Privacy Policy

We collect and process the following categories of personal data, depending on how you interact with our Platform and Services:

1.1 Information You Provide Directly

• Account Information — Full name, email address, company name, industry, job title, and user role, provided during registration or account setup.
• Contact Form Submissions — Name, email address, and message content submitted through our website contact form.
• Uploaded Content — Documents, data files (e.g., SAP Excel exports, CSV files), continuous improvement records, images, and other materials uploaded to the Platform in the course of using the Services.
• Communication Data — Messages, posts, comments, and other content created within the Platform's social feed, messaging features, and collaborative tools.
• Billing Information — Company billing address, VAT number, and invoice-related details. Note: we do not directly process or store credit card numbers or payment credentials; payment processing is handled by third-party payment processors.

1.2 Information Collected Automatically

• Technical Data — IP address, browser type and version, operating system, device type, screen resolution, and language preferences.
• Usage Data — Pages visited, features used, session duration, timestamps, click patterns, and interaction data to improve Platform functionality and user experience.
• Log Data — Server logs that record requests made to the Platform, including access times, error logs, and referring URLs.
• Cookies & Similar Technologies — As described in Section 9 of this Privacy Policy.

1.3 Information from Third Parties

In limited circumstances, we may receive personal data from third parties, such as: (a) identity verification services; (b) business partners who refer clients to us; or (c) publicly available business registries. Where this occurs, we will inform you of the source and legal basis for processing.

Your personal data is processed strictly for the following purposes:

• Account Creation & Management — To create, maintain, authenticate, and administer your user account and provide secure access to the Platform.
• Service Delivery — To deliver the contracted services, including all Platform features, modules, analytics, reporting, and data exports.
• Billing & Invoicing — To process subscription payments, issue invoices, manage renewals, and comply with tax and accounting obligations.
• Platform Improvement — To analyse usage patterns, identify bugs, and improve Platform functionality, performance, reliability, and user experience.
• Communication — To send essential service-related notifications (e.g., account confirmations, security alerts, service changes) and, only with your explicit consent, promotional or marketing communications.
• Security & Fraud Prevention — To detect, prevent, and respond to security incidents, unauthorised access, fraud, abuse, and Platform misuse.
• Legal Compliance — To comply with applicable legal obligations, respond to lawful requests from public authorities, and establish, exercise, or defend legal claims.
• Contact Enquiries — To respond to messages submitted via the contact form and to follow up on business enquiries.

We do not process your personal data for purposes incompatible with the above without obtaining your prior consent or having another lawful basis to do so.

We process personal data only where we have a valid legal basis under the GDPR:

• Performance of a Contract (Art. 6(1)(b)) — Processing necessary for the performance of our service agreement with you, including account management, service delivery, and billing. This is the primary legal basis for most processing activities related to Platform usage.
• Legitimate Interests (Art. 6(1)(f)) — Processing necessary for our legitimate business interests, including: Platform security and fraud prevention; service improvement through usage analytics; responding to contact form enquiries; and business administration. We have conducted a legitimate interest assessment and concluded that these interests do not override your fundamental rights and freedoms.
• Consent (Art. 6(1)(a)) — Where we rely on your consent, such as for: non-essential or analytics cookies; marketing and promotional communications; and any processing activity for which consent is specifically required. You have the right to withdraw consent at any time, without affecting the lawfulness of processing prior to withdrawal.
• Legal Obligation (Art. 6(1)(c)) — Processing required to comply with applicable Dutch, EU, or other relevant law, including tax record-keeping, anti-money laundering regulations, and responses to lawful government or judicial requests.

4.1 Storage Location

Personal data is stored on secure servers within the European Economic Area (EEA). Where data is hosted by third-party infrastructure providers, we ensure that such providers offer adequate security guarantees and that data processing agreements compliant with GDPR Article 28 are in place.

4.2 Retention Periods

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law:

• Account Data — Retained for the duration of the active subscription and for up to 12 months following account closure, to allow for account reactivation and to address any post-termination queries or disputes.
• Financial & Tax Records — Retained for 7 years in accordance with Dutch fiscal record-keeping requirements (Algemene wet inzake rijksbelastingen).
• Usage & Analytics Data — Retained in anonymised or aggregated form for up to 2 years. Data is anonymised such that individual users cannot be re-identified.
• Communication Data — Messages, posts, and comments are retained for the duration of the active subscription and deleted within 30 days of account closure, unless required for legal or compliance purposes.
• Contact Form Data — Retained for up to 12 months from the date of submission, or until the enquiry has been resolved, whichever is later.
• Server Logs — Retained for up to 90 days for security and debugging purposes, then automatically purged.

Upon expiration of the applicable retention period, personal data is securely deleted using industry-standard methods or irreversibly anonymised so that it can no longer be linked to an identifiable individual.

We primarily store and process personal data within the European Economic Area (EEA). However, in certain circumstances, personal data may be transferred to, or accessed from, countries outside the EEA — for example, where a third-party service provider operates from or has infrastructure in a non-EEA country.

Where such transfers occur, we ensure that appropriate safeguards are in place to protect your personal data, in accordance with GDPR Chapter V, including:

• Adequacy Decisions — Transfers to countries that the European Commission has determined provide an adequate level of data protection.
• Standard Contractual Clauses (SCCs) — EU-approved Standard Contractual Clauses incorporated into our agreements with third-party processors outside the EEA.
• Supplementary Measures — Additional technical and organisational safeguards where required by the specific circumstances of the transfer, following the guidance of the European Data Protection Board (EDPB).

You may request a copy of the relevant safeguards by contacting us at info@kaizenkanri.nl.

