Privacy Policy

AI Business Academy, located at the A20 Trade Center in Nieuwerkerk aan den IJssel, registered with the Dutch Chamber of Commerce under number 87755106, VAT number NL004471708B98, is the controller within the meaning of the General Data Protection Regulation (GDPR). For questions about this policy, contact info@ai-businessacademy.nl or call +31 10 322 0009.

For data that organisations record in our EU AI Act portal, the client is the controller and we are the processor. Our data processing agreement applies to that data.

Depending on your contact with us, we process:

• Identification and contact details: name, job title, organisation, business email address and phone number.
• Answers and messages: your answers in the Practice Scan and the EU AI Act check, the text you enter in a form, and email correspondence.
• Data of business contacts we call: name, legal form, Chamber of Commerce number, sector, location, website and general phone number of the organisation; name, job title and business phone number or email address of the contact person, insofar as the organisation has published them itself; notes of the call. See section 09.
• Recorded consent and objections: when, by whom and for what you gave consent, and for which phone number or email address you objected.
• Contract and invoice data: participation agreement, invoicing and payments.
• Data in the EU AI Act portal: user account data and the information and files your organisation records, such as descriptions of AI systems, documents, images and voice memos.
• Technical data: IP address, browser and device type, pages visited, and an approximate city, country and network organisation. We determine city, country and network with a database on our own server; your IP address is not sent to third parties for this. For statistics we do not store your IP address, only a pseudonym that changes every day (section 11).
• Security data: IP address, time, requested page, browser data and the outcome of login attempts. See section 10.

• Performance of a contract (Article 6(1)(b) GDPR): registration, delivery and invoicing of training and engagements, and provision of the EU AI Act portal.
• At your request (Article 6(1)(b) GDPR): compiling your Practice Scan report and answering your question via the contact form.
• Legal obligation (Article 6(1)(c)): tax retention obligations.
• Legitimate interest (Article 6(1)(f)): calling organisations that are legal entities to introduce our services (section 09); securing our systems and detecting abuse (section 10); cookieless website statistics (section 11); improving our services.
• Consent (Article 6(1)(a)): invitations to our Open Webinar; an email to a business contact who is not yet a client; calling a sole proprietorship, general partnership (vof), limited partnership (cv) or professional partnership (maatschap). We record when, by whom and for what you gave consent. You can withdraw consent at any time.

For some features we have text, and in the portal also images and audio, processed by a language model of an external AI service:

• drafting your Practice Scan report from your answers;
• preparing drafts in our back office, such as a draft email or a summary of an organisation's public website;
• the AI features of the EU AI Act portal, such as classifying AI systems, drafting documentation and processing material you upload.

We use xAI as first choice, with Anthropic and OpenAI as fallback. OpenAI converts voice memos to text; Anthropic and OpenAI process images. These providers are established in the United States and process the data there, with the safeguards described in section 06.

Before free text is sent to the AI service, we remove email addresses, phone numbers and IBANs. Names may remain in the text, so please do not enter personal data in text fields that is not needed. Images and voice memos are processed unchanged.

A staff member reviews drafts we prepare with AI, such as an email, before they are sent on our behalf. Your Practice Scan report is drafted automatically and shown to you straight away; it is advice, not a decision about you. In the portal, the AI output is a draft that your organisation reviews itself. No decision is based solely on automated processing within the meaning of Article 22 GDPR.

We share personal data only with the processors below, and only to the extent necessary for the purpose. We do not sell or rent personal data.

• Hetzner Online GmbH

  Established in

  Gunzenhausen, Germany

  Where processed

  Data centre in Helsinki (Finland)

  Purpose

  Hosting of the website, portal, database, log files and local backups.

  Transfer outside the EEA

  Not applicable, processing within the EEA

• Hostnet B.V.

  Established in

  Amsterdam, The Netherlands

  Where processed

  The Netherlands and Denmark

  Purpose

  Our business mailboxes, the sending of all our outgoing email, and registration and DNS of our domain name.

  Transfer outside the EEA

  Not applicable, processing within the EEA

• X.AI LLC

  Established in

  Palo Alto, United States

  Where processed

  United States

  Purpose

  Primary AI service: drafting your Practice Scan report from your answers, preparing drafts in our back office, and the AI features of the EU AI Act portal.

  Transfer outside the EEA

  EU-US Data Privacy Framework where the provider is certified, otherwise the European Commission's standard contractual clauses

• Anthropic PBC

  Established in

  San Francisco, United States

  Where processed

  United States

  Purpose

  Fallback AI service and image recognition: drafting your Practice Scan report from your answers, preparing drafts in our back office, and the AI features of the EU AI Act portal, including images you upload to the portal.

  Transfer outside the EEA

  EU-US Data Privacy Framework where the provider is certified, otherwise the European Commission's standard contractual clauses

• OpenAI OpCo, LLC

  Established in

  San Francisco, United States

  Where processed

  United States

  Purpose

  Fallback AI service, image recognition and speech-to-text: drafting your Practice Scan report from your answers, preparing drafts in our back office, and the AI features of the EU AI Act portal, including images and voice memos you upload to the portal.

  Transfer outside the EEA

  EU-US Data Privacy Framework where the provider is certified, otherwise the European Commission's standard contractual clauses

• Cloudflare, Inc.

  Established in

  San Francisco, United States

  Where processed

  Global network; United States

  Purpose

  Checking forms for automated abuse (Turnstile) and, where enabled, storage of portal uploads and encrypted backups (R2).

  Transfer outside the EEA

  EU-US Data Privacy Framework where the provider is certified, otherwise the European Commission's standard contractual clauses

• GitHub, Inc.

  Established in

  San Francisco, United States

  Where processed

  United States

  Purpose

  Storage of our source code and automatic deployment of new versions to our server; the deployment service has technical access to the server while doing so.

  Transfer outside the EEA

  EU-US Data Privacy Framework where the provider is certified, otherwise the European Commission's standard contractual clauses

For bookkeeping and invoicing we also use accounting software; we will tell you which provider on request.

We retrieve business data from the Dutch Chamber of Commerce (Business Register), for example to check an organisation's legal form before we call. The Chamber of Commerce is a public source here, not a processor.

We disclose data to the tax authorities or another public authority where the law requires it. Changes to this list are published on this page. Clients of the EU AI Act portal are informed at least thirty days in advance.

We store your data in the European Union: our server is in a data centre in Helsinki (Finland). Some of our processors are established in the United States and process data there: xAI, Anthropic and OpenAI (AI services), Cloudflare (checking forms for abuse and, where enabled, file storage) and GitHub (source code and deployment).

For these transfers we rely on the EU-US Data Privacy Framework where the provider is certified under it (European Commission adequacy decision of 10 July 2023), and otherwise on the European Commission's standard contractual clauses (Article 46(2)(c) GDPR).

We limit what is sent to these providers: email addresses, phone numbers and IBANs are removed from free text in advance, and we only send what the feature needs. You can request a copy of the relevant safeguards at info@ai-businessacademy.nl.

We do not keep data longer than necessary. When the period ends we delete or anonymise the data.

Data needed for an ongoing security investigation, a breach notification or legal proceedings is kept until that is closed.

We take appropriate technical and organisational measures, including: encrypted connections (TLS), role-based access, an append-only audit log with cryptographic chain verification, security monitoring with automatic alerts (section 10), daily backups and a documented procedure for reporting data breaches.

We contact organisations in logistics, food manufacturing and agri-food by telephone to introduce our training and implementation work.

Whom we call. Without prior consent we focus on organisations that are legal entities, such as a BV, NV, cooperative, foundation or association. We call a sole proprietorship, general partnership (vof), limited partnership (cv) or professional partnership (maatschap) only if we have your prior explicit consent, for example because you asked for a call yourself. We look up the legal form in the Dutch Business Register.

When and how often. We only call on working days, Monday to Friday between 08:00 and 18:00. We make at most five call attempts per contact person within fourteen days, and we approach at most three contact persons per organisation.

Which data and where we get it. We use business data only: the organisation's name, legal form, sector, location and general phone number, and the name, job title and business phone number of a contact person insofar as the organisation has published them itself. We take this data from public sources, such as the organisation's website, the Business Register of the Dutch Chamber of Commerce, trade press and public member lists of trade associations. On request we will tell you where your data came from. To prepare a call, an AI service (section 04) may summarise public information about the organisation, such as its website. We do not build profiles of individuals.

Legal basis. We do this on the basis of our legitimate interest in acquiring business clients (Article 6(1)(f) GDPR). We have documented a balancing test. You can request a summary.

Your right to object. In the first call we tell you who we are, where we found your details and that you can object. If you object, we will no longer call or email you. You can also object later, by email to info@ai-businessacademy.nl or by phone. This is free of charge and you do not need to give a reason.

Objection register. To keep respecting your objection, including if your details reappear in a public source, we record the phone number, email address or organisation your objection applies to in our objection register. This is one register for phone and email. We check it before every call and every email to a prospect.

Email. We only email you about our services if you have explicitly agreed to it during a call, or if you asked us for information yourself. We then record the date, the person who agreed and the subject. Such an email is addressed to you personally, from the mailbox of the staff member you spoke to, and is not part of a mass mailing.

