Last updated: [date of approval]
1. Who we are
The Kolekt Investment Optimizer is operated by [Legal name of the company, e.g. "… B.V."], registered with the Dutch Chamber of Commerce under number [Chamber of Commerce (KvK) number], located at [Registered address], the Netherlands ("Kolekt", "we", "us"). We are the controller of the personal data described here. For any question about your data, or to use one of your rights, write to info@kolekt.com.
2. What we collect and why
| Data | Why we use it | Legal basis |
|---|---|---|
| Your account: name, e-mail address, organisation and a password, which we only store as a one-way hash. | To create your account, let you sign in and contact you about it. | Contract |
| Six-digit codes we send to confirm your address or reset your password, and how many times a code was tried. | To check that the address is yours and to stop codes being guessed. | Contract; legitimate interest (security) |
| Your optimisation runs: the country, the question, the budget, targets and other settings you enter, the name you give a run, and its results. | To provide the optimizer and keep your run history. | Contract |
| For administrators: which data files were imported or changed, by whom and when. | To keep a record of where the country data behind every run came from. | Legitimate interest |
| Technical data: IP address, browser type and the time of a request. | To keep the service running and secure, and to block abuse such as repeated sign-in attempts. | Legitimate interest |
We do not sell your data, and we do not use it for advertising.
3. Who receives your data
| Recipient | What for |
|---|---|
| Microsoft (Azure), [region] | Hosting of the application and its database. |
| Twilio SendGrid | Sending the e-mails with verification and reset codes. |
| Google Fonts | Your browser loads the Poppins typeface from Google, which receives your IP address with that request. |
4. Transfers outside the EEA
SendGrid and Google may process data in the United States. Those transfers rely on [the EU-U.S. Data Privacy Framework / standard contractual clauses].
5. How long we keep it
- Your account and your runs: until you ask us to delete the account; a run you delete yourself is gone at once.
- Codes: until used or replaced; they stop working after 15 minutes.
- The record of data imports: [period].
- Technical logs: [period].
6. Your rights
You may ask for access to your data, correction, deletion, restriction, a copy in a portable form, and object to processing based on legitimate interest. Write to info@kolekt.com. You may also complain to the Dutch data protection authority (Autoriteit Persoonsgegevens) or the authority where you live.
7. Security
Connections are encrypted, passwords are stored as one-way hashes, sessions expire, and sign-in, code checks and e-mails are rate-limited.
8. Changes to this policy
When this policy changes, the date at the top changes with it; for a significant change we tell you by e-mail.