AIW works with private company information. This policy explains what personal data we handle when you visit our website or approach us, why we handle it, and what you can require of us.
1. Controller
AIW Systems Europe B.V., trading as Agents In White
Alphen aan den Rijn, Netherlands
Chamber of Commerce (KvK): number supplied on request and stated on every contract and invoice
Privacy contact: admin@agentsiw.com · General: admin@agentsiw.com
AIW acts as controller for the data described in this policy. Where AIW processes personal data inside a system we build or operate for a client, the client is the controller and AIW acts as processor under a separate Data Processing Agreement. This policy does not govern that processing.
AIW has assessed that it is not required to appoint a Data Protection Officer. Privacy accountability sits with the Founder & CEO.
2. Personal Data We Collect
a. Private access requests. Name, company, email address, phone or WhatsApp number, project type, budget range, website, and the content of your message.
b. Correspondence. Email, WhatsApp, telephone, and video-call communications, including attachments, calendar invitations, and meeting notes.
c. Engagement and client administration. Contact details of your personnel involved in a project, contractual documents, billing and payment details, and records of decisions and approvals.
d. Technical data. IP address, approximate location derived from it, browser and device type, referring page, pages viewed, and timestamps. Collected by our hosting infrastructure in server logs, and in aggregate form by analytics where configured.
e. Recruitment and unsolicited applications. CV, cover letter, portfolio, and contact details, if you approach us about working with AIW.
We do not knowingly collect special categories of personal data through this website. Do not submit health data, biometric data, government identification numbers, payment card numbers, or other sensitive material through the public form.
3. Why We Process It, And On What Basis
| Purpose | Data | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Evaluating and responding to a private access request | 2a, 2b | Legitimate interest (b) pre-contractual necessity where a project follows |
| Negotiating, concluding, and performing an engagement | 2b, 2c | Performance of a contract |
| Invoicing, accounting, and statutory record-keeping | 2c | Legal obligation (Dutch fiscal retention) |
| Operating, securing, and improving the website | 2d | Legitimate interest in a functioning, secure site |
| Measuring aggregate website traffic | 2d | Consent, where analytics cookies are used; otherwise legitimate interest for cookieless aggregate counts |
| Occasional updates to parties who have engaged with AIW | 2a, 2b | Legitimate interest, with opt-out in every message |
| Assessing a candidate | 2e | Consent |
| Establishing, exercising, or defending legal claims | any | Legitimate interest |
Where we rely on legitimate interest, we have weighed our interest against your rights and concluded that the processing is proportionate, limited in scope, and consistent with what you would reasonably expect. You may object at any time (§9).
4. Automated Decision-Making
AIW does not make decisions about you by automated means alone, and does not profile website visitors. Requests for private access are read and assessed by a person. AI tooling may be used to draft or summarise our own internal notes; the decision remains human.
5. Confidentiality Of What You Send Us
Material submitted through the public form is treated as confidential in practice, but the form is not the appropriate channel for sensitive or regulated information. Send a high-level description first; detailed workflows, documents, and data should follow only after a mutual NDA is in place. See NDA & Confidentiality.
6. Recipients And Processors
We share personal data only where necessary, and only with parties bound by confidentiality and, where applicable, a processor agreement:
- Hosting and content delivery — Cloudflare
- Email and calendar — Hostinger Mail
- Website analytics — Privacy-conscious analytics (cookieless, only where configured), where configured
- Accounting, invoicing, and tax filing — our bookkeeper and tax adviser
- Professional advisers — legal counsel, where a claim or obligation requires it
- Authorities — where AIW is legally compelled to disclose
A current list of the sub-processors used in client systems is maintained at /legal/sub-processors.
AIW does not sell personal data, does not trade it, and does not use client or visitor data to train publicly available AI models.
7. AI Providers
Where AIW uses third-party model providers in the course of its own operations, we select configurations that exclude customer content from provider model training and apply zero- or limited-retention settings where the provider offers them. Personal data is not submitted to a model provider without a lawful basis and, in client systems, without the client's instruction under the DPA.
8. International Transfers
Our infrastructure is chosen with a preference for the European Economic Area. Where a provider processes data outside the EEA, the transfer is covered by an adequacy decision of the European Commission or by the European Commission's Standard Contractual Clauses together with supplementary technical measures, including encryption in transit and at rest. A copy of the relevant transfer mechanism is available on request to admin@agentsiw.com.
9. Retention
| Data | Retention |
|---|---|
| Private access requests that do not lead to an engagement | 12 months from last contact |
| Correspondence during an active engagement | Duration of the engagement plus 2 years |
| Contracts, orders, and delivery records | 7 years after the engagement ends |
| Invoices and accounting records | 7 years (Dutch fiscal obligation) |
| Server logs | 30 days, unless retained longer for a specific security investigation |
| Analytics, aggregate | 14 months |
| Unsolicited applications | 4 weeks after the process closes, or 12 months with your consent |
After these periods data is deleted or irreversibly anonymised, unless a longer period is required to defend a legal claim.
10. Your Rights
You may ask us to:
- Access — confirm what personal data we hold about you and provide a copy
- Rectify — correct data that is inaccurate or incomplete
- Erase — delete data where we no longer have grounds to keep it
- Restrict — pause processing while a dispute about accuracy or grounds is resolved
- Port — receive data you provided in a structured, machine-readable format
- Object — stop processing based on legitimate interest, including any direct marketing
- Withdraw consent — where consent was the basis, without affecting prior processing
Write to admin@agentsiw.com. We respond within one month and will tell you if we need the extension the GDPR permits for complex requests. We may ask for information to confirm your identity, and only that.
11. Complaints
If our response does not satisfy you, you may lodge a complaint with the Dutch supervisory authority:
Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, Netherlands — autoriteitpersoonsgegevens.nl
You may also complain to the supervisory authority of your own EU member state, or bring the matter before a competent court.
12. Security
AIW applies access control on a need-to-know basis, multi-factor authentication on all administrative accounts, encryption in transit and at rest, separated client environments, and least-privilege credentials for integrations. Our full posture is described in the Information Security Statement. No system is absolutely secure; we commit to notifying affected parties and, where required, the Autoriteit Persoonsgegevens without undue delay and within 72 hours of becoming aware of a reportable breach.
13. Children
This website and our services are directed exclusively at professional parties. We do not offer services to children and do not knowingly process their data.
14. Cookies
See the separate Cookie Notice.
15. Changes
We may amend this policy as our infrastructure or obligations change. The effective date above marks the current version. Material changes affecting people whose data we hold will be communicated directly where we have a contact address.