Retention. We keep these data for up to 12 months after the last contact, unless there is an open proposal or engagement. An entry in the objection register is kept without an end date.

To protect our systems and our clients' data, we record security-relevant events.

What we record. IP address, time, requested page and method, browser data (user agent) and the outcome of the request. For login attempts we also record which account was involved and whether the attempt succeeded. For staff and portal users we record administrative actions.

Why. To detect, stop and investigate intrusion attempts, form abuse and outages, and to demonstrate appropriate security measures (Article 32 GDPR). The legal basis is our legitimate interest in securing our systems and the data clients entrust to us (Article 6(1)(f) GDPR).

Automatic measures. If one IP address sends repeated suspicious requests, we may block it automatically and temporarily. The only effect is that our website is temporarily unreachable from that address. Our team is alerted automatically about suspicious events.

Retention. Web server logs 14 days. Security events with the full IP address 30 days; after that we replace the IP address with a pseudonym and keep the event for up to 12 months; after that only daily counts remain.

These data are kept on our own server in the EU. We do not pass them on, unless the law requires it or it is needed to file a police report. Forms are additionally checked by Cloudflare Turnstile (section 11).

We do not use tracking cookies, and no third-party cookies or scripts for advertising or analytics. For our statistics we set no cookies and store nothing on your device. When you visit a page, our own measurement script only sends a few general browser details, such as screen size, language setting and the page you came from. This falls under the exception for measuring the quality or effectiveness of our website with no or minor impact on your privacy (Article 11.7a(3)(b) of the Dutch Telecommunications Act). That is why we do not ask you for cookie consent.

How we count visits. With every page visit our server receives, as with any website, your IP address and browser data (user agent). Together with the name of our website, we turn these into a pseudonym using a cryptographic hash function and a random key. That key is valid for one calendar day: after midnight we use a new one and delete the one from the previous day. As a result we can only link a visit to earlier visits on the same day, and no one, including us, can later trace the pseudonym back to your IP address or link it to visits on another day. We do not store your IP address or browser data themselves for this purpose. Visits with the same pseudonym less than 30 minutes apart count as one session.

What we record. The pseudonym and the session, the page visited, the website you came from, device type, browser and operating system, screen size, language setting, how far you scroll on a page, clicks on links to other websites and actions such as starting the Practice Scan, plus the approximate city, country and network organisation from section 02. We process these statistics on our own server; nothing is sent to an external analytics service. We do not link them to your name or contact details, not even when you fill in a form.

Legal basis. Our legitimate interest (Article 6(1)(f) GDPR) in understanding how our website is used and improving it. We limit the processing to what is needed for that: no ID on your device, a pseudonym that changes every day and no storage of your IP address. If your browser sends "Do Not Track", we do not count your visit. You can also object via info@ai-businessacademy.nl (section 12).

What is stored on your device. Only what is strictly necessary for a service you request yourself:

• Practice Scan: once you fill in the scan, your browser keeps a draft of your answers in session storage (sessionStorage) so you can continue where you left off, and afterwards a key that lets only you open your own report. Both disappear when you close the tab; we stop using the draft after two hours.
• Logging in: when you log in to the EU AI Act portal or the back office, we set a session cookie that keeps you logged in (aiba_eaa_session or aiba_admin_session) and a cookie that recognises your device after a successful login (aiba_dev, 180 days), so that repeated failed login attempts from an unknown device cannot lock you out. Two-step verification for the back office adds a short-lived cookie (aiba_admin_mfa).

Other choices on the website, such as dismissing a notice, are only remembered while the page is open.

Abuse check: forms such as the Practice Scan and the contact form may be protected by Cloudflare Turnstile. Cloudflare then processes your IP address and browser data to assess whether a person is filling in the form (sections 05 and 06).

You have the right to:

• access your data (Article 15 GDPR);
• have your data corrected or completed (Article 16);
• have your data erased (Article 17);
• have processing restricted (Article 18);
• data portability (Article 20);
• object to processing based on legitimate interest (Article 21);
• withdraw your consent at any time.

You can always object to the use of your data for direct marketing, including telephone outreach. We then stop immediately and add you to our objection register (section 09).

You can exercise your rights via info@ai-businessacademy.nl. We respond within one month. If a request is complex or there are many requests, we may extend this by two months; we will tell you why within one month.

If you believe we do not handle your data properly, please let us know. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via autoriteitpersoonsgegevens.nl.

We review this policy periodically and amend it when our processing changes. Changes are published on this page, with the date at the top. For a change that affects you, such as a new processor outside the EEA, we inform clients by email in advance.