Privacy statement

1. Who we are

NOutopia™ is a product of NOutopia B.V., located at Stoppelland 79, 7641 KN Wierden, the Netherlands, and registered with the Dutch Chamber of Commerce under number 42198176. In this statement we refer to NOutopia B.V. as ‘we’.

We are responsible for the personal data we process through our website noutopia.eu and in our contact with you and your organisation. That is the case when you fill in a form on the website, send us an email, request a trial account or when your organisation becomes a customer.

A different division of roles applies to the data your organisation enters in the NOutopia™ platform. Incidents, risks, documents and employee accounts belong to your organisation. Your organisation is the controller for that data and we are the processor: we process it only on your organisation's instructions and under the data processing agreement we conclude with every customer. This statement does not cover that data.

We have appointed a data protection officer (DPO), who monitors how we handle personal data. You can reach the DPO at privacy@noutopia.eu. Chapter 9 explains what you can ask of us.

2. Who this statement applies to

This statement applies to:

• visitors of noutopia.eu;
• anyone who contacts us through the contact form, by email or by phone, or who signs up for news about the launch;
• contact persons of organisations that request a trial account or are customers: the person who requests the account, signs the agreement or receives the invoices.

Do you use the platform as an employee of an organisation that is a customer? Then your organisation is responsible for your data in the platform, as chapter 1 explains. Questions about that data go to your own organisation; we help it answer them.

3. What data we process, why and on what basis

We only process data you give us yourself, and the technical data needed to keep the website secure. The table shows, per purpose, which data is involved, why we may process it and how long we keep it.

If you sign up for news about the launch, we first send you an email with a confirmation link. Only when you click that link are you on the list. This way we know for sure that the email address is yours and that you requested the messages yourself.

We do not ask you for special categories of personal data, such as health data. If you nevertheless include such data in an explanation, we use it only to answer your question and delete it afterwards.

We do not take decisions about you based solely on automated processing, and we do not profile visitors or contact persons.

4. How long we keep data

We do not keep data longer than necessary for the purpose for which we received it. The periods are listed in the table in chapter 3. Once the period has passed, we delete the data or anonymise it so that it can no longer be traced back to you.

Invoice details are subject to a statutory retention obligation of seven years. We keep that data for that long, but we only use it for the administration.

We make backups of our systems. Deleted data remains in them for another «four weeks» and then disappears automatically. We only use backups to restore data after a failure.

5. Who we share data with

We do not sell personal data and do not give it to others for their own purposes. We only share data with suppliers that help us deliver our services. We have concluded a data processing agreement with each of them, so that they process your data only for us and keep it secure.

In addition, «our accountant» sees invoice details for the administration. We only provide data to the government or a supervisory authority when the law obliges us to.

6. Transfers outside the European Economic Area

We choose suppliers that store and process your data within the European Union; the table in chapter 5 shows where that happens for each supplier. We do not transfer personal data to countries outside the European Economic Area.

Should that ever change, it will only happen with an appropriate safeguard, such as an adequacy decision of the European Commission or the European Union's standard contractual clauses, and we will update this statement before it happens.

7. Cookies

A cookie is a small file that a website places in your browser to remember something. Our website places one cookie.

A functional cookie does not require consent; that is why you do not see a cookie banner on our website. We use no analytics cookies, no marketing cookies and no third-party cookies. Should that change, we will update this statement and, where the law requires it, ask for your consent first.

Editors who log in to the website's management area receive a session cookie to stay logged in. Visitors do not receive that cookie.

You can always delete or block cookies through your browser settings. If you delete the language cookie, the website will choose the language again on your next visit based on your browser settings.

8. How we protect your data

We take the measures that fit the data we process:

• The connection to the website and the platform is encrypted (https), so that nobody can read along.
• Our systems are hosted by suppliers in the European Union, under European law.
• Access to systems and data is limited to the people who need it for their work«, with two-step verification».
• We make regular backups «and test whether we can restore data».
• For our own organisation we apply the standards we recommend to our customers, NEN 7510 and ISO 27001, as a guideline for our measures.

Should something nevertheless go wrong with your data, we report it to the Dutch Data Protection Authority where the law requires it, and to you if it poses a high risk to you.

9. Your rights

You have the right to:

• see which personal data we hold about you and what we use it for;
• have incorrect data corrected or completed;
• have data deleted, for example when we no longer need it or when you withdraw your consent;
• have processing restricted while we assess an objection or a correction;
• receive the data you gave us yourself in a common file format, to transfer it to someone else;
• object to processing based on our legitimate interest;
• withdraw consent you have given at any time. This does not affect what we were allowed to do before the withdrawal.

Send your request to privacy@noutopia.eu. To be sure we are dealing with the right person, we may ask you for additional information to identify yourself; we use it only for that purpose. You will receive a reply within one month. If a request is complex, we may extend that period by two months; we will let you know within the first month. There is no charge for a request.

Does your question concern data your organisation has entered in the platform? Then contact your organisation; it is responsible for that data and we help it answer you.

Not satisfied with how we handle your data or your request? Let us know and we will look for a solution together. You also always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

10. Changes to this statement

We update this statement when our services, our suppliers or the law change. The current version is always on this page; the version number and date are shown in the card at the top and in the table of changes below. If something changes that matters to you, such as a new purpose or a supplier outside the European Union, we inform our customers and the people on our mailing list by email before the change takes effect.