Privacy policy.

02Information we collect

Depending on how you use our services, we may collect the following personal data:

Contact information

Name, email address, phone number.

Billing information

Payment details, invoicing address.

Usage data

Interactions with our services, including IP address, browser type and usage patterns.

Client data

Data you share with us during consulting engagements or through our tools (such as datasets, email content and project details).

03Legal basis for processing

We process your personal data on the following legal bases:

Consent

Where you have given clear consent (for example, signing up for a newsletter).

Contractual necessity

To fulfil our contract with you (for example, delivering our services).

Legitimate interests

To improve our services, ensure security and better understand how our services are used.

Processing on behalf of clients

For Elmtrail Gaia, we act exclusively on the documented instructions of our client (the data controller), as set out in our Data Processing Agreements (DPAs).

04Cookies and tracking technologies

Our website and some of our services may use cookies or similar tracking technologies in the future (for example, for analytics or feature improvements). We will update this policy to reflect specific cookie use as it is implemented.

You can manage or refuse cookies in your browser settings. Some features may not work as intended if cookies are disabled.

05How we use your data

We use your personal data to:

• Provide and improve our products and services.
• Communicate with you about our services, updates or support.
• Process payments and manage billing.
• Analyse service usage and improve security.
• Comply with legal obligations.

06Data sharing and subprocessors

We may engage trusted third-party service providers (subprocessors) to help us deliver our services (for example, cloud hosting, analytics or AI platforms). We keep an up-to-date list of these subprocessors, available on request.

Where personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place (such as Standard Contractual Clauses), in line with the GDPR.

07Data retention

We keep personal data only as long as necessary for the purposes described in this policy, or as required by law. When your data is no longer needed, it is securely deleted or anonymised.

08Security measures

We take the security of your personal data seriously. Elmtrail B.V. implements appropriate technical and organisational measures to protect your data against unauthorised access, loss, misuse or disclosure. These measures include:

• Application and data security

  Passwords are hashed with bcrypt. Email activation uses expiring, encrypted tokens. All connections are forced over HTTPS. Sessions expire after periods of inactivity, and all cookies are set as secure. Sensitive data and credentials are encrypted in transit and at rest, and application secrets are managed with Rails credentials.

• Infrastructure and hosting

  The application is hosted on Hetzner servers in Germany, certified under ISO/IEC 27001 for information security management. Servers are firewalled to block all non-essential ports. Cloudflare’s Web Application Firewall (WAF) is enabled with OWASP rules and managed threat blocks.

• Development and operations

  We use static code analysis and code reviews in development. Dependencies are updated monthly, with automated vulnerability scanning (bundler-audit, Dependabot). Only the company founders have access to user data. Backups run nightly and restores are tested, with a recovery time of up to one day.

• Privacy, compliance and incident response

  We delete data manually on request, as the GDPR requires. This privacy policy is public. If we detect a data breach affecting user data, we notify affected users by email within 72 hours, in line with GDPR guidelines. We only use certified, reputable third-party providers.

We apply security updates continuously, and review and improve our security practices as technology advances.

09Your rights

Under the GDPR, you have the right to:

• Access your personal data.
• Correct or update inaccurate data.
• Request deletion of your data.
• Object to or restrict the processing of your data.
• Data portability: receive your data in a usable format.
• Withdraw consent at any time, where processing is based on consent.

If you have concerns about how we handle your data, you can also contact the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): autoriteitpersoonsgegevens.nl

10Changes to this policy

We may update this privacy policy from time to time and will post updates on our website. We recommend checking it regularly to stay informed about how we protect your data.

11Contact us

Questions about this privacy policy or your data? Contact us at:

Company

Elmtrail B.V.

Address

Delfgaauwstraat 5 A, 3037 LE Rotterdam, the Netherlands

Email

[email protected]

Website

elmtrail.com