Privacy & Cookies

Kwantor B.V., having its registered office at Kampenringweg 45 D, 2803PE Gouda, Netherlands, is the data controller for the processing described in this Privacy Policy. For questions about your personal data, contact us at info@kwantor.com. If you have a complaint regarding our processing, you may lodge it with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Kwantor (“we”, “us”, or “our”) is committed to protecting the privacy of our users. The term “users” covers partner customers and direct customers. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our software-as-a-service ("SaaS"). By using our SaaS, you agree to the collection and use of your personal information in accordance with this Privacy Policy.

Our SaaS includes an AI assistant for the purpose of better user experience, assisting you with drafting and reviewing documents. By using our AI assistant, you agree to the terms and conditions and privacy policy of the model provided at the moment of use. For more details on what this means for processing of your information that you submit to the AI assistant, please turn to Section 4.

1. Our roles and responsibility

Whether Kwantor is the data controller or a data processor depends on which personal data we process and why.

1.1 When Kwantor is the controller

This Privacy Policy applies when Kwantor determines the purposes and means of processing personal data. This is the case for account, communication, technical and usage data described in Section 2.

1.2 When Kwantor is a processor

Our SaaS allows our users (natural persons and legal entities that subscribe to our SaaS, the "Subscriber") to upload, generate and manage documents, and configurate software system. These documents, and the input and output of the AI assistant when used in the context of a Subscriber's account (together, the "Content"), may contain personal data of the Subscriber's founders, employees, advisors or other individuals.

We process Content as a data processor on behalf of the Subscriber. This Privacy Policy governs processing of data. Any requests relating to personal data included in Content should be directed to the relevant Subscriber. If we receive such a request, we will forward it to the Subscriber.

1.3 Other websites

Our SaaS may contain links to third-party websites. This Privacy Policy applies only to www.kwantor.com and the SaaS operated by Kwantor, not to third-party websites accessible from our SaaS. Third-parties have their own privacy policies and if needed, please consult them individually.

2. Information collection

2.1 Information you provide to us

We collect personal information that you provide to us when you use our SaaS, or otherwise interact with us. This may include your name and email address.

Depending on how you use our SaaS, this may also include:

• Account credentials and role or job title;
• Your employer or organisation and billing contact details where you are responsible for billing;
• Information you provide when you contact us for support, feedback or sales enquiries;
• Information you provide if you subscribe to our newsletter, request a demo, attend an event or respond to a survey;
• Prompts and documents you submit to the AI assistant. Where these are submitted as part of a Subscriber's account, we process them as a processor (see Section 1.2).

2.2 Information we automatically collect

We may also collect technical data, such as your IP address, browser type, device information, and usage data, when you use our SaaS. This information helps us understand how our SaaS is being used and allows us to improve our services.

2.3 Information from third parties

We may receive personal information about you from third parties, such as:

• Your employer or the Subscriber, who may provide your contact details so we can create an account for you;
• Service providers we use for fraud prevention or identity verification;
• Publicly available sources, such as the Chamber of Commerce (Kamer van Koophandel), LinkedIn or company websites, when we use these for prospecting and sales.

2.4 Sensitive personal data

Our SaaS is not designed to process special categories of personal data (such as health data, data revealing racial or ethnic origin, or biometric data). We ask that you not to submit such data to our SaaS or to the AI assistant.

3. Use of information

We use the personal information we collect to:

• Provide, maintain, and improve our SaaS;
• Communicate with you, such as providing customer support, sending important notices, and marketing our products and services;
• Analyze and understand usage patterns to improve our SaaS;
• Protect the security and integrity of our SaaS and our users' information;
• Comply with applicable laws and regulations.

The personal data collected is used entirely for the purposes listed above. Kwantor does not analyse your data further and does not sell your data to other parties.

4. The AI assistant and third-party sub-processors

Our SaaS includes an AI assistant which is built on third-party large language models. When you submit a prompt or document to the AI assistant:

• Your input is transmitted from our SaaS to third-party API;
• Third-party processes the input on its infrastructure and returns a response, which we display to you in the SaaS;
• We log that a request was made (including timestamp, account identifier and metadata) for operational purposes. We do not store the substance of your prompts and the AI responses beyond what is required to display them to you and to deliver the document workflow you initiated, unless you choose to save the resulting document to your account.

Our SaaS includes an optional AI assistant which is available to users for better user experience. Prior to using the AI assistant, the user will be informed about the identity of the applicable AI model provider. The applicable AI model provider acts as our sub-processor in respect of inputs and outputs of the AI assistant. We use the provider's API under the provider's terms and conditions, which govern our relationship with the provider in respect of the processing of data when using the AI assistant. For your security, we do not allow our sub-processor to retain any data after processing.

5. Information sharing

We may share your personal information with third-parties in the following circumstances:

• With service providers that help us operate our SaaS, such as payment processors, hosting providers, and customer support providers;
• In response to legal requests, such as court orders or subpoenas, to comply with our legal obligations;
• To protect our rights, property, or safety, or the rights, property, or safety of our users or others;
• In connection with a sale, merger, or acquisition involving our business;
• With your consent or as otherwise disclosed to you at the time of collection.

