Privacy policy

1. Who is responsible

Predictive Diligence B.V. develops VÖR and is responsible for the personal information used for the business activities described in this policy.

Address: Hereplein 4, 9711 GA Groningen, the Netherlands.
Privacy contact: privacy@predictivediligence.com.

You can also raise a privacy request by replying to your correspondence with us. We currently conduct product development, business development and fundraising. Processing of client case information on a client’s instructions requires separate client arrangements; this policy does not replace them.

2. Information we collect and why

Business relationships and fundraising

We process names, business contact details, organisations, roles, relevant professional information, correspondence and discussion notes to respond to enquiries, explore business and investment opportunities, arrange follow-up and maintain a record of our dealings.

Information comes directly from you, through introductions, or from LinkedIn and other public professional sources. When we contact you using information obtained elsewhere, we explain its source and the reason for contacting you. We use relevant information for our legitimate interests in developing and managing professional relationships, raising funding and documenting our business dealings.

Email and shared documents

Messages, attachments and shared files may contain information about you or other people. We use that information to handle the enquiry or matter, collaborate and keep necessary business records. Please avoid including personal information that is not needed for the discussion.

NDAs, agreements and signatures

We use PandaDoc to prepare, send and sign agreements, including non-disclosure agreements. The records include party and signatory details, agreement content, signatures and signing evidence. Depending on the signing process, this evidence includes document status, timestamps, email addresses and IP addresses. Completed documents are also sent by email and may be stored in OneDrive.

We use these records to administer the agreement, establish what was agreed and protect or enforce the relevant rights and obligations. Where you personally enter into a contract with us, we process information necessary to take steps you request before the contract or to perform it. Where you represent an organisation, we rely on our legitimate interests in administering the relationship and retaining necessary evidence. Signing an NDA does not give consent to marketing or optional presentation analytics.

Bookings and meetings

We use contact details, appointment information and booking answers to arrange meetings, send confirmations or reminders and prepare for the discussion. Our Microsoft Bookings form requests your organisation and role and offers optional questions about your interests and the workflow you would like to discuss. These uses support our legitimate interest in responding to meeting requests and managing business discussions. Where a booking form asks for consent, we use the submitted information within the purpose stated there.

Some Zoom meetings are recorded, transcribed or summarised using AI with participants’ permission. The resulting records can include names, voices, images, shared content, transcripts and summaries. They are stored in Zoom and may also be stored in OneDrive. Permission to record is separate from permission for an additional use of the material. You can decline recording or contact us to withdraw consent; withdrawal does not affect earlier lawful processing.

Business administration

Where relevant to our dealings, we process agreement, supplier, invoice, expense and payment information to administer the business. The basis is the applicable legal obligation for required accounting or corporate records, performance of a contract with you where necessary, or our legitimate interests in managing and evidencing the business relationship.

3. Website and presentation portals

Invitations, access and security

We use invitation contact details, access permissions, authentication and session records, successful sign-in times and relevant technical information to provide and protect access. An email address is required to receive a sign-in code. An access account may be created before your first sign-in. Authorised PD administrators manage invitations and access records.

The Brief Brief is no longer available for sign-in or new invitations. Existing Brief Brief records remain covered by this policy.

We rely on our legitimate interests in operating and securing the private presentation areas, preventing misuse and maintaining reliable access records. We use technical and security records to deliver the website, investigate failures and protect accounts.

Required film progress

We record the confirmed portion of the introduction film you have watched so you can resume it and so the presentation unlocks after the required viewing. Progress is linked to your access record and is visible to authorised administrators, who can reset it. We use it for our legitimate interest in providing the introduction and administering the presentation flow. This record is separate from optional viewing analytics and is still recorded if you decline those analytics.

Optional viewing analytics

With your consent, we record the slides you view, time spent and video playback, linked to your name and email address. Authorised administrators use these records to understand and improve our presentations. We do not use them to prioritise personal follow-up. Analytics are off until you opt in. Declining or withdrawing consent does not affect access.

Optional email updates

If you separately opt in, we record your permission to receive occasional email updates about Predictive Diligence. This choice is independent of analytics and access. Access messages are not marketing consent. Our current outreach is individual; we may introduce newsletters or campaigns using the appropriate permission and an unsubscribe option.

Change either choice through Privacy preferences in any presentation area. You can also request a privacy link to withdraw consent, even after your access ends, or contact privacy@predictivediligence.com. The link expires after 15 minutes and does not give access to a presentation. Withdrawal does not affect the lawfulness of processing before withdrawal.

Public website statistics

We use Amazon Web Services (AWS) CloudWatch RUM to understand how our public website is used and improve its content and routes to a demo. Reports count page views, film starts, playback milestones and completions, demo-link clicks, and clicks that open a booking calendar, email app or phone app. These clicks show interest; they do not confirm a completed booking, sent message or connected call.

