EXENZO takes the protection of your personal data seriously. This privacy statement explains which personal data we process, why we do so, and how we keep your data safe. We act in accordance with the General Data Protection Regulation (GDPR).
1. Who we are
EXENZO is the data controller for the processing of personal data described in this privacy statement.
Contact details:
- Company name: EXENZO
- Address: Willemstraat 11a, 4811 AH Breda, the Netherlands
- Chamber of Commerce number: 58240691
- Email: support@exenzo.com
- Website: exenzo.com
2. Which personal data do we process?
We process the following categories of personal data, depending on the service you use or the contact you have with us:
- First and last name
- Company name and role
- Address details
- Phone number
- Email address
- IP address and device information (when visiting the website)
- Information about your use of our services
- Communication between you and EXENZO (emails, support tickets)
- Invoice and payment details
- Other information you actively share with us
3. What do we use your personal data for?
We process your personal data for the following purposes:
- Performing agreements and delivering our services
- Maintaining contact and answering questions
- Sending quotes, invoices, and other administrative messages
- Improving our services and website
- Meeting legal obligations (such as tax retention)
- Securing our systems and preventing abuse
- Marketing activities, only with your consent or on the basis of existing client relationships
4. On what legal basis do we process your data?
We process your personal data only on one of the legal bases set out in Article 6 GDPR:
- Performance of a contract: when needed to deliver our service to you.
- Legal obligation: for instance, for our administration and tax filings.
- Legitimate interest: for matters such as security, fraud prevention, and improving our services.
- Consent: when you have explicitly given consent, for instance for the newsletter. You can withdraw this consent at any time.
For the visitor statistics of exenzo.com we rely on legitimate interest. Google Analytics 4 counts on every visit how many people come and which pages they read. Our interest is that we want to know what works on this site, and the intrusion stays limited to a number without your name or email address. If you refuse the cookies, the count keeps running but nothing is stored on your device: our own server reports the page view to Google, with your IP address, your browser type, and a number we calculate ourselves that changes every night. We only use the measurement for advertising purposes if you accept the cookies.
You may object to that count, and you do not have to give a reason. Our cookie statement has a button that switches it off. From that click on, our server skips your visits and the Google script no longer loads either, in the browser you click in. If you prefer to do it in writing, email support@exenzo.com with your objection. We reply within four weeks, confirm your objection, and help you switch the count off on your other devices. For PostHog and the session recordings we ask for consent up front, because that measurement goes further than counting.
5. How long do we keep your data?
We do not keep your personal data longer than strictly necessary for the purposes for which it was collected:
- Customer data and correspondence: up to 2 years after the end of the client relationship
- Administrative and financial data: 7 years (tax retention obligation)
- Website visit data: up to 12 months
- Application data: up to 4 weeks after the procedure ends, unless you consent to a longer period (max. 1 year)
6. Sharing with third parties
EXENZO does not sell your data to third parties. We only share your data with parties that help us deliver our services, such as:
- Hosting providers and cloud vendors
- Accounting and payment software
- Email and communication services
- IT service providers and subcontractors
- PostHog, for product analytics and session recordings of your website visit, on servers in the European Union
- Google, for Google Analytics 4, which we use to measure which ads bring in visits
PostHog and Google are the only two external parties that receive data about your visit to exenzo.com. Google Analytics starts on every visit. If you have refused, the Google script does not load in your browser and our own server forwards the page view instead. PostHog loads only after you accept the cookies. What PostHog sees: which pages you view, where you click, your IP address, and a recording of your visit. Whatever you type into an input field is masked and does not end up in that recording. We keep visit data and recordings for up to 12 months.
One processing activity is separate from your cookie choice. When you request a trial, a check-in, or a quickscan through a form, our own server sends that request to PostHog, along with your email address and a few details about the request. This happens even if you refused the cookies, because it is part of handling your request. Our cookie statement sets out exactly what goes along with it.
We enter into data processing agreements with these parties to safeguard the protection of personal data. We only share data with third parties when necessary for our services or when legally required.
We process your data in principle within the European Economic Area (EEA). PostHog runs on European servers. Google Analytics 4 is the exception: that data goes to Google and may end up outside the EEA. For transfers outside the EEA we put appropriate safeguards in place in accordance with the GDPR.
7. Security
We take appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, and other unlawful processing. These include encryption, access controls, regular backups, and security updates. If you suspect that your data is not properly secured or that there are indications of abuse, please contact us at support@exenzo.com.
8. Cookies
Our website uses cookies. You can find more details in our cookie statement.
9. Your rights
Under the GDPR you have a number of rights in relation to your personal data:
- Right of access: you can request which data we hold about you.
- Right to rectification: you can have incorrect data corrected.
- Right to erasure ("right to be forgotten"): under certain conditions you can request erasure.
- Right to restriction of processing: you can request temporary suspension.
- Right to data portability: you can request your data in a common format.
- Right to object: to processing based on legitimate interest or direct marketing.
- Right to withdraw consent: when processing is based on consent.
You can submit a request via support@exenzo.com. We respond in principle within four weeks. To make sure the request was made by you, we may ask you to identify yourself.
10. Filing a complaint
If you have a complaint about how we handle your personal data, please contact us first at support@exenzo.com so we can work towards a solution together. You also have the right to file a complaint with the Dutch Data Protection Authority at autoriteitpersoonsgegevens.nl.
11. Changes
EXENZO reserves the right to amend this privacy statement. Changes are published on this page, with the date on which the change takes effect. We recommend reviewing this page regularly.
Contact
For questions about this privacy statement or the processing of your personal data, please contact us at support@exenzo.com.