1. Who is responsible
This privacy statement describes how Anonimize processes personal data for its own purposes: on the website anonimize.eu, in your account on the platform and for payment, support and communication. Anonimize is the controller for that processing.
Digital Change Management Services BV (Anonimize)
Galgestraat 109, 3300 Tienen, Belgium
Enterprise number 0798.754.517
info@anonimize.eu
For questions about this statement or about your data, you can always contact info@anonimize.eu.
2. Documents you have processed
For the content of documents and texts that customers have processed through the platform, Anonimize acts as a processor on behalf of the customer. That processing is governed by the data processing agreement, not by this privacy statement. If such a document concerns you, please contact the organisation that had it processed.
Anonimize does not use document content for its own purposes or to train AI models. Anonimize never sells information.
3. Data, purposes and legal bases
Website
The website sets no cookies. For visitor statistics we use Plausible Analytics. Plausible uses your IP address and browser data only to calculate a daily changing, irreversible visitor code and does not store them. We only see aggregated figures, such as the pages visited and referring websites. With every visit, the hosting processes technical connection data, such as your IP address, to deliver and secure the pages. Legal basis: our legitimate interest in a secure website and in understanding how it is used (Article 6(1)(f) GDPR).
Account and use of the platform
For your account we process your name, email address, password (only as an irreversible hash), the name of your organisation and workspaces, your role, your language, your settings and, if you add one, your profile picture. For signing in we process session data and, if you use two-step verification, the data it requires. Legal basis: the performance of the contract (Article 6(1)(b) GDPR).
Security and misuse
To secure the platform, we process technical data such as IP addresses in the hosting access logs, sign-in attempts (stored under an unreadable derivative of the IP address) and events in the audit log. At registration, Cloudflare Turnstile checks that a human is filling in the form. For this, Cloudflare processes data including your IP address and browser data. Legal basis: our legitimate interest in a secure service (Article 6(1)(f) GDPR).
Subscription, payment and invoicing
For a subscription we process your billing details (name, company, address, country, email address and VAT number), the chosen plan, the subscription status and credit usage. Payments are handled by Stripe. With Stripe Managed Payments, Link, a company of the Stripe group, acts as the seller. Stripe and Link then process your payment details as independent controllers. Anonimize does not receive full card details. If, as a business customer with a Belgian VAT number, you choose an invoice via Peppol, Anonimize issues that invoice with Billit. Legal basis: the performance of the contract and our legal accounting and tax obligations (Article 6(1)(b) and (c) GDPR).
Support and messages
If you send us a message through the support function in the app or by email, we process your message, your contact details and the further conversation. Support conversations in the app are stored encrypted. Our mailbox runs on Microsoft 365. We also send you messages that belong to your account or subscription, such as the acknowledgement of a withdrawal. Legal basis: the performance of the contract and our legitimate interest in good support (Article 6(1)(b) and (f) GDPR).
Acceptance and withdrawal
We keep a record of who accepted the terms and conditions and the data processing agreement on behalf of an organisation, with name, email address, organisation, version and time. For a withdrawal, we keep the statement with name, email address, subscription and time. Legal basis: our legal obligations and our legitimate interest in being able to prove the agreements (Article 6(1)(c) and (f) GDPR).
API use
When the API is used, we record for each request the time, the method, the route, the status code, the duration and the API key used. This serves usage overviews, support and the prevention of misuse. Legal basis: the performance of the contract and our legitimate interest in a reliable API (Article 6(1)(b) and (f) GDPR).
4. Recipients
We share personal data only with service providers we need for the service, under agreements on confidentiality and data protection.
- Zerops s.r.o. (Czech Republic): hosting of the website and the platform in Prague.
- Plausible Insights OÜ (Estonia): visitor statistics for the website, without cookies.
- Cloudflare (United States): the security check at registration.
- Stripe and Link: payment, tax handling and, with Managed Payments, the sale.
- Billit (Belgium): invoices via Peppol for business customers.
- Microsoft (Ireland): email via Microsoft 365.
We also disclose data where the law requires us to, for example to the tax authorities. Anonimize never sells information.
5. Transfers outside the EEA
Cloudflare, Stripe and Microsoft may also process data in the United States. Those transfers rely on the EU-U.S. Data Privacy Framework, in which these companies participate, or on the standard contractual clauses of the European Commission. Zerops, Plausible and Billit process the data in the EEA.
6. Retention periods
- Sessions: up to twelve hours after signing in.
- Sign-in attempts for preventing misuse: fifteen minutes.
- Data on API requests: ninety days.
- Account, organisation and support data: for as long as the account exists. You can request deletion via info@anonimize.eu.
- Acceptances and withdrawals: for as long as the organisation has an account.
- Invoices and accounting records: ten years, as Belgian accounting law requires.
- Technical hosting logs: for as long as needed for security and troubleshooting, under the retention periods of Zerops.
- Backups: the daily database backup for seven days. In addition, Zerops keeps at least seven daily, four weekly and three monthly backups of the storage volume, up to a maximum of fifty. Deleted data only disappear from the backups when those expire.
7. Your rights
You have the right to access your personal data and to rectification, erasure, restriction of processing and portability. You can object to processing based on our legitimate interest. Send your request to info@anonimize.eu. We reply within one month and may ask you to confirm your identity.
We do not take decisions about you based solely on automated processing and do not create profiles.
The export register sets out which data you can export yourself and which we provide on request.
If you disagree with how we handle your data, you can lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels, https://www.dataprotectionauthority.be, or with the supervisory authority in the country where you live or work.
9. Security
We protect data with measures including encryption at rest and in transit, hashed passwords, two-step verification and strict access rights. More information is on the Security page.
10. Changes
We update this privacy statement when our processing changes. The date at the top shows the latest version. We inform customers in advance of important changes.