Limited analytics are on by default. We rely on our legitimate interest in understanding and improving the website, with limits intended to keep the effect on visitors’ privacy small. You can turn analytics off below. We also stop collection when your browser sends Global Privacy Control or Do Not Track, or when we cannot reliably read and save the browser preference. Dismissing the notice does not give consent or change this setting.

Records contain a predefined public page name, interaction type and position, time and broad source category. For tagged marketing links, records can also include the source, marketing channel, campaign name and link variant. AWS also processes browser and operating-system names and versions, device and platform type, browser language and domain, and approximate location, including country, region and locality. Where the browser does not provide structured browser information, AWS receives its User-Agent string to identify the browser and operating system. Network requests involve your IP address, which AWS processes to receive the data and derive location information. Random temporary identifiers accompany these records. In your browser they are kept only in page memory; we do not use persistent visitor cookies or identifiers to recognise you across page loads.

To investigate problems playing the public film, we also record limited playback diagnostics: player interactions and play requests, whether playback starts, buffering stalls, predefined error and fallback categories, and approximate playback position, buffer length and timing. These records include the selected playback method and basic player state. We do not send raw error messages, media URLs or additional visitor identifiers for these diagnostics. They follow the same analytics choices and retention periods.

We use these records for aggregate website reporting, without linking them to portal accounts, names or email addresses. We do not collect form contents, full referring URLs, full query strings or URL fragments for this purpose. Other query parameters are ignored. Private presentations, sign-in, administrator and editor areas are excluded. Public-site statistics are separate from the optional, named presentation analytics described above.

Detailed RUM records are retained for 30 days. CloudWatch log copies are set to expire after 30 days; AWS’s final deletion may take longer. Aggregate counters are kept for up to 15 months. The analytics service is configured in AWS’s Frankfurt region, Germany. This does not guarantee that every service operation stays within the European Economic Area; the AWS processing and transfer arrangements described below also apply.

We save your analytics choice and notice dismissal in this browser’s local storage for up to one year. This stores a setting and expiry time, not a visitor identifier. Clearing that storage removes the saved setting. Turning analytics off prevents further collection; it does not undo records already submitted. You can contact us about those records using the rights and contact details below.

4. Cookies and similar technologies

Each presentation portal uses its own necessary session cookie. It contains a token that keeps your authorised session signed in.

__Host-pd-client-session

Site and client presentation access. Stored for up to seven days, shortened if your access expires sooner.

__Host-pd-investor-session

Investor presentation access. Stored for up to seven days; access may end sooner if your invitation expires or is revoked.

__Host-pd-brief-session

The Brief Brief presentation access. Stored for up to seven days, shortened if your access expires sooner.

These cookies use Secure, HttpOnly and SameSite protections. Signing out removes the relevant portal’s session cookie. Blocking it prevents that signed-in access from working. During the transition to these names, an existing session may still use __Host-pd-site-session or pd_investor_session until it expires, is replaced or you sign out.

Privacy choices are stored on the server. Opting in to analytics or email updates does not add a separate consent or analytics cookie. Consented analytics send viewing events from your browser using the signed-in session. Administrator and editor tools have separate authentication cookies and editing-related browser storage.

External booking, signing and meeting services use their own cookies and storage. For example, Microsoft Bookings uses cookies and browser storage for its service when you open the booking page. Those services provide additional information in their own privacy and cookie notices.

5. AI-assisted business work

We use ChatGPT Business or AWS Bedrock for business assistance involving material such as documents and correspondence. Inputs and outputs can contain personal information relevant to the task. Zoom may also generate meeting summaries where that feature is used with permission.

The purpose and legal basis follow the underlying activity described above. Using an AI tool does not create a separate permission to reuse your information for unrelated purposes. AI-generated information can be inaccurate; you can contact us to correct personal information in our records. Retention and processing locations depend on the service, model and configuration.

6. Providers, recipients and international processing

Personal information is currently handled within PD by its founders. We use service providers for the activities below. Intended correspondents and agreement counterparties also receive the messages or documents sent to them.

Amazon Web Services

Website and portal hosting, authentication, access and privacy emails, protected content, database records, public website analytics, and security services; AWS Bedrock for business AI tasks.

Microsoft

Email, calendar, Bookings and OneDrive document storage. Microsoft Entra supports administrator sign-in.

PandaDoc

Agreement preparation, electronic signing, completed copies and signing evidence.

Zoom

Meetings and enabled recording, transcription and AI-summary features.

OpenAI

ChatGPT Business for business AI assistance.

Providers and their subprocessors process the information involved in the relevant service. Some providers also process service or account information for their own purposes under their privacy notices. We may disclose relevant information where required by law or necessary for an identified legal claim.

