Privacy Policy
TEMPORARY VERSION – PENDING LEGAL REVIEW. This text is a provisional draft and has not yet been reviewed by a lawyer. Items marked [CHECK] still need to be confirmed.
Last updated: [CHECK: date of publication]
This policy explains how we handle personal data when you visit wemember.ai (our marketing website) or contact us. It does not cover the WeMember product at app.wemember.ai; data processed in the product is governed by the agreement and data processing agreement with your organisation.
1. Who we are (data controller)
The controller for the processing described here is:
- [CHECK: legal entity name, e.g. “… B.V.”], trading as WeMember
- Address: [CHECK: registered address]
- Chamber of Commerce (KvK) number: [CHECK: KvK number]
- E-mail: hello@wemember.ai
- Privacy contact / Data Protection Officer: [CHECK: name and e-mail of privacy officer or DPO, or state that no DPO has been appointed]
We are established in the Netherlands and subject to the General Data Protection Regulation (GDPR / AVG) and Dutch law.
2. What data we process, why, and on what legal basis
| Purpose | Data | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Hosting and securing the website | IP address, browser and device information, requested pages, timestamps (server and security logs) | Legitimate interest (running a secure, working website) |
| Cookieless website statistics (Cloudflare Web Analytics) | Aggregated page views, referrer, country, browser and device type. No cookies, no cross-site tracking | Legitimate interest (understanding how the site is used) |
| Heatmaps and session recordings (PostHog EU Cloud) | Clicks, scrolls, mouse movements, pages visited, device and browser information, pseudonymous identifier. Form inputs are masked | Consent – only after you accept in the cookie banner |
| Answering contact-form and e-mail messages | Name, e-mail address, company, message content and any other details you share | Legitimate interest (responding to you) or, where you ask about our services, taking steps before entering into a contract |
| Business relationship and pre-contractual contact | Contact details and correspondence | Contract (performing or preparing an agreement) |
| Legal obligations | Records we must keep, e.g. for tax purposes | Legal obligation |
Where we rely on legitimate interest, we have weighed our interest against your privacy. You can object at any time (see section 7).
We do not sell your data and do not use it for automated decision-making or profiling with legal effects.
3. How long we keep data
| Data | Retention period |
|---|---|
| Server and security logs | [CHECK: e.g. max. 30 days, unless needed to investigate an incident] |
| Cloudflare Web Analytics | Aggregated data only; [CHECK: Cloudflare retention period] |
| Heatmap and session-recording data | [CHECK: e.g. max. 90 days / tool default] |
| Contact-form and e-mail messages | [CHECK: e.g. up to 12 months after the last contact, unless a business relationship follows] |
| Customer and contract records | As long as the relationship lasts, plus the statutory retention period (7 years for tax records under Dutch law) |
| Your cookie choice | See the Cookie Policy |
4. Processors
We use the following service providers, who process data on our behalf under a data processing agreement:
| Processor | Service | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, CDN, security, cookieless Web Analytics | Global network; [CHECK: data region / EU settings] |
| PostHog Inc. (EU Cloud) | Heatmaps and session recordings (after consent) | EU (Frankfurt) |
| [CHECK: contact-form provider, if not handled on Cloudflare] | Contact form | [CHECK] |
| [CHECK: e-mail provider, e.g. Google Workspace / Microsoft 365] | [CHECK] |
We may also share data where required by law or with professional advisers bound by confidentiality.
5. International transfers
Some of our processors are based in, or may access data from, the United States. Where personal data is transferred outside the European Economic Area, we make sure it is protected by:
- the EU-U.S. Data Privacy Framework (DPF), where the recipient is certified under it [CHECK: confirm DPF certification of Cloudflare, Inc. and PostHog Inc. at dataprivacyframework.gov]; or
- the European Commission’s Standard Contractual Clauses, with additional measures where needed.
You can contact us for more information about these safeguards.
6. Security
We take appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS) and access restrictions.
7. Your rights
Under the GDPR you have the right to:
- access your personal data;
- rectification of incorrect data;
- erasure (“right to be forgotten”);
- restriction of processing;
- data portability;
- object to processing based on legitimate interest;
- withdraw consent at any time, without affecting processing before withdrawal (for cookies: see the Cookie Policy).
Send your request to hello@wemember.ai [CHECK: or the dedicated privacy address]. We will respond within one month. We may ask you to confirm your identity.
8. Complaints
If you believe we handle your data incorrectly, please contact us first. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (www.autoriteitpersoonsgegevens.nl), or the supervisory authority in your country of residence.
9. Changes
We may update this policy. The latest version is always published on this page, with the date at the top.