GDPR compliance

We apply the principles of Article 5 GDPR to all personal data we handle:

• Lawfulness, fairness and transparency: we only process data on a valid legal basis and tell people how we use it.
• Purpose limitation: data collected for one purpose is not reused for an unrelated one.
• Data minimisation: we collect only what we need.
• Accuracy: we correct or delete inaccurate data when we become aware of it.
• Storage limitation: we keep data no longer than necessary.
• Integrity and confidentiality: we protect data against loss and unauthorised access.
• Accountability: we can show how we meet these principles.

As a controller, we decide how and why personal data is processed. This covers website enquiries, contact details of clients and prospects, correspondence, proposals, contracts and invoicing.

As a processor, we process personal data on behalf of our clients. During PLM, ALM and SAP engagements we may have access to client systems that contain personal data, such as user accounts, approval histories or engineering change records. In those cases we act only on the client's documented instructions, under a data processing agreement (verwerkersovereenkomst) as required by Article 28 GDPR, and we do not use that data for any purpose of our own.

As a controller we rely on the following bases under Article 6 GDPR:

• Contract: to prepare proposals at your request and to deliver agreed services.
• Legitimate interests: to answer business enquiries and keep our website secure, where those interests are not outweighed by your rights.
• Legal obligation: to keep financial records as Dutch tax law requires.
• Consent: only where we ask for it explicitly. Consent can be withdrawn at any time.

Under the GDPR you have the right to:

• access the personal data we hold about you (Article 15);
• have inaccurate data corrected (Article 16);
• have your data erased (Article 17);
• restrict processing (Article 18);
• receive your data in a portable format (Article 20);
• object to processing based on legitimate interests (Article 21);
• withdraw consent at any time, without affecting earlier processing;
• lodge a complaint with the Autoriteit Persoonsgegevens, the Dutch data protection authority.

We do not make decisions about you based solely on automated processing or profiling.

We take technical and organisational measures appropriate to the risk, as Article 32 GDPR requires, including:

• HTTPS encryption for this website and the contact form;
• access to personal data limited to the people who need it;
• confidentiality obligations for everyone working on client engagements;
• working inside client-controlled environments where possible, rather than copying client data to our own systems;
• returning or deleting client data at the end of an engagement, as agreed in the data processing agreement.

We aim to keep personal data within the European Economic Area. Some of our service providers may process data outside the EEA. Where that happens, the transfer is protected by an adequacy decision such as the EU-US Data Privacy Framework, or by the European Commission's Standard Contractual Clauses.

We keep personal data only as long as needed for the purpose it was collected for. Enquiries that do not lead to an engagement are deleted within two years. Contract and invoicing records are kept for seven years to meet Dutch tax obligations. Client data we process as a processor is kept only for the duration of the engagement, unless the client instructs otherwise.

We use a small number of service providers who process personal data on our behalf, each bound by data processing terms:

• Vercel: website hosting;
• Web3Forms: delivery of contact-form submissions;
• our email provider: business email.

We do not use analytics, advertising or marketing-automation tools on this website.

When we design integrations, migrations and automation for clients, we consider data protection from the start, in line with Article 25 GDPR. That means moving only the data a process needs, keeping access rights aligned with roles, and flagging personal data in migration and integration scopes so the client can decide how it is handled.

If a personal data breach occurs, we assess it immediately. Where required, we report it to the Autoriteit Persoonsgegevens within 72 hours (Article 33) and inform affected individuals without undue delay when the breach is likely to pose a high risk to them (Article 34). When we act as a processor, we notify the client without undue delay so they can meet their own obligations.

Given the nature and scale of our processing, we are not required to appoint a Data Protection Officer under Article 37 GDPR. Data protection questions are handled directly by our management at contact@dnaitlabs.com.

Send your request to contact@dnaitlabs.com with “GDPR request” in the subject line. We may ask you to confirm your identity before acting on it. We respond within one month; for complex requests this can be extended by two further months, in which case we will tell you why.

DnA IT Labs
Stijging 8, 5629 TZ Eindhoven
The Netherlands
KVK 76432017
contact@dnaitlabs.com