Privacy notice

1. Who is responsible

RotoSuite is provided by [COMPANY_NAME], located at [REGISTERED_ADDRESS], registered with the Netherlands Chamber of Commerce under number [KVK_NUMBER]. ‘RotoSuite’, ‘we’ and ‘us’ refer to that company.

We are the controller for personal data whose purposes and means we determine for our own website, business communications, contract administration and security. Contact s.staal@pentas.nl or m.koorn@pentas.nl with the subject ‘RotoSuite privacy’.

2. Your organisation’s role

When your employer or another organisation uses RotoSuite to process information about staff, visitors, customers or suppliers, that organisation normally determines the purposes and configuration. RotoSuite processes customer data on its behalf as a processor, under the contract and data processing arrangements.

Your organisation’s privacy information also applies. It determines access rights, sources, lawful bases and retention periods, and can explain which modules, integrations, recordings or analyses are active. An organisation administrator may access information within that organisation according to their permissions. Business notes and messages should therefore not be assumed to be private to their author.

This notice does not replace a data processing agreement and does not itself authorise employee monitoring, recordings or collection of sensitive information.

3. Website visits, enquiries and demo requests

For an enquiry or demo request, we process your name, company, business email, selected area of interest and message. Technical request information may also be processed, including the time, IP address, browser information and information needed to prevent abuse. Include only information needed for your enquiry.

Website enquiries are sent through the RotoSuite mail server to s.staal@pentas.nl and m.koorn@pentas.nl. The form uses a temporary security token and request limits. An enquiry does not subscribe you to a newsletter or create a paid subscription.

Name, company, email and message are needed to submit and handle the form. The area of interest is optional. You may also email us directly. Without necessary contact information, we may be unable to respond or prepare an appropriate proposal.

4. Data within the SaaS service

Different modules process different information. Depending on enabled functions and information supplied by the customer, this may include:

• Account and organisation details: names, business email addresses, user identifiers, organisation, roles, permissions and account status.
• Collaboration: tasks, tickets, comments, notes, files, shared documents, action points and the staff involved.
• Learning and development: skills, completed training, qualifications and development records entered by the organisation.
• Meetings and communications: participants, audio or other supplied media, transcripts, summaries and messages, insofar as the selected function processes them.
• Production and safety: planning, responsibilities, risk and quality records, machine and test information. Technical information is personal data when it can be linked to a person.
• Image and AI functions: supplied images, prompts, source documents, generated responses and associated metadata, depending on the activated use case.
• Technical and support information: access and usage events, errors, security information and material a user supplies with a support request.

5. Sources of information

We receive information directly when you contact us or enter information. Within a customer environment, it may also come from administrators, colleagues, imported files, connected business systems or configured equipment. The responsible organisation must inform individuals about relevant sources and uses.

If we receive a business contact’s details from a colleague or organisation for our own purposes, we use them for the relevant business contact and provide the information required by law. We do not automatically use every technically available data source.

6. Purposes and lawful bases

For processing under our own responsibility, we distinguish the following purposes and bases. Legitimate interests must be balanced against the impact on the individual; they are not unlimited permission to use information.

• Answering enquiries and preparing demonstrations: our legitimate interest in handling business requests. Steps taken at your request before entering a contract may also apply when you personally are the prospective contracting party.
• Managing contracts and business relationships: performance of a contract where you personally are a party; for representatives of a legal entity, our legitimate interest in conducting and managing that relationship.
• Billing, accounting and required records: performance of the contract and applicable accounting and tax obligations.
• Protecting the website, accounts and services: our legitimate interest in reliable access, preventing and investigating abuse, and protecting information and infrastructure.
• Handling disputes, legal requests and obligations: the relevant legal obligation or our legitimate interest in establishing, exercising or defending legal claims.
• Optional processing requiring consent: the specific consent requested. You can withdraw it; withdrawal does not automatically make earlier processing unlawful.
• Processing customer data within modules: the customer determines and substantiates the lawful basis. RotoSuite follows documented instructions; a processing agreement is not itself the customer’s lawful basis for collecting information.

7. Cookies and similar technologies

In its current configuration, the public marketing website does not use advertising or analytics cookies. Fonts and website images are served from the website. Technical server records and form security may still process request information; this is separate from advertising tracking.

The authenticated SaaS environment may require functional session, authentication and security technologies. Optional technologies requiring consent must obtain that consent in advance. Reading this notice does not authorise a new optional integration. Browser restrictions on storage may prevent necessary features from working properly.

8. Who may receive information

Access is intended for people and service providers who need it for their work: authorised staff, hosting and infrastructure providers, business email, support and administration providers, and professional advisers where necessary. Within a customer environment, authorised customer users receive information according to configured permissions.

Enabled AI, communications or other external integrations may send relevant inputs and technical information to selected providers. The actual parties depend on the agreed service and configuration. Customers may request information about the parties, roles, locations and arrangements before activation.

Appropriate processing and confidentiality arrangements must cover parties processing on our or the customer’s behalf. We may disclose information where legally required or in response to a valid government request, after assessing its scope. We do not sell personal data as a commercial contact database.

9. Locations and international transfers

Storage and access locations depend on the contracted environment and selected providers. A Dutch-language website or European domain does not guarantee that all processing remains within the European Economic Area. Locations and subprocessors for customer data must be documented in the processing arrangements.

