Privacy Policy

1. Data Controller Information

2. Information We Collect

2.1 Information You Provide Directly

• Contact Information: Name, email address, phone number, company name
• Business Information: Job title, company size, industry, business requirements
• Communication Data: Messages, inquiries, and correspondence with us
• Service Data: Information provided during consultations and service delivery

2.2 Information Collected Automatically

• Website Usage: Pages visited, time spent, navigation patterns
• Technical Data: IP address, browser type, device information, operating system
• Cookies and Tracking: As detailed in our Cookie Policy below

3. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contractual Necessity: To perform our services and fulfill contractual obligations
• Legitimate Interest: To improve our services, conduct business operations, and communicate with prospects
• Consent: For marketing communications and non-essential cookies (where required)
• Legal Obligation: To comply with applicable laws and regulations

4. How We Use Your Information

• Provide and deliver our consulting and technology services
• Respond to inquiries and provide customer support
• Send service-related communications and updates
• Improve our website, services, and user experience
• Conduct business analysis and operational improvements
• Comply with legal obligations and protect our rights
• Send marketing communications (with your consent where required)

5. Information Sharing and Disclosure

We may share your information with:

• Service Providers: Third-party vendors who assist in service delivery (cloud providers, analytics tools)
• Business Partners: When jointly providing services (with your consent)
• Legal Requirements: When required by law, court order, or government request
• Business Transfers: In connection with mergers, acquisitions, or asset sales

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

6. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA). When we transfer data internationally, we ensure appropriate safeguards through:

• EU-approved Standard Contractual Clauses (SCCs)
• Adequacy decisions by the European Commission
• Binding Corporate Rules where applicable
• Other appropriate safeguards as required by GDPR

7. Data Retention

We retain your personal data only for as long as necessary:

• Client Data: Duration of engagement plus 7 years for legal and tax purposes
• Marketing Data: Until you withdraw consent or 3 years of inactivity
• Website Analytics: 26 months maximum
• Legal Claims: Until the statute of limitations expires

8. Your Rights Under GDPR

To exercise your rights, contact us at privacy@enhancebmt.ai. We will respond within 30 days.

9. Cookie Policy

We use cookies and similar technologies to:

• Essential Cookies: Enable basic website functionality (no consent required)
• Analytics Cookies: Understand website usage and improve performance
• Marketing Cookies: Deliver relevant advertisements and track campaign effectiveness

You can control cookies through your browser settings or our cookie consent banner. Disabling certain cookies may affect website functionality.

10. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption of data in transit and at rest
• Access controls and authentication systems
• Regular security assessments and updates
• Employee training on data protection
• Incident response and breach notification procedures

11. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected individuals without undue delay where required by law.

12. Children's Privacy

Our services are not directed to individuals under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that we have collected such information, we will take steps to delete it promptly.

13. Updates to This Policy

We may update this Privacy Policy to reflect changes in our practices or applicable laws. We will notify you of material changes via email or prominent website notice at least 30 days before the effective date.

14. Supervisory Authority

You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data violates GDPR. In the Netherlands, this is the Autoriteit Persoonsgegevens (AP).

15. Contact Us