Privacy Policy

Last updated: 8 September 2026

This privacy statement explains which personal data Cloud ClinIQ B.V. (hereinafter "we", "us" or "Cloud ClinIQ") processes when we act as data controller, for which purposes, on which legal basis, and how long we retain it. It also explains your rights and how to exercise them.

1. Who are we?

We are the data controller for the processing activities described in this statement. Our details:

Name: Cloud ClinIQ B.V.
Address: Vondellaan 42-B, 3521 GH, Utrecht
Chamber of Commerce: 90297431

We have appointed a Data Protection Officer (DPO). You can reach the DPO at jcbijvoets@avg-compleet.nl. For any privacy questions or to exercise your rights, you can contact the DPO.

2. What data do we process and why?

Below we describe, by topic, which personal data we process, for what purpose, on what legal basis, and how long we retain it.

2.1 Client and contract administration

Whose data: Contact persons at our clients.
What data: Name, business email address, phone number, job title, company name, billing details and the signed agreement.
Purpose: Managing the client relationship, entering into and maintaining agreements and invoicing.
Legal basis: Necessary to perform our agreement with you; retention of invoices and contracts is based on our legal obligation to keep them for tax purposes.
Retention period: Invoices and contracts: 7 years (statutory tax retention). Other correspondence: up to 1 year after the contract ends.

2.2 Enquiries from prospective clients

Whose data: Prospective clients and other interested parties who contact us, for example through the contact or demo request form on our website.
What data: Name, business email address, phone number, company name and the content of the enquiry.
Purpose: Responding to your enquiry, providing information about our services and, where requested, arranging a demo or quote.
Legal basis: Steps taken at your request prior to entering into an agreement and our legitimate interest in responding to enquiries and following up on them.
Retention period: Up to 12 months after the last contact if no client relationship results, unless you ask us to delete your data sooner.

2.3 Customer support

Whose data: Contact persons and end users at our clients who submit a support or service request.
What data: Name, business email address, job function and the content of the support request.
Purpose: Handling support and service requests.
Legal basis: Performance of the agreement.
Retention period: Support correspondence: up to 12 months after the request has been resolved.

2.4 Logging of login attempts (security)

Whose data: Staff, contractors, clients' users, and anyone who makes a login attempt on the platform.
What data: Username and IP address (with the time and result of the login attempt).
Purpose: Security: detecting repeated failed login attempts (protection against brute-force attacks) and being able to investigate or reconstruct possible security incidents.
Legal basis: Legitimate interest: network and information security. The logs are not actively monitored but are retained to allow incidents to be investigated.
Retention period: 6 months.

3. Special categories of personal data

For the processing activities for which we are the data controller, we do not, in principle, process special categories of personal data. The only exception is that a support request (see 2.3) may incidentally contain special categories of personal data if a user includes it. We expressly ask users not to do this and delete such data as soon as the request has been handled.

4. Who do we share data with?

We do not sell your data. We do engage service providers (processors) who process data on our behalf. We enter into data processing agreements with these parties. They fall into the following categories:

Storage and email (cloud and office software)
Accounting and invoicing
Digital signing of documents
Customer support and internal collaboration
Hosting of the platform and related infrastructure

In addition, we may share data with the bank (for payments) and with authorities where we are legally required to do so.

5. Transfers outside the European Economic Area (EEA)

Some of the service providers mentioned above process data (potentially) outside the EEA, in particular in the United States. For those transfers we ensure appropriate safeguards, such as the Standard Contractual Clauses adopted by the European Commission and, where applicable, the EU-U.S. Data Privacy Framework. You can request a copy of these safeguards via the email address in section 1.

6. How do we secure your data?

We take appropriate technical and organisational measures to protect your data against loss and unauthorised access, including:

Access control and role-based authorisation
Encryption of data in transit (TLS)
Data processing agreements with our service providers
Storage within secured infrastructure

7. Your rights

Under the GDPR you have the following rights regarding your personal data:

Access to know what data we process about you;
Rectification to have inaccurate data corrected;
Erasure to have your data deleted, insofar as no retention obligation or other compelling interest applies;
Restriction to have processing temporarily suspended;
Objection to object to processing based on legitimate interest;
Portability to receive your data in a common format or have it transferred.

You can submit a request via the email address in section 1. We respond within one month. To prevent misuse, we may ask you to identify yourself.

8. Complaints

If you have a complaint about how we handle your data, please contact us first. You also have the right to lodge a complaint with the supervisory authority, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). More information and the complaints procedure can be found at autoriteitpersoonsgegevens.nl.

9. Third-party services on this website

To offer this website we rely on a small number of external service providers. Each of them processes only what is needed for the purpose listed below. Where a provider processes personal data outside the European Economic Area, the safeguard is named in the same row.

Service	Purpose	Data processed	Location	Legal basis / safeguard
Cookiebot (Cybot A/S)	Consent management platform (CMP) that stores and enforces your cookie choices	Consent record, anonymised IP, user agent	European Economic Area (Denmark)	Necessary — legitimate interest (Art. 6(1)(f) GDPR)
Google Analytics 4 (Google Ireland Ltd.)	Aggregated, anonymised measurement of site usage	GA client-ID cookie, page paths, anonymised IP address, referrer	European Union (primary) with onward transfer to the United States	Consent (Art. 6(1)(a) GDPR); EU Standard Contractual Clauses; EU-U.S. Data Privacy Framework (Google LLC certified)
Amazon Web Services — CloudFront & S3 (AWS EMEA SARL)	Global delivery and hosting of website pages, images and fonts	Request metadata (IP, URL, user agent) needed to serve the page	European Economic Area (Frankfurt) with edge caching within the EEA where possible	Necessary for the performance of the service (Art. 6(1)(f) GDPR)
Amazon Web Services — RDS PostgreSQL	Storing demo-request submissions from the contact form	All fields you submit (name, email, phone, company, message)	European Economic Area (Frankfurt)	Necessary to take steps at your request prior to entering into an agreement (Art. 6(1)(b) GDPR)
Amazon Web Services — Simple Email Service (SES)	Delivering the internal notification email that follows a demo request	The email you submit and the message body	European Economic Area (Frankfurt)	Necessary to respond to your enquiry (Art. 6(1)(b) GDPR)

Non-essential services (currently only Google Analytics) load only after you grant consent in the cookie dialog. Denying or withdrawing consent stops them and clears their cookies from your browser.

10. Cookies

Our website uses cookies and similar techniques. When you first visit the site, our consent management platform (CMP) asks for your choices regarding non-essential cookies (such as analytics or marketing cookies). Strictly necessary cookies, which are required for the site to function, are placed without consent; non-essential cookies are placed only after you have given consent.

Through the CMP you can view at any time which cookies are set, for what purpose and for how long. Because this overview is kept up to date there, we do not repeat the full list of cookies in this statement.

11. Changes

We may update this privacy statement from time to time. The most recent version is always available from us. The date at the top of this statement indicates when it was last changed.