5.1 Our service providers and sub-processors

The service providers we currently use include, in particular:

• Cloud infrastructure and hosting: applicable provider for hosting our SaaS, primarily within the EU/EEA;
• AI model provider: applicable provider used by the AI assistant;
• Email and communications: applicable provider for transactional and marketing emails;
• Customer support: applicable provider for managing support requests;
• Analytics: applicable provider for measuring usage of our website and SaaS;
• Payment processing: applicable provider for processing subscription payments;
• Electronic signing: applicable provider for capturing electronic signatures on documents.

These providers process personal data on our behalf and under our instructions, on the basis of a data processing agreement. A current list of our sub-processors is available on request via info@kwantor.com.

5.2 Other users

If you collaborate with colleagues on the SaaS, certain actions you take (such as comments, edits and shared documents) will be visible to other users from the same Subscriber. Visibility to other Subscribers depends on the settings configured by your organisation.

6. Data retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

In particular:

• Account data: for the duration of your account and for a reasonable period following closure to handle any outstanding matters and to comply with legal obligations;
• Content processed as a processor: in accordance with the Subscriber Agreement and our data processing agreement with the Subscriber;
• AI assistant inputs and outputs: kept only as long as needed to deliver the response and any resulting document workflow, unless you save the document to your account;
• Communication and support data: typically up to 24 months after the last interaction, unless we are required to keep it for longer;
• Billing and tax records: at least 7 years from the end of the relevant financial year, as required by Dutch tax law;
• Marketing data: until you object or withdraw your consent, and a short period thereafter to confirm the opt-out;
• Technical logs: as long as needed for security and troubleshooting purposes.

When we no longer need your personal information, we will delete it or anonymise it. If deletion is not immediately possible (for example, because the data is stored in backup archives), we will isolate the data from further processing until deletion is possible.

7. International transfers

Your personal information may be transferred to, stored in, and processed in countries other than the country in which you reside. By using our SaaS, you consent to the transfer of your personal information to countries outside your country of residence, which may have different data protection laws.

We host the SaaS primarily within the European Economic Area (EEA). However, some of our service providers may process personal data outside the EEA.

Where personal data is transferred outside the EEA to a country that has not received an adequacy decision from the European Commission, we put in place appropriate safeguards required by GDPR, which may include:

• The EU Standard Contractual Clauses approved by the European Commission, supplemented by additional technical and organisational measures where necessary following a transfer impact assessment; or
• Other safeguards permitted under Chapter V of the GDPR.

8. Data security

We take reasonable measures to protect your personal information from unauthorized access, use, or disclosure. However, no method of data transmission or storage is fully secure, and we cannot guarantee the absolute security of your personal information.

Our measures include:

• Encryption of personal data in transit and at rest using industry-standard algorithms;
• Role-based access controls and the principle of least privilege for our staff;
• Logging and monitoring of access to personal data;
• Confidentiality obligations for our staff and contractors;
• Data processing agreements with our service providers.

9. Your rights

You may have certain rights under applicable data protection laws, such as the right to access, correct, or delete your personal information, or to object to or restrict our processing of your personal information. To exercise these rights, please contact us at info@kwantor.com.

In particular, under the GDPR you have:

• The right of access: to request confirmation of whether we process personal data about you and a copy of that data.
• The right to rectification: to ask us to correct inaccurate or incomplete personal data about you.
• The right to erasure: to ask us to delete personal data about you. We may not be able to honour this request where we have a legal obligation or a compelling legitimate interest to retain the data.
• The right to restriction: to ask us to restrict our processing of your personal data in certain circumstances.
• The right to object: to processing based on our legitimate interests, including direct marketing. If you object to direct marketing, we will stop using your personal data for that purpose.
• The right to data portability: to receive personal data that we process based on your consent or a contract with you in a structured, commonly used and machine-readable format.
• The right to withdraw consent: where we rely on your consent. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• The right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or another competent supervisory authority.

We may need to verify your identity before responding to your request. We will reply within one month of receipt; this period may be extended by two further months if your request is complex or if we receive several requests from you.

If your personal data is included in Content uploaded by a Subscriber, please direct your request to that Subscriber (see Section 1.2).

10. Automated decision-making and the AI assistant

We do not make decisions that produce legal effects on you, or similarly significantly affect you, based solely on automated processing.

The AI assistant generates draft text and analysis based on inputs you provide. The output is intended to support, not replace, human judgment. You and the Subscriber remain responsible for reviewing AI-generated content before relying on it or using it in a legal document.

11. Cookies

11.1 What are cookies?

Cookies are small text files that are placed on your computer or device by websites you visit. They are widely used to make websites work more efficiently and provide a better user experience, as well as to provide information to the website owner.

11.2 Types of cookies we use

We may use the following types of cookies on our website and service:

• Essential cookies: Necessary for the proper functioning of our website and service.
• Analytical/performance cookies: Help us understand how users interact with our website and service.
• Functionality cookies: Remember choices you make, such as language or region.

You can manage your cookie preferences via the cookie banner on our website and through your browser settings. Refusing non-essential cookies may limit some features of our SaaS.

12. Updates to this Privacy Policy

We may occasionally update this Privacy Policy. In case of an update, we will post the updated version on our website and update the "Last updated" date at the top. If the changes are material, we will notify you by email or through the SaaS before the changes take effect. Your continued use of the SaaS after the changes take effect constitutes acceptance of the updated Privacy Policy.

13. Contact us

If you have any questions or concerns about this Privacy Policy or our processing of your personal data, please contact us at:

Kwantor B.V., Kampenringweg 45 D, 2803PE Gouda, Netherlands

Email: info@kwantor.com