Last updated: [date of approval]
1. Who we are
The Kolekt EPR Wizard is operated by [Legal name of the company, e.g. "… B.V."], registered with the Dutch Chamber of Commerce under number [Chamber of Commerce (KvK) number], located at [Registered address], the Netherlands ("Kolekt", "we", "us"). We are the controller of the personal data described here. For any question about your data, or to use one of your rights, write to info@kolekt.com.
2. What we collect and why
| Data | Why we use it | Legal basis |
|---|---|---|
| Your account: name, e-mail address, organisation and a password, which we only store as a one-way hash. That you accepted the Terms of Use, and when. | To create your account, let you sign in and contact you about it. | Contract |
| Six-digit codes we send to confirm your address or reset your password, and how many times a code was tried. | To check that the address is yours and to stop codes being guessed. | Contract; legitimate interest (security) |
| Your scenarios: the country, the options chosen, the settings you give them and the people you share them with. | To provide the Wizard. | Contract |
| Requests for access to a country's documents, with any message you add, and Kolekt's decision. | To decide who may use country content, and to keep a record of it. | Contract; legitimate interest |
| A record of every document generated: who, when, which scenario, which version of the country content and from which IP address. | To protect the country content: each document carries your name and a unique reference that leads back to this record. | Legitimate interest |
| Technical data: IP address, browser type and the time of a request. | To keep the service running and secure, and to block abuse such as repeated sign-in attempts. | Legitimate interest |
We do not sell your data, and we do not use it for advertising.
3. Who receives your data
| Recipient | What for |
|---|---|
| Microsoft (Azure), [region] | Hosting of the application and its database. |
| Twilio SendGrid | Sending the e-mails with codes, invitations and access decisions. |
| Google Fonts | Your browser loads the Poppins typeface from Google, which receives your IP address with that request. |
| People you share a scenario with | They see that scenario, and your name as its owner. |
4. Transfers outside the EEA
SendGrid and Google may process data in the United States. Those transfers rely on [the EU-U.S. Data Privacy Framework / standard contractual clauses].
5. How long we keep it
- Your account and scenarios: until you ask us to delete the account.
- Codes: until used or replaced; they stop working after 15 minutes.
- The record of generated documents: [period].
- Technical logs: [period].
6. Your rights
You may ask for access to your data, correction, deletion, restriction, a copy in a portable form, and object to processing based on legitimate interest. Write to info@kolekt.com. You may also complain to the Dutch data protection authority (Autoriteit Persoonsgegevens) or the authority where you live.
7. Security
Connections are encrypted, passwords are stored as one-way hashes, sessions expire, and sign-in, code checks and e-mails are rate-limited.
8. Changes to this policy
When this policy changes, the date at the top changes with it; for a significant change we tell you by e-mail.