Privacy policy
1. Data controller
Narrowcastingscherm, Gouddonk 4, 4824DG Breda
Email: narrowcastingschermnl@gmail.com
[If a data protection officer has been appointed: add their name and contact details here.]
2. What data we process
When you register, buy a starter package, or use our app, we process:
- Account data: name, email address, password (stored encrypted, never in plain text)
- Billing address: company/person name, address, country, VAT ID if applicable (for invoicing)
- Payment data: processed exclusively through our payment provider Mollie (see section 4) - we ourselves never store card or bank details
- Technical data: IP address and timestamp on login attempts (to protect against abuse, e.g. brute-force attacks), a session cookie for login (technically necessary)
- Biometric login (WebAuthn/passkey), if you set it up: the biometric data itself never leaves your device - we only store a cryptographic key, never fingerprint or face data
3. Purpose and legal basis
We process this data to fulfil our contract with you (Art. 6(1)(b) GDPR) - i.e. to operate your account, provide your license, and issue invoices - and to comply with legal obligations (Art. 6(1)(c) GDPR, e.g. statutory retention periods for invoices).
4. Recipients / processors
To provide our service, we share data with the following providers:
- Mollie B.V. – payment processing. Mollie receives the data needed for payment directly from you. [Review: sign a data processing agreement (DPA) with Mollie if not already in place.]
- [Add hosting provider, e.g. DigitalOcean] – server hosting for this website and your Kassenübersicht installation. [Review: sign a DPA with the hosting provider; document the server location and any transfers outside the EU (e.g. to the US) here.]
- [Add email/SMTP provider] – sending confirmation, invoice, and report emails.
We do not share data with any other third parties, except where legally required to do so.
5. Retention period
We keep account data for as long as your account exists. Invoices are retained due to statutory retention obligations (typically 10 years in Germany), even after account deletion. [Review: define concrete deletion periods for all data categories.]
6. Your rights
You have the right to:
- access to the data we hold about you (Art. 15 GDPR)
- correction of inaccurate data (Art. 16 GDPR)
- erasure, unless a statutory retention obligation applies (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- object to processing (Art. 21 GDPR)
- lodge a complaint with a data protection supervisory authority
To exercise these rights, contact: narrowcastingschermnl@gmail.com
7. Cookies
We use a technically necessary session cookie to keep you logged in. This cookie is required for the site to function and does not require separate consent. We do not currently use any other (e.g. marketing or tracking) cookies. [Review: if this changes, add a cookie banner with a consent mechanism.]