We may share personal data with the following categories of third-party service providers ("Processors"), all of whom are bound by written data processing agreements in compliance with GDPR Article 28:

• Hosting & Infrastructure Providers — Cloud hosting services for secure data storage, computing, and Platform availability.
• Email Service Providers — For sending transactional emails (e.g., account notifications, contact form confirmations) and, with your consent, marketing communications.
• Payment Processors — For the secure processing of subscription payments and invoices. Payment processors operate as independent controllers for payment-related data.
• Analytics Tools — For anonymised usage analytics to improve Platform performance and user experience. Analytics data is aggregated and does not identify individual users.
• Security Services — For intrusion detection, DDoS protection, and other security-related monitoring.

We do not sell, rent, lease, or trade your personal data to third parties for their own marketing or commercial purposes.

We may also disclose personal data where required by law, regulation, legal process, or enforceable governmental request, or where necessary to protect the rights, property, or safety of the Provider, its users, or the public.

Under the GDPR, you have the following rights with respect to your personal data. These rights are not absolute and may be subject to legal exceptions and limitations:

• Right of Access (Art. 15) — You have the right to obtain confirmation as to whether personal data concerning you is being processed and, if so, to request a copy of that data along with supplementary information about the processing.
• Right to Rectification (Art. 16) — You have the right to request the correction of inaccurate personal data and the completion of incomplete personal data.
• Right to Erasure (Art. 17) — You have the right to request deletion of your personal data where: the data is no longer necessary for the purpose for which it was collected; you withdraw consent (where consent is the legal basis); you object to processing and there are no overriding legitimate grounds; or the data has been unlawfully processed. This right is subject to legal retention obligations.
• Right to Restriction of Processing (Art. 18) — You have the right to request restriction of processing where: the accuracy of the data is contested; the processing is unlawful and you oppose erasure; we no longer need the data but you require it for legal claims; or you have objected to processing pending verification of legitimate grounds.
• Right to Data Portability (Art. 20) — You have the right to receive your personal data in a structured, commonly used, machine-readable format (e.g., JSON, CSV) and to transmit that data to another controller, where processing is based on consent or contract and carried out by automated means.
• Right to Object (Art. 21) — You have the right to object to processing based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, processing shall cease immediately.
• Right to Withdraw Consent (Art. 7(3)) — Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.
• Right to Lodge a Complaint — You have the right to lodge a complaint with the competent supervisory authority (see Section 12).

How to exercise your rights: To exercise any of the above rights, please submit your request to info@kaizenkanri.nl. We may request verification of your identity before processing your request. We will respond within 30 days of receipt, as required by the GDPR. If we need additional time (up to a further 60 days for complex requests), we will inform you within the initial 30-day period, together with the reasons for the extension.

The Platform does not currently engage in automated decision-making or profiling that produces legal effects or similarly significant effects on individuals, as defined under GDPR Article 22.

Should we introduce any form of automated decision-making or profiling in the future, we will: (a) inform you of the logic involved and the significance and envisaged consequences for you; (b) implement appropriate safeguards, including the right to obtain human intervention, express your point of view, and contest the decision; and (c) update this Privacy Policy accordingly.

The Platform uses cookies and similar technologies (e.g., local storage, session storage) to provide, secure, and improve the user experience. Below is a summary of the cookies we use:

Essential cookies are strictly necessary for the Platform to function and cannot be disabled without impairing core functionality. Analytics cookies are only activated with your explicit consent.

You may manage your cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. However, disabling essential cookies may prevent you from using key features of the Platform. For more information about managing cookies, visit allaboutcookies.org.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction, in accordance with GDPR Article 32. These measures include, but are not limited to:

• Encryption — All data is encrypted in transit using TLS 1.2 or higher. Sensitive data is encrypted at rest where applicable.
• Access Control — Access to personal data is restricted to authorised personnel on a strict need-to-know basis, governed by role-based access controls (RBAC) and the principle of least privilege.
• Authentication — Secure authentication mechanisms including hashed and salted passwords (bcrypt), JWT-based session tokens, and configurable session expiry.
• Monitoring & Logging — Continuous security monitoring with activity logging, anomaly detection, and established incident response procedures.
• Regular Assessment — Periodic review of security practices, vulnerability assessments, and updates to address emerging threats.
• Data Minimisation — We collect only the personal data that is necessary for the stated purposes and do not retain it longer than required.

While we strive to use commercially acceptable means to protect your personal data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to taking all reasonable steps to protect your data.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, we will:

• Notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33, including: the nature of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures taken or proposed to address the breach.
• Where the breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, in accordance with GDPR Article 34, providing a clear description of the breach and recommendations for you to mitigate potential adverse effects.
• Document all breaches, including those that do not meet the notification threshold, as part of our internal breach register, in compliance with our accountability obligations under GDPR Article 5(2).

The Platform and Services are designed for use by businesses and professionals. We do not knowingly collect personal data from children under the age of 16 (or the applicable age of digital consent in your jurisdiction). If we become aware that we have inadvertently collected personal data from a child without appropriate parental consent, we will take prompt steps to delete such data. If you believe that a child has provided us with personal data, please contact us at info@kaizenkanri.nl.

We reserve the right to update or modify this Privacy Policy at any time to reflect changes in our processing activities, legal requirements, or business practices. Where changes are material, we will notify you at least 30 days in advance by email or through a prominent notice on the Platform.

We encourage you to review this Privacy Policy periodically. The "Last updated" date at the top of this page indicates when the most recent changes were made. Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.

For any questions, concerns, or requests regarding this Privacy Policy, the processing of your personal data, or to exercise your data subject rights, please contact:

We aim to resolve all privacy-related enquiries promptly and fairly. If you are unsatisfied with our response or believe that your data protection rights have been violated, you have the right to lodge a complaint with the competent supervisory authority: