Privacy policy

Who is responsible

Verbrio B.V. handles information used to run its own business, including enquiries and project administration. When we process personal data in customer records on a customer's instructions, the agreed DPA describes that relationship. Roles depend on the actual work and access involved.

Verbrio B.V. is a Dutch business software provider registered at Hoedemakerplein 2, 7511 JP Enschede, the Netherlands, under Chamber of Commerce number 96023325 and VAT ID NL867435276B01. This policy applies to verbrio.com, our applications, and related business services. Questions and rights requests can be sent to [email protected]. This English text is the sole legally binding version; translations are provided only for transparency, readability, and accessibility.

Verbrio is the controller when it decides why and how to process account, billing, support, security, service-usage, and consented marketing or analytics data. In that role, we are responsible for the processing described in this policy.

Verbrio is a processor when a customer uploads or connects documents, emails, contacts, messages, orders, invoices, and related data so we can provide the service on that customer’s instructions. The customer is normally the controller and our Data Processing Agreement applies. If your request concerns data in a customer workspace, contact that customer first; we will assist them as required.

Enquiries and introductory calls

Getting in touch may involve your name, business contact details, organisation, message and information about the process you want to improve. We use those details to respond, prepare for the conversation and discuss possible work.

Booking a call opens an external Google calendar page. Information you enter there, including your contact details and chosen time, is handled through that booking service. Its own privacy information also applies. Please avoid adding customer records or sensitive documents to a booking description.

Delivering the project

Implementation and reconstruction may involve contacts, documents, messages, invoices, orders and information from connected systems. The scope and processing schedule identify the sources, people, data categories, purpose and permitted access for that project.

We also handle project correspondence, approvals, billing details and support requests to administer the engagement. Production data should be shared through the agreed delivery channel.

Website use and analytics

Necessary storage supports preferences, security and your analytics choice. The existing consent framework keeps optional PostHog browser analytics and session recording off until acceptance. The cookie settings control lets you reconsider that choice.

When enabled, analytics can include page interactions, device and session details and technical diagnostics. The cookie policy explains the controls. An external calendar has its own storage settings.

We use necessary browser storage for functions such as language, authentication, security, and remembering your privacy choice. Non-essential analytics remains off unless you accept it. You can reject or later change that choice through the cookie settings control on the Cookie Policy page.

The Cookie Policy lists current technologies, providers, purposes, categories, data, and durations.

Providers and access

Service delivery can involve infrastructure, email, document-processing and other providers. The provider register and project processing arrangements identify the providers involved. A provider's registered country alone does not establish where all processing happens.

The delivery plan should identify approved access, the providers involved and relevant processing locations before customer data is introduced.

The service may send the minimum content needed to AI, OCR, search, or indexing providers to extract text, create representations, classify, translate, summarise, or retrieve information. This processing is performed to provide the feature requested by the customer and is governed by the DPA and Subprocessor Register. Verbrio does not make decisions producing legal or similarly significant effects about individuals for its own purposes.

If a customer connects Refurbed, Back Market, or another external service, Verbrio exchanges data with that service only as configured and instructed by the customer. Those services generally operate under the customer’s own contract and privacy notice and may act as independent controllers. Disconnecting an integration stops new exchanges but does not erase data already held by that provider.

We share personal data only as needed with contracted service providers, customer-selected integrations, Polar in its payment roles, professional advisers and auditors, authorities where legally required, or a buyer or successor during a genuine corporate transaction subject to confidentiality and appropriate notice. We do not sell personal data or share it for third-party targeted advertising.

Our Subprocessor Register identifies current service providers, the processing they support, locations, and how customers are notified of changes. Customers receive the notice and objection rights stated in the DPA.

We favour European processing and hosting where practical, but some providers or support operations may process data outside the European Economic Area. Before such a transfer, we use a lawful mechanism such as an adequacy decision or the European Commission’s Standard Contractual Clauses and assess supplementary safeguards where required.

The Subprocessor Register gives provider-level location information. Contact us if you need information about the safeguard used for a particular transfer; commercially sensitive terms may be redacted.

We use technical and organisational measures proportionate to the data and risk, including access controls, least-privilege practices, encryption in transit and where appropriate at rest, logging, protected backups, supplier review, and incident procedures. No internet service is risk-free, so customers must also secure accounts, users, devices, integrations, and exported copies.

If we become aware of a personal-data breach, we assess, contain, and document it and notify the competent authority and affected people when we are the controller and law requires it. When we are a processor, we notify and assist the customer without undue delay as set out in the DPA.

Retention and project completion

Retention depends on the purpose, engagement, documented instructions and applicable obligations. The project arrangement must specify return or deletion of customer records, backup handling and any information that must be retained. No universal retention or deletion period applies to every project.

We keep personal data only while it serves the purpose described above, plus any period needed for legal duties, security, fraud prevention, dispute resolution, or enforcement. We consider the contract term, sensitivity, risk, legal limitation periods, and whether data can be aggregated or anonymised. Anonymised data that can no longer identify a person may be retained for statistics and service improvement.

When a customer ends the service, workspace data remains available for export for 30 days and is then deleted from active systems, unless law or a documented legal hold requires retention. Encrypted backups remain protected and expire through our backup-retention lifecycle. Financial records are normally retained for seven years. Other controller records follow the criteria and periods in the table.

Questions and requests

Contact our legal inbox to ask about your personal information, request access or correction, raise a deletion request, or discuss a privacy concern. For records managed on a customer's instructions, contact that customer first so the request can be handled in the right context.

Depending on the processing, the GDPR gives you rights to access, correct, erase, restrict, or receive your personal data; object to processing based on legitimate interests or direct marketing; and withdraw consent without affecting earlier lawful processing. You may also have the right not to be subject to a solely automated decision with legal or similarly significant effects.

Send requests to [email protected]. We may verify your identity and ask for details needed to locate the data. We normally respond within one month, subject to lawful extensions and exceptions. There is no fee unless a request is manifestly unfounded or excessive. For Customer Data, send the request to the relevant customer as controller.

We encourage you to contact us first so we can try to resolve the concern.

You can complain to the supervisory authority where you live or work. In the Netherlands, this is the Autoriteit Persoonsgegevens.

Business service and children

Verbrio is a business service and is not directed to children or intended for personal household use. People under 18 may not create an account. Customer Data may concern minors only where the customer has a lawful business need and meets the additional protections required by law.

Changes to this policy

We update this policy when our processing, providers, or legal duties change. The version and effective date appear at the top. For a material change, we will provide a prominent notice or contact account administrators before it takes effect where reasonably possible. Changes to subprocessors follow the separate DPA notice process.

Contact

Privacy questions, rights requests, and data-protection notices can be sent to: