PrivacyPolicy

Identity of the Data Controller

This privacy policy applies to AIMAZE (hereinafter referred to as “we,” “us,” or “our”). Under the General Data Protection Regulation (GDPR), AIMAZE may assume two roles:

For processing activities that AIMAZE carries out for its own purposes, such as website management, marketing, customer administration, and platform management, AIMAZE acts as the data controller. This privacy policy primarily addresses these situations, in which we ourselves determine why and how personal data is processed.

When AIMAZE processes personal data on behalf of a client—for example, when using a Digital Employee or our platform within that client’s environment—AIMAZE acts as a processor. In such cases, the client’s privacy policy takes precedence, and the mutual agreements regarding data processing and security are set forth in a separate data processing agreement.

Contact Information:

If you have any questions about this privacy policy or the processing of your personal data, please contact us at one of the email addresses listed above.

Scope of Application

This Privacy Policy applies to all services and activities of AIMAZE B.V., including, but not limited to, our websites (such as aimaze.nl and teamportal.ai), the AIMAZE platform and its associated applications, the use of and interaction with our Digital Employees (AI systems), customer portals, online forms, newsletters, and social media links (as described in Article 17). This policy describes what personal data we collect, on what legal basis and for what purpose we process it, how long we retain it, and what rights you have as a data subject. Wherever the term “the website” is used in the remainder of this document, it refers to the entire AIMAZE ecosystem described above, unless explicitly stated otherwise.

AIMAZE processes personal data in various capacities. For processing activities that AIMAZE carries out for its own purposes—such as website management, customer administration, marketing, newsletters, demo requests, platform management, and security—AIMAZE acts as the data controller within the meaning of the GDPR.

When AIMAZE processes personal data on behalf of a client—for example, when using a Digital Employee within that client’s systems, content processes, or social media accounts—AIMAZE acts as a processor. In such cases, the terms regarding the processing are set forth in a separate data processing agreement.

What personal data do we process?

3.1 Website Visitors

When you visit our website, the following data may be processed:

• IP address (anonymized where possible)
• Browser and device information (user agent)
• Date and time of the visit
• Pages Visited and Click Behavior
• Referring website (referrer URL)
• Cookie Data (see Article 9)

3.2 Subscribers and newsletter sign-ups

If you subscribe to a newsletter or notifications, we process:

• Email address
• Any name or preferences provided
• Date and time of registration
• Consent Record (Proof of Opt-In)

3.3 Commenters and Interaction

When you comment on blog posts or otherwise communicate through the website, we process:

• Name (or pseudonym)
• Email address
• IP address
• Content of your response
• Date and time of the response

3.4 Columnists and Guest Writers

For columnists and guest authors who submit content, we process:

• Full name and, if applicable, pen name
• Email address and other contact information
• Biographical Information (for the Author Page)
• Profile photo (if provided)
• Bank Information (only if payments are involved)

3.5 Customers, business contacts, and leads

When you become a customer, request a demo, or contact our support department, we process:

• First and last name
• Business email address and phone number
• Company Name and Position
• Payment and Billing Information
• Content of support inquiries and other email communications

3.6 Platform Users (AIMAZE Platform)

When you create an account and use our AI platform or our customer portals, we process:

• Login credentials (such as email addresses and encrypted passwords)
• Platform usage logs (such as login times, IP addresses, and actions taken)
• Prompts, entered text, and filled-in input fields
• Generated output (if and to the extent that it contains personal data)

3.7 Social Media Links

When you link your external social media accounts (such as Facebook, Threads, and Instagram) to our platform, as described in more detail in Article 17, we receive and process:

• Social media user IDs
• Access tokens for publication
• Basic profile information (such as name and profile photo)

Purposes and Legal Basis for Processing

We process personal data exclusively for the purposes described below and on the legal grounds specified in Article 6 of the GDPR:

4.1 Website Functionality

Legal basis: legitimate interests (Article 6(1)(f) of the GDPR).

We process technical data to ensure that the website functions properly, to guarantee security, and to prevent misuse.

4.2 Analyzing Website Usage

Legal basis: consent (Article 6(1)(a) of the GDPR) for non-essential analytical cookies; legitimate interest for anonymized statistics.

We use analytics tools to understand how our website is used and to improve the user experience.

4.3 Sending Newsletters and Notifications

Legal basis: consent (Article 6(1)(a) of the GDPR).

We send newsletters and notifications only to individuals who have expressly consented to receive them. You can withdraw this consent at any time by clicking the unsubscribe link in each message.

4.4 Publication of Comments

Legal basis: consent (Article 6(1)(a) of the GDPR).

Comments will be published after you have given your consent. Your email address will not be made public.

4.5 Managing Authors and Columnists

Legal basis: performance of a contract (Article 6(1)(b) of the GDPR) and legal obligation (Article 6(1)(c) of the GDPR regarding tax retention requirements).

We process authors' data for the purpose of publishing their content, displaying author profiles, and handling any administrative and financial matters.

4.6 Legal Obligations

Legal basis: legal obligation (Article 6(1)(c) of the GDPR).

