Privacy Statement
Conveneo builds customer care on two things people have to be able to trust: the humans in our teams, and the data they work with. This statement explains in plain language which personal data we process, why, on what legal basis, how long we keep it, and what you can ask us to do with it.
1. Who is responsible
The controller for the personal data described in this statement is:
- Assistance Centre Amsterdam B.V., trading as Conveneo
- Weijinksweg 3, 7558 PL Hengelo (Ov.), the Netherlands
- Chamber of Commerce (KvK) number: 34287475
- Telephone: +31 (0)20 75 55 411
- Email: egbert.vandecoevering@conveneo.eu
We have not appointed a statutory Data Protection Officer. Privacy matters are handled directly by our management, at the email address above.
2. Scope of this statement
This statement covers the personal data we process as a controller — that is, where we decide why and how the data is used:
- visitors to conveneo.eu, including our Insights articles and the Human After All Prize pages;
- people who contact us through a form, by email or by telephone;
- prospective clients who request a quote or configure a team;
- candidates and job applicants.
It does not cover the personal data we handle on behalf of our clients when we deliver customer care, helpdesk, back-office or bookkeeping services. There, our client is the controller and we act as a processor — see section 10.
3. What we process and why
3.1 Visiting the website
conveneo.eu is a static website delivered through a content delivery network. To serve a page and keep the site available and secure, our hosting and CDN provider processes technical data in server logs: your IP address, the requested URL, the date and time, the HTTP status, the referring page, and your browser and operating system type.
We do not use analytics software, advertising pixels, heatmaps, visitor profiling or cross-site tracking of any kind. We do not build profiles of our visitors, and we do not sell or rent personal data to anyone.
| Purpose | Legal basis |
|---|---|
| Delivering the website, troubleshooting, and protecting against abuse and attacks | Legitimate interest (Art. 6(1)(f) GDPR) — a secure, functioning website |
3.2 Contact form and team-configuration wizard
Our homepage contact form asks for your name, work email address and your message. The Build Your Team wizard additionally records the team configuration you put together — such as roles, languages, team size and timeline — together with your name, company, email address and, optionally, your phone number.
We use this to answer your question, prepare a quote and, if it leads somewhere, set up the engagement. Submissions reach us by email through a third-party form-delivery service (see section 5).
| Purpose | Legal basis |
|---|---|
| Responding to your enquiry, drawing up a quote, pre-contractual contact | Performance of, or steps preparatory to, a contract (Art. 6(1)(b) GDPR) |
| General business correspondence and follow-up with prospective clients | Legitimate interest (Art. 6(1)(f) GDPR) — conducting our business |
Completing these forms is voluntary, but without a name, an email address and a description of your question we cannot help you.
3.3 Email, telephone and LinkedIn
If you email or call us, or reach out through LinkedIn, we process the contact details and the content you provide so that we can reply and keep a record of the conversation. The legal basis is our legitimate interest in handling business correspondence, or the preparation of a contract where your message concerns a possible engagement.
3.4 Job applications
If you apply for a role at Conveneo, we process the data you send us: your name, contact details, CV, motivation, work history, education, language skills, references you name yourself, and the notes we make during the procedure. We use this to assess your application and to communicate with you about it.
| Purpose | Legal basis |
|---|---|
| Assessing your suitability and running the application procedure | Legitimate interest (Art. 6(1)(f) GDPR) — filling our vacancies — and the steps leading to an employment contract |
| Keeping your details on file after the procedure ends | Your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time |
Please do not send us special categories of personal data — such as data about your health, religion or ethnicity — in your application. We do not ask for them and do not need them. Where a role requires screening that the law allows, such as a certificate of good conduct (VOG) or a reference check, this happens only with your knowledge.
3.5 Insights and the Human After All Prize
Our Insights articles are plain static pages: reading them requires no account and sets no tracking. If a campaign or a prize entry process asks for your details, you will be told at that point which data is collected, by whom and for what purpose.
4. Cookies and local storage
The site does use one piece of functional browser storage:
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
conveneo_lang |
Local storage (functional) | Remembers the interface language you selected (EN, DE, FR, ES or NL) | Until you clear your browser storage |
This value stays in your own browser, holds nothing but a two-letter language code, and is never sent to us or to a third party. Because it exists solely to carry out a preference you expressed yourself, no consent is required for it.
Our hosting and CDN provider may use a strictly technical cookie or token for load balancing and abuse protection. Such cookies are necessary for the site to be delivered and are not used to recognise you across websites.
