Privacy Policy

The Dutch version of this text is legally binding.

This privacy policy covers the data we process through our website and in the contact that results from it.

1. Introduction

Operium Solutions B.V., established at Verboomstraat 118B, 3082 JS Rotterdam, is responsible for the processing of personal data as described in this privacy policy. Operium builds AI-native software and automated workflows for Dutch small and medium-sized businesses.

We have not appointed a data protection officer; our organisation is not legally required to have one. For privacy questions, you can contact us at the email address above.

Are you our customer?

If we process data in the software or workflows we build or manage for your organisation, we do so on your instructions. Your organisation is then the controller and we are the processor. This privacy policy does not apply to that processing; the data processing agreement we have concluded with you does.

Was your data entered into our systems by one of our customers? Then please direct your request to that organisation. If we receive such a request directly, we will forward it.

2. Personal data we process

We process personal data because you visit our website, contact us or schedule an appointment.

• First and last name
• Email address
• Phone number
• Company name and job title
• The content of your message or enquiry
• Date, time and subject of a scheduled appointment
• Aggregated website statistics and technical server log data

Special categories and sensitive personal data

We do not process special categories of personal data (Article 9 GDPR) and ask that you do not provide them to us via the website or by email.

Our website is aimed at business users and is not intended to collect data about persons under 16. We cannot verify whether a visitor is over 16. If you are a parent or guardian and think we have collected data about your child without consent, please contact us and we will delete it.

3. Purposes and legal basis

For each purpose, the legal basis under Article 6 GDPR is given.

Contact and communication

Handling your contact request and calling or emailing you where necessary. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b)), or our legitimate interest in maintaining business contact (Art. 6(1)(f)). We keep demo and contact requests, with your name, company, email address and any phone number, to follow up on the request (at Resend as an unsubscribed contact, so without a newsletter), for the period given under 4 (contact requests without follow-up: 12 months after last contact).

Appointments and demos

Scheduling and confirming an appointment or demo. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b)).

Quotes and agreements

Preparing a quote, recording and performing an agreement, and invoicing and bookkeeping. Legal basis: performance of the contract (Art. 6(1)(b)) and, for bookkeeping, a legal obligation (Art. 6(1)(c)).

Commercial communication

Informing you about our services and developments. Legal basis: your consent (Art. 6(1)(a)), or our legitimate interest in direct marketing to existing customers and business relations (Art. 6(1)(f)), in accordance with Article 11.7 of the Dutch Telecommunications Act. Every commercial email contains a direct unsubscribe option.

Downloads and results by email

If you request a template or the result of a calculator, we use your email address to send you the file or the result. We do this with a link in an email: only when you confirm that link do you get the file or the result and do we subscribe you to the Operium newsletter (double confirmation). Until then your address, with what you requested, is held as an unsubscribed contact. Legal basis: your consent (Art. 6(1)(a)). If you do not confirm, you will not receive the newsletter. You can unsubscribe at any time via the link in every newsletter or by replying to an email from us. We use Resend as a processor to send the email and to store the address. We do not keep a result you have emailed to yourself; our internal notification only contains your address and the main result.

Website optimisation

Measuring visitor numbers and page views at an aggregated level. Legal basis: your consent (Art. 6(1)(a)). For this we use Google Analytics 4, which places cookies. Measurement only starts after you have accepted the Analytics category; if you refuse, nothing is loaded and nothing is measured. You can withdraw your consent at any time via Cookie settings at the bottom of every page. IP addresses are processed in truncated form.

Security and abuse prevention

Securing our website and preventing abuse of forms. Legal basis: legitimate interest in the security and availability of our systems (Art. 6(1)(f)).

Automated decision-making

We do not make decisions with legal effects, or similarly significant effects, that are based solely on automated processing (Article 22 GDPR).

4. How long we keep data

We do not keep your personal data longer than strictly necessary to achieve the purposes for which it is collected.

When the retention period ends, data is securely deleted or anonymised.

5. Sharing data with third parties

We only share data with third parties where necessary for our services or to comply with a legal obligation. We conclude a data processing agreement under Article 28 GDPR with all parties that process data on our behalf.

• Vercel Inc. — hosting of our website (processing in the EU, supplier established in the US)
• Microsoft Ireland Operations Ltd. — email, calendar and document storage (EU)
• Google Ireland Ltd. — website statistics via Google Analytics 4, only with your consent (EU, with transfer to the US under the EU-US Data Privacy Framework)
• Calendly LLC — scheduling appointments (US)
• Resend, Inc. — sending email, such as downloaded templates and results, and storing addresses for the newsletter (US)
• Our accountant or bookkeeper — for the financial administration
• Government bodies — where we are legally required to do so

We never sell your data to third parties.

Transfers outside the European Economic Area

Some of the parties above are established in the United States or process data there. Transfers take place only on the basis of a valid transfer mechanism: an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for parties certified under it, or the European Commission's standard contractual clauses, supplemented by an assessment of the transfer and appropriate additional measures. You can request a copy of the safeguards we apply via [email protected].

6. Cookies

Our website places necessary cookies and — only with your consent — analytics cookies from Google Analytics 4. On your first visit we ask for that consent through a cookie banner; you can change your choice at any time via "Cookie settings" at the bottom of every page. Exactly which cookies we place, for what purpose, by whom and for how long is set out in our cookie policy.

7. Your rights

You have the right to access, correct or delete your personal data. You also have the right to withdraw your consent or to object to the processing of your personal data.

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure (Art. 17)
• Right to restriction (Art. 18)
• Right to data portability (Art. 20)
• Right to object, and at any time to direct marketing (Art. 21)
• Right to withdraw consent, without affecting the lawfulness of processing before withdrawal (Art. 7(3))

How do you submit a request?

Send an email to [email protected] with a clear description of your request. To avoid handing data to the wrong person, we may ask you to verify your identity. We never ask for more data than necessary, and we expressly ask you not to send a copy of your identity document.

We respond within one month. If your request is complex or extensive, we may extend this period by up to two months. We will let you know in good time.

Filing a complaint

Do you disagree with the way we handle your data? Please contact us first. You also always have the right to lodge a complaint with the supervisory authority.

8. Data security

We take the protection of your data seriously and take appropriate measures to prevent misuse, loss, unauthorised access, unwanted disclosure and unauthorised alteration.

• Encrypted data transfer (TLS) and encrypted storage where appropriate
• Role-based access control and the principle of least privilege
• Multi-factor authentication on business accounts
• Logging and monitoring of system access
• Periodic backups and tested recovery procedures
• Confidentiality agreements with employees and third parties we engage
• Data processing agreements with all parties that process data on our behalf

Do you suspect a vulnerability or misuse? Report it via [email protected]. We treat reports confidentially and will get back to you about the follow-up.

9. Changes

We may amend this privacy policy from time to time to reflect changes to our website, services or legislation. For significant changes, we will actively inform the people concerned. This privacy policy was last updated on 23 August 2026.