TelMaar privacy statement

1. Who we are

AGENTICA, established at Langeland 18, 2548 WE The Hague, registered with the Dutch Chamber of Commerce under number 94577056, is the controller for the personal data processed within TelMaar.

2. Purposes of processing

We process personal data solely for the following purposes:

• Keeping the financial administration (bookkeeping, bank transactions, journal entries).
• Invoicing: drawing up, sending and collecting quotes and invoices.
• Customer relationship management: maintaining the customer and supplier file, correspondence and tasks.
• Complying with legal obligations, including tax and administrative retention duties.

3. Legal basis

Processing is based on one or more of the following legal bases under the GDPR:

• Performance of a contract (article 6(1)(b) GDPR), such as delivering a product or service.
• Legal obligation (article 6(1)(c) GDPR), such as the statutory retention duty for tax purposes.
• Legitimate interest (article 6(1)(f) GDPR), such as maintaining the customer relationship and preventing fraud.

4. Categories of personal data

Depending on the relation, we may process the following data:

• Name and address details, email address(es) and telephone number(s) of contact persons.
• Position or role within the organisation of the relation.
• Company details such as Chamber of Commerce and VAT numbers, insofar as these are traceable to a natural person, for example in the case of sole traders.
• Financial data relating to quotes, invoices and payments (amounts, payment status, IBAN in the case of manual payment).
• Notes, activities and tasks linked to the file of the relation.
• Login details of customer portal users (email address, session data).

In the mobile app we also process: photos of receipts and signatures on work orders (the text of a receipt is read on the phone itself), and a device code for notifications. Fingerprint and face recognition stay on the device; we never receive them. The app does not use location, contacts or any analytics or advertising software.

5. Retention periods

Personal data is kept no longer than necessary for the purpose of the processing, taking statutory retention duties into account. For the financial administration (invoices, quotes, entries and underlying supporting documents) a statutory retention period for tax purposes of 7 years applies in the Netherlands. This data is retained for that period, including after an erasure request by the data subject (see article 6).

Other personal data not covered by the retention duty is deleted or anonymised as soon as it is no longer necessary, or earlier at the request of the data subject.

When someone closes their account, it is locked immediately. After 30 days the name, email address, phone number and login details are permanently deleted; the company's administration remains subject to the retention obligation above. Encrypted backups are kept for 7 to 30 days, so data disappears from them no later than 30 days after that. How to delete your account is explained at telmaar.nl/account-verwijderen.

6. Rights of data subjects

Under the GDPR, data subjects have the following rights:

• The right of access to the personal data processed about them.
• The right to rectification of inaccurate or incomplete data.
• The right to erasure (the “right to be forgotten”), within the limits of the statutory retention duty: personal data outside the financial administration is deleted or anonymised; data that forms part of the financial administration is retained until the end of the statutory retention period but is no longer used for other purposes.
• The right to restriction of processing and the right to object.
• The right to data portability, insofar as applicable.
• The right to lodge a complaint with the Dutch Data Protection Authority.

A request can be submitted using the contact details under article 11. We respond within the statutory period of one month.

7. Sub-processors

To provide our services we use the following sub-processors, which may process personal data on our behalf:

• Supabase: database, authentication and file storage.
• Vercel: hosting and execution of the application.
• Resend: sending transactional email.
• Stripe: processing online payments.
• Mollie: processing online payments, including iDEAL.
• Cloudflare: security, DNS and content delivery (CDN).
• Anthropic: processing the questions and documents submitted through the assistant (see article 9).
• Sentry: collecting error reports from the application so that failures are noticed. IBAN, email address, VAT number and phone number are stripped out before a report is sent.
• Expo, Google (Firebase Cloud Messaging) and Apple (Push Notification service): delivering notifications to the phone: a device code and the text of the notification.
• Google (ML Kit): reading the text on a receipt. This happens on the phone itself, the photo is not sent to Google. ML Kit does send data about the device, the app version and the processing speed to Google, for diagnostics and usage statistics.
• Mapbox: showing a small map for an address in the web application.
• overheid.io: looking up company details in the Dutch Business Register by Chamber of Commerce number or name.
• postcode.tech: completing an address from postcode and house number.
• Peppol network: looking up a contact's e-invoicing address in the public Peppol registries.
• Google (Analytics) and Microsoft (Clarity): only with the consent of a visitor to telmaar.nl: statistics about the use of the website (see article 10).

Appropriate arrangements on the protection of personal data have been made with every sub-processor, laid down in a data processing agreement where applicable.

8. Transfers outside the European Economic Area

Our processing takes place within the EEA in principle. A number of the sub-processors listed in article 7 are established in the United States or may provide support from there. Insofar as personal data is processed outside the EEA in that context, this takes place on the basis of an adequacy decision of the European Commission (including the EU-US Data Privacy Framework) or on the basis of the standard contractual clauses (SCCs), supplemented by appropriate technical measures such as encryption in transit and at rest.

9. Customers in the United Arab Emirates

If your business operates from the United Arab Emirates, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) applies in addition to the above.

Where your data is held. Your administration is held on servers in the European Union (Frankfurt, Germany). That is a transfer outside the United Arab Emirates. We make that transfer because it is necessary to perform our agreement with you, and because the European Union maintains a level of protection at least equivalent to that of the PDPL.

Your rights. You have the right of access, correction, erasure, restriction of processing, portability of your data, and objection to automated processing. You exercise those rights through the address in article 12.

Complaints. If you disagree with how we handle your data, you can lodge a complaint with the UAE Data Office.

Retention. We retain tax records for as long as UAE law requires: five years after the end of the tax period for VAT, and fifteen years for records relating to real estate.

10. Assistant and automated decision-making

TelMaar includes an assistant that answers questions in plain language, reads receipts and invoices, and proposes bookings and planning. For that purpose the question asked and the data or documents concerned are processed by Anthropic. The assistant is available only to users with a financial role; other users have no access to it.

The assistant only makes proposals. A booking, invoice or payment is created only after a user confirms it. There is therefore no decision-making based solely on automated processing that produces legal effects or similarly significantly affects the data subject, as referred to in article 22 GDPR. The data submitted is not used to train third-party models.

11. Visitors to our website and cookies

Anyone who visits telmaar.nl without logging in leaves only the data technically needed to display the page. Without consent we only place necessary and functional cookies. If a visitor gives consent, we also use analytical cookies from Google Analytics and Microsoft Clarity to see how the website is used; that consent can be withdrawn at any time. We do not use advertising cookies. Exactly which cookies these are, for what purpose and how long they are kept is set out in our cookie statement.

If someone completes the contact form, we process the name, email address, any company name and the message provided in order to answer that question. The basis is our legitimate interest in being able to respond to messages. These messages arrive in our email environment and are not used for unsolicited advertising.

12. Security and contact

We take appropriate technical and organisational measures to protect personal data against loss or unlawful processing. For details, see our data processing agreement.

For questions about this privacy statement or to exercise your rights, you can contact us:

• Email: privacy@telmaar.nl
• AGENTICA, established at Langeland 18, 2548 WE The Hague, Chamber of Commerce number 94577056, VAT number NL005093484B44.

13. Changes

We may amend this privacy statement from time to time. The most recent version is always available on this page.