EchoChat Privacy Policy

About our privacy policy

EchoChat (a product of Echovise B.V.) places the highest value on your privacy and data integrity. Because we offer a business AI platform, our care goes beyond personal data alone; we also protect your business-sensitive information. We only process data that is necessary for the operation and improvement of our services.

This privacy policy applies to the use of the website and the services of EchoChat (by Echovise B.V.) made available on it. This privacy policy describes what information about you we collect, what this information is used for, and with whom and under what conditions this information is shared. We also explain how we use your data, how we protect your data against misuse, and what rights you have with regard to the information you provide. If you have any questions about our privacy policy, you can contact our privacy contact person. You will find the contact details at the end of our privacy policy.

We handle your personal data in accordance with the General Data Protection Regulation (GDPR) (the "Relevant Legislation").

Personal data

We process personal data to provide our website and services. The term "personal data" means information by which you can be identified as a person. This definition is in accordance with the Relevant Legislation.

Your consent

We may collect your information at various times, such as when you visit our website, create an account on EchoChat, use our services, or when you contact us. We may process your data because we ask for your consent through this privacy policy. In addition, we need your data to perform the agreement between you and us. If you choose not to share your information, we cannot provide our services to you. Furthermore, we will not process your data without your consent, unless we are legally required to do so.

Under 16 years of age

If you are under 16 years of age, you need the consent of a parent or legal guardian to use our website and services.

Summary of the data we collect

To use our website and services, we need at least the following information from you:

• Your email address
• Password
• Your name
• Your IP address

Depending on your use, we may additionally collect, among other things, the following data: organization name, billing details (with a paid subscription), and data you voluntarily provide when contacting us or in your profile.

We also collect some data from you that is not directly personal when you use our website, such as:

• The name of the browser you use
• The operating system you use
• The internet provider through which you access the internet

Visibility of data within your organization

If you use EchoChat as a member of an organization, the administrator (admin) of that organization can view certain account and session data about you, including the IP address from which you have logged in. This information is, for example, visible in the security overview of active sessions, so that administrators can identify suspicious activity and end sessions. In that case, the administrator is the data controller for the use of this data within the organization.

Email contact

Automated emails are sent, for example, to confirm your account creation or to reset your password. Our services use external parties for this. These parties collect your name and email address on our behalf, but do not use your email address for their own purposes.

We use the services of Google Workspace for our regular business email traffic. This party has taken appropriate technical and organizational measures to prevent misuse, loss, and corruption of your and our data as much as possible. Google Workspace has no access to our inbox and we treat all our email traffic confidentially.

Security

We are committed to protecting your personal information against loss, destruction, use, modification, or distribution by unauthorized persons. This means that those who have nothing to do with your data have no access to it. We do this through the following measures:

• Encryption of digital files containing personal data
• Securing network connections with Secure Socket Layer (SSL) or an equivalent technology
• Access to the data is limited to the persons who need the data
• Confidentiality declarations by employees and data backups
• Strong password policy

Retention period

We do not retain your personal data longer than necessary for the purposes described above.

To avoid retaining data longer than necessary, we delete accounts that have never been used. An account is considered never used when, after registration, no further login has taken place, no credits have been used, and no content (such as conversations or files) has been created. If an account has been in this state for more than 90 days, we may permanently delete the account and its associated data. We send a warning by email in advance to the address known for the account, stating the deletion date. By logging in once before that date, you keep your account and the deletion is cancelled. Accounts with an active or paid subscription are not deleted on this basis.

Who do we share your personal data with?

It happens that other parties receive your data from us. We agree with these parties in a processing agreement that they handle your data carefully and they only receive the data necessary to provide their service. These parties only use your data in accordance with the instructions we give and not for their own purposes. We may pass on your data to the following parties: Google Workspace (email), Supabase (authentication and storage), Stripe (payments), and the email service we use for account and transactional messages. They provide for the storage of the data, the security of the data, and the execution of parts of our services. These parties are "processors" within the meaning of the Relevant Legislation.

Transfer

We will preferably process your data within the European Union. Outside the European Union, we only process your data if that country offers an appropriate level of protection for your data. Without your consent, we will never transfer your data to other countries or to other parties than those mentioned above, unless we are legally required to do so.

Links

Our website may contain links to other websites. We are not responsible for the content or privacy protection of these websites. We therefore recommend that you always read the privacy policy of the relevant website.

Cookies

A cookie is a small text file that is sent from a website's server to the browser. The browser then stores the file on your device. Your device is given a unique number, with which our site recognizes the device again later. We may use cookies to improve your experience on our website. Cookies also ensure that the website is fast, that you can visit our website securely, and that we can detect errors on our website. By storing cookies, we ensure, among other things, that:

• you stay logged in and can use our services without interruption
• you use our services securely
• the website is fast
• we can detect errors and inconveniences on the website
• we can test improvements

You can always delete or disable cookies yourself via the browser settings. Cookies will then no longer be stored when you visit our website. Please note: without cookies, our website may work less well.

Purpose of data processing

General purpose of processing

We use your data exclusively for our services. This means that the purpose of the processing is always directly related to the assignment you provide. We do not use your data for (targeted) marketing. Your data is not shared with third parties, other than to comply with accounting and other administrative obligations. These third parties are all bound by confidentiality on the basis of the agreement between them and us or an oath or legal obligation.

Automatically collected data

Data that is automatically collected by our website is processed with the aim of further improving our services. This information (e.g. web browser and operating system) is not personal information.

Cooperation in tax and criminal investigations

If necessary, Echovise B.V. may be legally required to share your data in connection with tax or criminal investigations by the government. In such a case, we are obliged to share your data, but we will resist such requests within the limits of the law.

Changes to the privacy policy

We may amend this privacy policy. If we significantly change the privacy policy, we will post a notice on our website together with the new privacy policy. We will notify users who are registered with us by their email address of any changes. If you are not registered as a user, we recommend that you consult the website and this statement regularly.

Your rights

The information we collect from you is personal. You therefore have the following rights:

• You may ask us for access to your data;
• You may ask us to correct, restrict, or delete your data. In case of fraud, non-payment, or other unlawful acts, we may keep some of your data in a register or on a blacklist;
• You may ask us for a copy of your data. We can also pass on this copy to another party at your request, so that you no longer have to do this yourself;
• You can object to the processing of your data;
• You can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) if you think we process your data unlawfully;
• You can always withdraw your consent for the processing of your data. From the moment you withdraw consent, we may no longer process any of your data.

If you have any questions or requests regarding our privacy policy, please contact:

Stefan van Gijsel
[email protected]