5. Third parties we rely on
We keep our supply chain deliberately short. For the website, these are the parties that may process personal data on our behalf, or that receive it as a consequence of how the web works:
| Party | Role | What it sees |
|---|---|---|
| Bunny.net (BunnyWay d.o.o., Slovenia — EU) | Hosting and content delivery network | Your IP address and technical request data, in server logs |
| Web3Forms | Delivers form submissions to our mailbox | The contents of the contact and quote forms you submit |
| Google (Google Fonts) | Serves the typefaces used on this site | Your IP address and browser details when the font files are requested |
| Our email and office provider | Mailboxes, calendars and document storage | The correspondence you have with us |
Where these parties process personal data on our instructions, we have a data processing agreement with them as required by Article 28 GDPR. We also share data where we are legally obliged to — for example with tax authorities, auditors, or law enforcement acting on a valid request.
6. Transfers outside the EEA
We prefer European providers, and our hosting and content delivery sit within the EU. Some of the services listed above may nevertheless process data outside the European Economic Area, or use support staff who do. Where that happens, the transfer is covered by an adequacy decision of the European Commission or by the European Commission's Standard Contractual Clauses, supplemented where necessary with additional technical and organisational safeguards. You can ask us which mechanism applies to a specific provider.
7. How long we keep data
We keep personal data no longer than we need it for the purpose it was collected for, unless a statutory retention period applies.
| Data | Retention |
|---|---|
| Server and CDN logs | Short-term only, as a rule no more than 30 days, unless kept longer to investigate a specific security incident |
| Contact form submissions and general correspondence | Up to 24 months after our last contact |
| Quote and team-configuration requests that do not lead to an engagement | Up to 24 months after the request |
| Client contracts and the administration around them | 7 years after the end of the financial year, as required by Dutch tax law |
| Application data of candidates we do not hire | Up to 4 weeks after the procedure ends; up to 1 year with your consent |
| The language preference in your browser | Until you clear it yourself |
8. How we protect data
Security is part of how we are built, not an afterthought. Among other measures, we:
- serve the entire website over HTTPS/TLS, so traffic between you and us is encrypted;
- limit access to personal data to the people who need it for their work, under confidentiality obligations;
- use multi-factor authentication and role-based access on our business systems;
- apply privacy by design and by default, keeping the amount of data we collect to the minimum;
- work in line with recognised information security and quality management standards, and review our measures periodically.
If a personal data breach occurs that is likely to present a risk, we report it to the Dutch Data Protection Authority within 72 hours and inform the people affected where the law requires it. If you think you have found a vulnerability in our website or systems, please tell us at egbert.vandecoevering@conveneo.eu and give us a reasonable opportunity to fix it before disclosing it publicly.
9. Your rights
Under the GDPR you have the right to:
- access — ask whether we process data about you, and receive a copy;
- rectification — have inaccurate or incomplete data corrected;
- erasure — have your data deleted where we no longer have grounds to keep it;
- restriction — ask us to pause the processing while a dispute is resolved;
- object — object to processing based on our legitimate interest;
- data portability — receive the data you provided to us in a structured, machine-readable format;
- withdraw consent — at any time, where processing is based on your consent. Withdrawal does not affect processing that already took place.
Send your request to egbert.vandecoevering@conveneo.eu. We respond within one month; if your request is complex we may extend this by two months and will tell you if we do. We may ask for additional information to establish your identity — we would rather ask than hand your data to the wrong person. Exercising these rights is free of charge.
10. When we act for a client
When Conveneo handles customer conversations, helpdesk tickets, back-office work or bookkeeping for a client, we process the personal data of that client's customers and employees. In that role we are a processor: the client decides why and how the data is used, and we act only on their documented instructions, under a data processing agreement as required by Article 28 GDPR.
If you are a customer of one of our clients and you want to exercise your rights over that data, please contact that organisation — they are the controller and their privacy statement applies. If you approach us directly, we will forward your request to the client concerned and tell you that we have done so, but we cannot decide on it ourselves.
11. AI and automated decisions
AI agents are part of how we deliver service: they handle routine conversations and prepare work so our specialists can concentrate on the cases that need human judgement. Two commitments follow from that.
First, in our own relationship with you we do not subject you to automated decision-making with legal or similarly significant effects within the meaning of Article 22 GDPR. Decisions on applications, quotes and engagements are made by people. Where an AI system supports service delivery for a client, a human remains accountable for the outcome and a conversation can always be escalated to a person.
Second, we do not use the personal data of website visitors, prospective clients or applicants to train our own or third-party AI models.
12. Children
Our website and services are aimed at organisations and professionals, not at children. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
13. Changes to this statement
We may update this statement when our services, our systems or the law change. The version number and date at the top of this page always tell you which version applies. Material changes will be announced on this page before they take effect. We recommend checking this page whenever you submit personal data to us.
14. Contact and complaints
Questions, requests or doubts about how we handle your data are welcome. Write to us at egbert.vandecoevering@conveneo.eu or call +31 (0)20 75 55 411.
You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or with the supervisory authority of the EU member state where you live or work. We would appreciate the chance to resolve the matter with you first.