In certain cases, we are legally required to process personal data, for example, for tax purposes or in response to court orders.

4.7 Demo Requests, Customer Contact, and Support

Legal basis: legitimate interests (Article 6(1)(f) of the GDPR) and/or performance of a contract (Article 6(1)(b) of the GDPR).

Purpose: We process contact information, company information, and communication data to answer questions, schedule demos, prepare quotes, provide customer support, and deliver our services.

4.8 Use of the AIMAZE Platform

Legal basis: performance of a contract (Article 6(1)(b) of the GDPR) and legitimate interest (Article 6(1)(f) of the GDPR).

Purpose: We process account information, log data, prompts, input fields, and output to provide access to the platform, authenticate users, execute commands, ensure security, and prevent abuse.

4.9 Social Media Links

Legal basis: consent (Article 6(1)(a) of the GDPR) and/or performance of a contract (Article 6(1)(b) of the GDPR).

Purpose: We process data from linked social media accounts solely to perform functions requested by the user, such as preparing, scheduling, or publishing content.

Automated content creation and artificial intelligence

Some of the content on our website is generated by Digital Employees: automated systems based on artificial intelligence (AI). It is important for you to know the following:

• Transparency and Editorial Oversight: Content that is generated entirely or largely by AI is identified as such where relevant and required by law. Publications on topics of public interest are reviewed by a human editor prior to publication and fall under the editorial responsibility of AIMAZE or the respective author.
• No personal data used as input: When generating content using AI, no personal data from visitors is used as input.
• No profiling: The AI systems do not use profiling data from individual visitors.
• Content Moderation: If AI systems are used for content moderation (such as filtering comments), this is done to protect our legitimate interests, and no automated individual decision-making takes place that has legal effects on data subjects within the meaning of Article 22 of the GDPR.

Retention Periods

We do not retain personal data for longer than is necessary for the purposes for which it was collected. The following retention periods apply:

• Technical log data (IP address, server logs): up to 6 months.
• Analytical data: up to 26 months (anonymized).
• Newsletter data: until consent is withdrawn, plus an administrative processing period of up to 30 days.
• Comment data: for as long as the content in question remains online, unless you request its removal earlier.
• Author Information: for the duration of the collaboration and for up to 2 years thereafter, unless statutory retention requirements mandate a longer period.
• Tax and accounting records: 7 years, in accordance with the statutory retention requirement.
• Customer accounts and platform users: for the duration of the agreement and for up to 2 years after its termination.
• Prospects and leads (demo requests): up to 1 year after the last point of contact.
• Support tickets and email communications: up to 2 years after the request has been resolved.
• Access tokens (social media): only as long as the connection is active. If the connection is terminated, these are immediately deleted.
• Consent logs: up to 5 years after consent is withdrawn, to comply with our legal accountability requirements.
• Backups: up to 30 to 90 days, after which they are automatically overwritten or deleted.

Sharing Data with Third Parties

We share personal data with third parties only when necessary for the purposes described in this policy, or when we are legally required to do so. This may include:

• Hosting providers: for the technical management and storage of the website and data.
• Analytics tools: such as Google Analytics (with IP anonymization enabled) or similar services.
• Email service providers: for sending newsletters.
• IT security services: for protection against cyberattacks and misuse.
• Government agencies: if we are legally required to do so.
• AI providers: for the provision of the underlying language models that power our Digital Employees.
• Social media platforms: for publishing content via linked accounts (such as Meta, LinkedIn, X).

We enter into a data processing agreement in accordance with Article 28 of the GDPR with all processors who process personal data on our behalf. We remain responsible for the processing of your personal data at all times.

Transfer outside the EEA

AIMAZE strives to process personal data within the European Economic Area (EEA) as much as possible. However, to ensure the optimal functioning of our platform and our Digital Employees, we use specialized third-party services that may process data outside the EEA.

8.1 Supplier Categories

This applies to the following categories of suppliers:

• Cloud and infrastructure providers: For hosting the platform and storing data (such as Microsoft Azure or Google Cloud).
• AI model providers: For content generation and the operation of digital employees (such as OpenAI).
• Social media platforms: For the links to Meta (Facebook, Instagram, and Threads), as described in Article 17.
• Analytics and marketing services: For measuring website usage and managing communications (such as Google Analytics or email service providers).

8.2 Safeguards for Data Transfer

If data is transferred to countries outside the EEA for which no adequacy decision has been issued by the European Commission, AIMAZE will ensure appropriate safeguards in accordance with Chapter V of the GDPR. We do this by:

• The conclusion of Standard Contractual Clauses (SCCs), as approved by the European Commission.
• Use suppliers that are certified under the EU-U.S. Data Privacy Framework, if applicable.
• Conducting a Data Transfer Impact Assessment (DTIA) where necessary to ensure that the level of protection of personal data is not compromised.

You can request information about the specific warranties we offer for each supplier by using our contact information.

Cookies and Tracking Technologies

AIMAZE uses cookies and similar technologies to ensure the website and platform function optimally and to analyze usage. We distinguish between the following categories:

9.1 Strictly Necessary Cookies

These are essential for basic functionality (such as logging in to the platform or security). No consent is required for these cookies.

9.2 Functional Cookies

These cookies store your preferences (such as language settings). We ask for your consent for these cookies, unless they are necessary for a service you have requested.

9.3 Analytical Cookies

These cookies are used to analyze and improve the use of the website. We place analytical cookies only after obtaining your explicit consent, unless they are configured to respect your privacy (for example, with IP anonymization and without sharing data with third parties).

9.4 Marketing and Tracking Cookies

These cookies are used to track your browsing behavior and display personalized ads. These cookies are placed only after you have given your explicit, prior consent via our cookie banner.

Protection of Personal Data

We take appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or alteration. These measures include, among other things:

• Encryption of data traffic via TLS/SSL (HTTPS).
• Restricting access to personal data based on the need-to-know principle.
• Regular security updates and patches for our systems.
• Backup procedures and disaster recovery plans.
• Awareness training for employees and columnists who have access to personal data.
• Implementation of Multi-Factor Authentication (MFA) for access to our systems.
• Comprehensive logging of access and platform usage to detect anomalies.
• Strict authorization management based on Role-Based Access Control (RBAC).
• Secure, encrypted storage of API keys and access tokens (token security).

Your Rights as a Data Subject

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Article 15 of the GDPR): You may request a list of the personal data we process about you.
• Right to rectification (Article 16 of the GDPR): You may request that inaccurate or incomplete data be corrected.
• Right to erasure (Article 17 of the GDPR): In certain cases, you may request that your personal data be deleted.
• Right to restriction of processing (Article 18 of the GDPR): You may request that the processing of your data be (temporarily) restricted.
• Right to data portability (Article 20 of the GDPR): You may request to receive your data in a structured, commonly used, and machine-readable format.
• Right to object (Article 21 of the GDPR): You may object to the processing of your data based on our legitimate interest.
• Right to withdraw consent: If the processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of the processing prior to the withdrawal.

To exercise your rights, you can submit a request via info@aimaze.nl. We will respond to your request within one month, in accordance with the statutory deadline. In complex cases, this period may be extended by two months, in which case we will notify you in a timely manner.

Please note: We reserve the right to refuse or restrict a request (in whole or in part) if there is a legal exception that allows us to do so, for example, when the processing is necessary for the establishment, exercise, or defense of a legal claim.

We may ask you to verify your identity before we process your request, to prevent personal data from being disclosed to the wrong person.

Right to File a Complaint

If you believe that we are not processing your personal data with due care or in accordance with the GDPR, you have the right to file a complaint with the Dutch Data Protection Authority (AP). This is the Dutch supervisory authority for data protection.

Contact Information for the Dutch Data Protection Authority:

We would appreciate it if you would contact us first so that we can work together to find a solution.

Minors

Our website is not specifically intended for individuals under the age of 16. We do not knowingly collect personal data from minors. If we discover that we have inadvertently collected data from a minor without valid consent from a parent or guardian, we will delete that data as soon as possible. If you suspect that we have collected data from a minor, please contact us.

Links to external websites

Our website may contain links to third-party websites. We are not responsible for the privacy policies or content of these external websites. We recommend that you review the privacy policies of these websites before providing any personal information to them.

Changes to This Privacy Policy

We reserve the right to modify this privacy policy. Changes will be published on this page, along with the date of the last update. In the event of significant changes that affect the way we process your personal data, we will actively inform you of these changes, for example, through a notice on the website or by email (if applicable).

We recommend that you review this privacy policy regularly so that you can stay informed of any changes.

Applicable Law

This Privacy Policy and all processing of personal data by AIMAZE are governed by Dutch law. Any disputes arising from or related to this Privacy Policy shall be submitted to the competent court in the Netherlands.

Integration with Meta (Facebook, Threads, and Instagram)

AIMAZE allows users to link their Facebook, Instagram, and/or Threads accounts to the AIMAZE platform. Through this link, a Digital Employee can—upon the user’s instruction or with the user’s pre-set consent—prepare, schedule, or publish content on the linked accounts.

As part of this integration, we may process the following data, among other things: user IDs, page or account IDs, basic profile information, account names, profile photos, access tokens, publishing permissions, scheduled content, publishing logs, and technical error messages.

We use this data solely to perform the requested integration and publishing functions, to secure the integration, to prevent misuse, and to provide technical support. AIMAZE does not post any content without a request, approval, or pre-set publishing instructions from the user.

The legal basis for this processing is consent and/or the performance of the agreement with the user or customer. Access tokens are retained only as long as the connection is active or as long as necessary for security, logging, or legal obligations.

The user can disconnect the account at any time through the account settings within AIMAZE or through the settings in Meta, Facebook, Instagram, or Threads. Once the connection is disconnected, access tokens are revoked or deleted.

To request the deletion of data, please contact us at info@aimaze.nl or use the AIMAZE data deletion form (https://aimaze.nl/data-deletion-form/). Meta acts as an independent data controller for its own platforms and services. Meta’s privacy policy applies to Meta’s processing activities.