Transfers outside the EEA require a valid transfer mechanism, such as an applicable adequacy decision or appropriate safeguards including European standard contractual clauses. A transfer assessment and supplementary measures may also be necessary. Contact us for information about applicable safeguards and how to obtain a copy, subject to protection of confidential information.

10. Retention and deletion

Retention depends on the purpose and category of information. There is no unlimited blanket retention period. Where no fixed statutory or contractual period applies, completion of the purpose, specific follow-up needs and concrete legal obligations determine when information can be deleted or anonymised.

• Enquiries and demonstrations: during handling and specific follow-up communications. After completion, only information needed for an ongoing relationship, agreed follow-up or concrete dispute remains necessary; other content should be deleted.
• Contracts and invoices: during the relationship and subsequently as required by statutory record-keeping duties. Dutch invoices normally have a seven-year retention period; special legal regimes may require another period.
• Technical logs and security information: as needed to investigate and resolve the relevant fault, incident or abuse. Records relating to a concrete incident may be needed longer than routine operational records.
• Customer content and user information: according to the controller’s instructions, retention schedules and processing agreement. Removing an account does not automatically require deletion of every business task, note or record associated with it.
• After a customer contract ends: according to export, retrieval, deletion and backup arrangements, subject to mandatory switching and privacy rules. Restricted backup copies follow the agreed expiry schedule and are not reused for ordinary operations.
• Legal claims or mandatory retention: only the relevant information and only while that specific reason continues. An exception for one matter does not justify retaining all other information.

11. Security and incidents

Security must reflect the information and processing risks. The public website uses HTTPS and measures against unauthorised access and form abuse. Relevant technical and organisational measures and additional customer requirements are documented in the contract and processing arrangements.

Relevant topics include access management, confidentiality, maintenance, recovery, vulnerability handling and incident response. This notice does not independently promise certification, an availability percentage, a fixed recovery time or a particular encryption method for all stored data.

Report a suspected incident promptly to our contact addresses without sending unnecessary sensitive information. Incidents are assessed to determine appropriate measures and notifications. As processor, we notify the customer without undue delay; the controller assesses notification duties to authorities and affected individuals.

12. AI, cameras, recordings and employee information

Configured modules may use AI, image recognition, transcription, document search or summaries. Inputs, providers and provider retention must be assessed for the selected configuration. Do not upload special-category data or confidential business information into an external function before the processing is permitted and appropriate arrangements are in place.

Customer data received as processor is subject to the customer’s instructions. Reuse to train a general-purpose model is not automatically part of providing an AI feature and requires a separate lawful, documented arrangement. External providers’ processing terms must be considered.

AI results may be inaccurate or incomplete. Customers must organise appropriate human review, especially for employment, safety or quality decisions. Cameras and meeting recordings require a separate assessment of necessity, proportionality, transparency and lawful basis. The employment relationship means staff consent is not always an appropriate basis.

We do not make solely automated decisions with legal or similarly significant effects when handling website enquiries. If such processing occurs within a customer environment, the responsible organisation must explain it separately and comply with the applicable conditions.

13. Sensitive information and children

The website and business SaaS service are not directed at children. Do not use the contact form for medical records, criminal-offence data, national identification numbers, passwords or copies of identity documents. A module’s ability to store a file does not make every category of information suitable or permitted.

Special-category and criminal-offence data, and other specially protected information, require an applicable exception or specific legal conditions. Before processing, customers must assess whether the service, contractual arrangements and security are suitable. A training record, for example, is not automatically an appropriate place for medical information.

14. Your privacy rights

Subject to the processing and statutory conditions, you may request access and a copy, correction, erasure or restriction. Portability may apply to information you supplied that is processed automatically on the basis of consent or a contract.

You may object to processing based on legitimate interests for reasons relating to your situation. You may always object to direct marketing. Consent may be withdrawn for future processing without affecting the lawfulness of earlier processing.

Rights are not absolute. Statutory retention, others’ rights or a concrete legal claim may justify limitations. We explain a refusal or restriction and your opportunities to challenge it.

15. Making a request

Email s.staal@pentas.nl or m.koorn@pentas.nl, explaining the information and action concerned. We may request proportionate information to verify identity and authority, but do not routinely require a complete identity-document copy.

For processing under our responsibility, we normally respond within one month. Complex or multiple requests may justify an extension of up to two further months under the GDPR; we explain this within the first month. Requests are normally free. A reasonable fee or refusal is possible only within the statutory exceptions.

For data in your employer’s or another customer’s environment, contact that organisation first. If we receive such a request, we assist the controller under the processing arrangements. We do not independently amend or disclose customer information without valid instructions or a legal obligation.

16. Questions, complaints and supervisory authorities

Contact us with questions or concerns about our handling of personal data. You do not have to resolve a complaint with us before contacting a supervisory authority.

You may complain to the Dutch Autoriteit Persoonsgegevens at autoriteitpersoonsgegevens.nl. Within the EEA, you may also contact the competent authority where you usually live or work, or where the alleged infringement occurred. Your statutory judicial remedies remain available.

17. Changes and versions

This notice may change when services, processing or applicable rules change. Its version and date appear above. Material changes requiring further information or consent are not implemented merely by replacing this webpage.

You may download and keep this version. A revised notice does not provide retroactive consent or itself amend an existing processing agreement.