you view on our site. When you submit the sign-up form, we also record the website you arrived from. We do this to see which sources bring visitors to us, and to be able to demonstrate our own service on ourselves.
We deliberately do not collect special categories of personal data, such as data on health, religious belief or political opinion. We ask you not to provide such data to us.
3. Why we use your data and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Performing the subscription: measuring, optimising and reporting monthly | Contact details, company details, website data | Performance of the contract (Art. 6(1)(b) GDPR) |
| Answering your question or quotation request | Name, email address, content of the message | Performance of the contract or legitimate interest (Art. 6(1)(b) or (f) GDPR) |
| Invoicing and administration | Company and payment details | Legal obligation (Art. 6(1)(c) GDPR) |
| Measuring how our website is used | IP address, browsing behaviour via Google Analytics | Your consent (Art. 6(1)(a) GDPR) |
| Protecting the website against misuse and overload | IP address, log files | Legitimate interest (Art. 6(1)(f) GDPR) |
4. Cookies and similar techniques
Our website places analytics cookies from Google Analytics. These are placed only after you have given consent through the notice that appears on your first visit. As long as you do not give consent, these cookies are not placed and Google Analytics is not loaded.
We also use local storage in your browser to remember your language choice and your cookie choice. That is functional and does not require consent. Our cookie policy sets out exactly which cookies and storage we use and how you can change your choice.
5. Who we share your data with
We do not sell your data and do not share it with parties that use it for their own advertising. We do engage the following parties:
| Party | For what | Where |
|---|---|---|
| Cloud86 B.V. | hosting of the website and email | the Netherlands |
| Google Ireland Limited | Google Analytics, only after your consent | Ireland, with transfer to the United States |
| Providers of AI answer engines | carrying out the measurements for your subscription | including the United States |
To deliver the service we put questions to third-party AI answer engines, including ChatGPT by OpenAI, Claude by Anthropic, Perplexity and Google AI Overviews. As a rule those questions use only your company name and your sector. We do not include personal data of your staff or your customers in them.
With parties acting as our processor we conclude a data processing agreement, which records that they may only use your data on our instructions.
6. Transfers outside the European Economic Area
Some of the parties named above are established in the United States or transfer data there. Such transfers take place under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision, or under the standard contractual clauses adopted by the European Commission.
If you would prefer your data not to leave the European Economic Area, do not give consent for analytics cookies and let us know at hello@repertio.nl, and we will discuss what is possible within the service.
7. How long we keep your data
| Type of data | Retention period |
|---|---|
| Contact requests without follow-up | 12 months after the last contact |
| Client data and reports | for the term of the subscription and 24 months thereafter |
| Invoices and administration | 7 years, under the statutory tax retention obligation |
| Web server log files | no more than 12 months |
| Google Analytics | 14 months |
8. How we protect your data
The website is only reachable over an encrypted connection. Access to client data is limited to the people who need it to deliver the service. Our hosting is located in a data centre in the Netherlands.
If you discover a vulnerability in our systems, please report it to hello@repertio.nl. We respond within five working days and will not disclose the report without consulting you.
9. Your rights
Under the GDPR you have the right to:
- see which personal data we process about you;
- have inaccurate data corrected;
- have your data erased, insofar as we are not legally required to retain it;
- have the processing restricted;
- object to processing based on a legitimate interest;
- receive your data in a common file format or have it transferred;
- withdraw consent at any time, without affecting the lawfulness of processing before that point.
You can submit a request at hello@repertio.nl. We respond within four weeks. To avoid disclosing data to the wrong person, we may ask you to prove your identity.
10. Lodging a complaint
If you disagree with how we handle your data, please tell us first so we can look for a solution together. You also always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), Postbus 93374, 2509 AJ The Hague, autoriteitpersoonsgegevens.nl.
11. Changes to this privacy policy
We may amend this privacy policy, for example when we start using a new service or a new supplier. The current version is always on this page, with the version date at the bottom. For significant changes that affect you as a client, we will inform you by email.