Privacy Statement
1. Introduction
ControlBuddy B.V. ("ControlBuddy", "we", "us", or "our") is committed to protecting the personal data of its clients, website visitors, and business partners. This Privacy Statement describes why and how we collect, process, and protect personal data in the context of our services related to financial steering, process governance, and interim control.
We process personal data in accordance with the General Data Protection Regulation (GDPR / AVG) and applicable Dutch privacy legislation.
2. Scope
This Privacy Statement applies to all services provided by ControlBuddy (located at Kabelstraat 5, Almere Poort, the Netherlands) and to the website www.controlbuddy.nl.
Our service delivery is 100% remote and online. Our website may contain links to third-party software or external websites (such as accounting software, payment processors, or portals). When you leave our environment via a link, this Privacy Statement no longer applies.
3. How We Collect and Process Personal Data
A. Financial Services & Analytics. To execute our financial control, analytical, and dossier preparation services, we process data provided by you as a client (e.g. via secure data uploads or API integrations). Data categories: contact details of key personnel (name, role, business email, phone number), financial administrative data, master data of debtors/creditors. Legal basis: performance of a contract.
B. Use of AI Technology & Data Security. ControlBuddy utilizes an advanced Financial AI Engine to accelerate calculations and data analysis and to detect process anomalies. No AI training on client data: client data and financial files are never used to train public or external AI models — all data remains strictly segmented and confidential. Human-in-the-Loop oversight: AI outputs are never shared autonomously; every analysis is personally reviewed, refined, and authorized by our Senior Finance Partner before reports are delivered.
C. Client Onboarding, Quotes & Invoicing. Data categories: company name, KvK number, VAT number, name of the authorized representative, business bank account number, billing address. Legal basis: legal obligation (statutory tax retention compliance) and legitimate interest (client acceptance procedures).
D. Online Communication & Website. Data categories: IP address, browser details, messages submitted via contact forms or analysis request forms. Legal basis: legitimate interest (managing and securing our online services) and consent (for cookies).
4. Retention of Personal Data
We do not retain personal data longer than necessary for the purposes for which it was collected:
Financial and Client Records: for the duration of the agreement and up to a maximum of 7 years following termination (statutory tax retention requirements)
AI Analysis Dossiers & Documentation: archived in a secure environment following project completion and delivery, unless the client explicitly requests erasure (to the extent legally permissible)
Quotes & Inquiries (non-converted prospects): up to a maximum of 12 months after the last contact, unless consent is granted to store contact details longer
5. Data Sharing with Third Parties & International Transfers
We never sell or rent your personal data to third parties. We only share personal data in the following circumstances:
IT and Hosting Partners: certified cloud and hosting providers, with data processing agreements in place
Security & Storage within the EEA: all data is stored on secure servers within the European Economic Area and transmitted using advanced SSL encryption
Your External Accountant / Regulatory Authority: solely upon your explicit request and consent, to handle document request lists (Lijst van Oplevering / PBC)
Legal Obligations: when required by law or regulatory/enforcement authorities
6. Cookies
Our website uses functional and analytical cookies to optimize performance and analyze platform usage.
Functional Cookies: essential for the proper operation of the website and interactive forms
Analytical Cookies: used to collect anonymous statistics regarding website visits
You can manage or block cookies through your internet browser settings, or via our cookie consent banner and preferences.
7. Your Rights as a Data Subject
Right of Access: request a copy of the personal data we process about you
Right to Rectification: ask us to update or correct inaccurate or incomplete data
Right to Erasure ("Right to be Forgotten"): request deletion of your personal data, provided we are not legally obligated to retain it
Right to Restriction & Object: object to data processing or request a restriction on processing activities
Right to Data Portability: receive your personal data in a structured, commonly used, machine-readable format
To exercise any of your rights, please submit a request to support@controlbuddy.nl. To verify your identity, we may request additional information.
8. Contact Details
ControlBuddy, Kabelstraat 5, Almere Poort, The Netherlands
Email: support@controlbuddy.nl / info@controlbuddy.nl
Website: www.controlbuddy.nl
If you believe that we are not processing your personal data correctly, you also have the right to lodge a complaint with the Dutch supervisory authority: the Autoriteit Persoonsgegevens (AP) via www.autoriteitpersoonsgegevens.nl.
9. Amendments
ControlBuddy reserves the right to amend this Privacy Statement at any time. The most current version will always be available on our website.