Portal account, consent and viewing records are stored in AWS’s Frankfurt region, Germany. Our Microsoft 365 tenant reports EU/EFTA storage geography for its core email and file services. These storage locations do not mean every service operation stays within the European Economic Area: global content delivery, AI services, subprocessors and support can involve other countries, including the United States.

Our providers’ data-processing terms describe their international-transfer arrangements, including European Commission Standard Contractual Clauses where applicable. You can consult the AWS DPA, Microsoft DPA, PandaDoc DPA, Zoom data-protection information and OpenAI DPA. Contact us for information about the safeguards relevant to your information or a copy of the applicable safeguards.

7. How long we keep information

Retention depends on the purpose, continuing obligations and necessary evidence. The business-record periods below are our retention limits, not a requirement to keep every item until the limit. Information should be removed earlier when it is no longer needed and there is no other valid reason to retain it.

Business contacts

During an active relationship and up to five years after the last substantive interaction. An automated email or moving a record into a different system does not restart that period.

Substantive correspondence and checked meeting records

During the relevant relationship or matter and up to seven years after it closes, where needed to document negotiations, commitments or decisions. Routine scheduling and duplicate working material are kept only while needed for the task and its follow-up.

Agreements and signing evidence

While relevant contractual obligations continue and up to seven years after they end. An ongoing confidentiality obligation can require longer retention of the NDA and necessary signing evidence.

Meeting recordings and full transcripts

Up to twelve months after the meeting where continued reference is needed, with earlier deletion when a checked summary meets the purpose.

Financial and corporate records

For the period required by the applicable legal duty. Core Dutch tax records generally have a seven-year requirement; some records have a different period or starting point.

AI working material

While needed for the task and necessary checking. Selected business records follow the appropriate category above. Provider deletion and residual retention depend on the service and its applicable terms.

For public website statistics, detailed records are retained for 30 days and aggregate counters for up to 15 months. See Public website statistics for browser preferences and the full retention details.

Portal records

Detailed viewing analytics are retained for 90 days, then excluded from use and automatically deleted. Physical deletion may take a few additional days. Withdrawing analytics consent stops further collection and initiates deletion of your detailed viewing records.

We automatically delete a portal account, its sign-in identity, contact details, invitation provenance, delivery status and film-progress records after one year without a successful sign-in to that portal. If the account has never been used, the year starts when it is created. Extending access does not restart this period. Deleting any portal account resets optional analytics and email-update permissions across all presentation areas; any other portal account keeps its own access and film progress.

We keep current privacy choices while needed to respect your access and permissions. We keep minimal consent and withdrawal evidence while relied on, then for one year after it is superseded or the relevant permission ends. Historical evidence does not itself authorise further updates or analytics. Routine application logs are kept for 30 days; authentication challenges and privacy links have shorter lifetimes.

Exceptions, requests and copies

We retain the information needed to handle a privacy request through its completion and any related complaint. Limited objection or suppression information may remain necessary to prevent unwanted contact. Specific records may be kept longer for a continuing obligation, statutory requirement or identified legal claim, limited to that purpose.

Retention also concerns copies in email, document storage and the originating services. Deleted information may remain in restricted backup or recovery systems until it expires under the applicable recovery cycle. Backup retention does not authorise renewed routine use.

8. Your rights and choices

Contact privacy@predictivediligence.com to request access, correction, deletion, restriction of processing or data portability where applicable, or to raise a privacy concern. Portability applies where its legal conditions are met, including automated processing based on consent or a contract.

You can object to processing based on legitimate interests because of your particular situation. You can object to direct marketing at any time, including related profiling. We will then stop using your information for that marketing.

Where we rely on consent, you can withdraw it without affecting the lawfulness of processing before withdrawal. Use Privacy preferences for portal analytics and email-update permissions, or contact us for other requests.

We normally respond within one month. If a permitted extension is needed, we explain it within that month. We may ask for proportionate information to confirm your identity. Where a right is limited by a legal exception or a record must be retained, we explain the reason.

You may complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or the competent supervisory authority where you live or work or where an alleged infringement occurred.

9. Information you need to provide

We need an email address for portal access and sufficient contact information to respond to you or arrange a meeting. Agreement and signatory details are needed to enter into and evidence an agreement. If necessary information is not supplied, we may be unable to complete that activity. Optional booking answers, analytics and email-update consent are not conditions of portal access. Recording permission is a separate choice.

10. Changes and new activities

We may introduce a CRM, newsletters, pilots and client services as the business develops. We update the relevant information and obtain any permission required before a new use begins. New systems do not, by themselves, extend the purpose or retention of information already collected.

Applicants, employees and contractors receive information appropriate to their relationship with us. Client case processing is addressed in the applicable service and data-processing arrangements. This policy does not provide blanket permission for future processing.

The date above identifies the current version. We provide further notice where a material change affects how your information is used.