Privacy policy.

How does Sebsoft handle your data?

We process your data for our services and business operations. This means:

• We do not sell your data.
• We only share your data with third parties where this is needed for our services, for example with the service providers described below, or where the law requires it.
• We only use your data to keep you informed about developments at Sebsoft and its services if you have given your consent or where the law otherwise allows it.
• We use the data for our financial administration.
• We collect anonymised usage data to improve our technical infrastructure.

Sebsoft is a Dutch company, and our hosting platforms run in European data centres. For some parts of our own operations, such as our phone assistant and calendar, we use external service providers that may process data outside Europe. See Calling Joris, our AI phone assistant.

Privacy statement

Sebsoft B.V. is the controller for the personal data we process for our own services and business operations, such as invoicing, contact with you and contract management. For these purposes we collect the following types of data from you (the data subject):

Individuals: Name, address, email address, telephone number, bank details.

Businesses: Company name, Chamber of Commerce number, VAT number, address, contact person, email address, telephone number, bank details.

When customers process personal data in Moodle environments that we host for them, we generally act as a processor on their behalf for that data, and the customer decides why and how it is processed. For questions or requests about that data, it is best to contact that organisation.

Why do we need it?

We need your personal data to provide the services you have requested, including invoicing, domain registration, SSL certificate verification, and incident response.

What do we do with it?

Your personal data is processed at Sebsoft B.V. in Halsteren, the Netherlands. Hosting and storage on our own platforms take place in one or more data centres used by us within Western Europe. For some parts of our operations we use external service providers, which may process data outside Europe as described below.

For our phone assistant, we also explain below what its provider says in its product information about possible use of data to improve its service.

How long do we keep it?

Records covered by a statutory retention obligation, such as our financial and tax records, are kept for as long as the law requires; for tax records this is generally 7 years. We keep other personal data for as long as it is relevant to the purpose for which we received it, such as performing a contract or dealing with your question. For calls with our phone assistant, see Calling Joris. If we use your data for marketing communications, we keep it for that purpose until you withdraw your consent, object or tell us you no longer wish to receive such information.

Calling Joris, our AI phone assistant

When you call Sebsoft, your call may be answered by Joris, an AI phone assistant that runs on services from an external provider. At the start of the call, Joris tells you that you are speaking to an AI assistant. If you would rather not speak to an AI assistant, you can email us at helpdesk@sebsoft.nl.

What we process and why. Joris processes your voice and a text version of what you say, your name and phone number if you give them, the number you are calling from, the time and length of the call and, if you book an appointment, the details needed for it. We use this to answer your question, follow it up and schedule appointments. You do not have to give us your details, but without a name or phone number we may not be able to call you back.

After the call. If your call needs follow-up, Joris writes a summary. It is added to our internal contact and case records and may also be logged in our self-hosted CRM. If you book an appointment, it is passed via Sebsoft Meet, our appointment scheduler, to our calendar. We work with the summary and the appointment details; audio and transcripts are not added to our own records.

Service providers and transfers. For Joris we use external service providers for telephony, speech recognition and AI processing, and a calendar service for appointments. According to the public product information of the phone assistant's provider, pseudonymised speech data may be used to improve the service. Pseudonymised data is not anonymous: it is still personal data. Your data may also be processed outside the European Economic Area, for example in the United States. The GDPR only allows such transfers under its conditions, for example on the basis of an adequacy decision by the European Commission or with standard contractual clauses.

Legal basis. If you, as an individual, are yourself a party to a contract with Sebsoft, or are taking concrete steps at your own request towards entering into one, for example by asking for a quote or booking an appointment, we process the data from your call under Article 6(1)(b) GDPR, insofar as this is necessary for that contract or those steps. If you call on behalf of a business customer or prospect, including about a quote, an assignment, an existing contract or an appointment, we generally rely on our legitimate interest in being easy to reach and following up on business questions and assignments (Article 6(1)(f) GDPR). The same applies to other questions and introductory calls. On that basis we process no more than that interest requires, and you can object to this processing.

Retention. The provider of the phone assistant may temporarily hold audio and transcripts. According to its product information, this data is deleted or anonymised once it is no longer needed.

We keep follow-up summaries and appointments for as long as they are needed for your question, any commitments made and our business contact with you. They help us see which questions and appointments came before when you contact us again.

You can ask to see, correct or delete this data, or object to its use, by emailing privacy@sebsoft.nl. If you ask to see your data, we will also tell you which recipients have received it. We assess each request individually; we may need to keep some data, for example for a current assignment or a legal obligation.

What are your rights?

Under the GDPR, and insofar as they apply to the processing concerned, you have the right to:

• access the personal data we hold about you;
• have incorrect or incomplete data rectified;
• have your data erased;
• have the processing of your data restricted;
• object to processing based on our legitimate interest, and to the use of your data for direct marketing;
• receive data you have provided to us in a structured, commonly used and machine-readable format, or have it transmitted to another party (data portability);
• withdraw your consent where we process data on the basis of consent. This does not affect processing that took place before you withdrew it.

To exercise these rights, email us at privacy@sebsoft.nl. Most data can also be viewed or corrected via our customer panel.

If you have a question or complaint about how we handle your personal data, you can contact our privacy contact:

Sebsoft B.V.
Attn. Privacy contact (Karin Walters)
Vang 14a
4661 TX Halsteren
privacy@sebsoft.nl

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).