Privacy
Privacy statement
Last updated: 5 October 2026
This statement explains which personal data AIstap processes, why, for how long and with which parties.
Who we are
AIstap, based in Tilburg, the Netherlands, is responsible for the processing of personal data described in this statement (the "controller" within the meaning of the GDPR). Contact: [email protected].
Which data we process, and why
Form on this website
Your name, company name, work email address, phone number and your short description. We also record on which page and in which language you filled in the form, through which link or website you arrived, and when you gave consent.
We use this data to contact you and follow up on your request. Legal basis: your consent via the tick box in the form (Art. 6(1)(a) GDPR). Once we schedule an analysis or workshop together, the legal basis is taking steps at your request prior to entering into a contract (b).
Email, phone and online calls
Your name, contact details, the content of your message and our notes of a conversation, to answer you and prepare an appointment. Legal basis: steps at your request prior to entering into a contract (b) or our legitimate interest in answering questions (f).
Clients
The contact and billing details needed to carry out and invoice the assignment. For workshops also the participants' names, and their email address if it was provided, for the certificate of attendance. Legal basis: the contract (b) and our legal obligation to keep records (c).
Website visits
Technical data, such as your IP address, to deliver the website and protect it against abuse. Legal basis: our legitimate interest in a secure, working website (f).
Company data from public sources
To approach companies that may benefit from our services, we compile a list of Dutch companies. We do not get this data from you but from public sources, such as company websites, job vacancy sites and public registers. That is why we inform you here (Art. 14 GDPR).
Which data: company details (such as name, address, website, sector, and the general phone number and email address), a contact person's name and role, and our notes on the contact with your company.
Purpose: approaching your company with our offer.
Legal basis: our legitimate interest in bringing our business to the attention of other businesses (Art. 6(1)(f) GDPR).
Objection: you can object at any time and without giving a reason, via [email protected] or during the call. We then stop approaching your company.
Who we share data with
We only share data with service providers that process it on our behalf (processors): providers of hosting and database, email, video calling, and AI software with which we summarise public company information.
Some of these parties are based in the United States. When data is processed outside the European Economic Area (EEA), this is done with appropriate safeguards, such as the European Commission's standard contractual clauses. You can request an overview of these parties and safeguards via [email protected].
How long we keep data
| Data | Retention |
|---|---|
| Requests via the form | At most 12 months after the last contact if there is no follow-up |
| Appointments and contact history | At most 24 months after the last contact |
| Company data from public sources | At most 24 months after the last contact |
| Do-not-contact record | Only the company name and phone number, as long as needed to respect your objection |
| Workshop certificates | 24 months |
| Client data and invoices | 7 years (statutory retention obligation) |
We keep back-ups for at most 3 months.
Cookies
This website does not set cookies itself and uses no tracking or advertising networks. Our hosting provider may set a strictly necessary security cookie to prevent abuse of the website. Such a cookie does not require consent.
Your rights
You have the right to access your data, have it corrected or deleted, restrict its processing, have it transferred (data portability) and object. If you gave consent, you can withdraw it at any time; this does not affect what was lawfully done before.
Email your request to [email protected]. We respond within one month.
You can also lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.