Privacy statement

Article 1: Who we are

VYRA Software Solutions B.V. ("VYRA", "we") is the controller for the personal data processed through our platform and website, as described in this statement. Questions: [email protected].

Article 2: Starting point: data minimisation

We process as little personal data as possible. Payment data is processed entirely by our payment provider Stripe, which acts as an independent controller for that purpose; we do not receive or store payment data. The data we use to analyse and improve the service is anonymised and contains no names or other directly identifying details.

Article 3: Which data we process

From business customers (account holders):

• Account and contact details: the user's e-mail address, name, optional profile photo and preferred language; the name and telephone number of the organisation.
• Billing details: processed through Stripe; we only receive invoice status, amounts and Stripe references, never card details.
• Platform usage data: the business data you enter and the insights generated from it (see the Terms and Conditions).

From website visitors:

• Only the functional data needed to make the website work. See the Cookie Policy.

From guests (VYRA Views):

• Views does not ask for a name, e-mail address, telephone number or other contact details. Free-text answers may contain personal data if the guest enters it; we do not actively process it and delete it on request via [email protected].

Article 4: Purposes and legal bases

Article 5: Intended analysis of platform usage

We are considering analysing behavioural data on the platform (such as click paths and navigation order) to improve the flow and layout of the application. We do not do this at the moment. As soon as we start, we will update this statement and determine the appropriate legal basis. Where such analysis can be traced to an individual logged-in user, we will inform you and provide the required legal basis; wherever possible the analysis is aggregated or anonymised.

Article 6: Third parties (processors)

We use the following service providers, which process personal data on our behalf. A data processing agreement is or will be in place with each of them.

Article 6a: Independent controllers

Some parties process personal data as independent controllers, not on our behalf:

• Stripe processes payment data as an independent controller. Both we and the customer have our own relationship with Stripe. Stripe's privacy policy applies to this processing and can be found at https://stripe.com/privacy. How Stripe processes data as part of its payment services is described further in Stripe's data processing terms (https://stripe.com/legal/dpa).

Article 7: Retention periods

We do not keep personal data longer than necessary. We keep account data for the duration of the subscription and for 90 days afterwards, after which we delete it permanently. We keep invoice data in accordance with the statutory tax retention obligation (7 years). Anonymised data falls outside these periods because it is not identifiable.

Article 8: Transfers outside the EEA

Where our processors process data outside the EEA, this takes place under appropriate safeguards such as the standard contractual clauses of the European Commission. Transfers of payment data by Stripe are governed by Stripe's own policy and safeguards, as described in Stripe's privacy policy (https://stripe.com/privacy).

Article 9: Your rights

You have the right to access, rectify, erase and restrict your data, to object, and to data portability. Send requests to [email protected]. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Article 10: Security

We take appropriate technical and organisational measures to protect personal data, including encrypted connections (TLS), encrypted storage of keys, separation of customer data at database level, multi-factor authentication for administrators, per-user access control, monitoring and logging of administrative actions, and daily backups.

Article 11: Changes

We may amend this privacy statement. The current version is always available at vyra.works/en/legal/privacy.