Privacy Policy

Version 1.2

This document is the English-language version of the privacy policy. In the event of any discrepancy between the Dutch-language and the English-language version, the Dutch-language version shall prevail.

Schuldhulpje B.V. is a company registered in the Netherlands, with the following information:

• Company name: Schuldhulpje B.V.
• Address: [ADDRESS PLACEHOLDER]
• Kamer van Koophandel (Chamber of Commerce) number: [KVK PLACEHOLDER]
• VAT number: [VAT PLACEHOLDER]
• Privacy contact: [EMAIL PLACEHOLDER]

This privacy policy is a legal agreement between you (hereinafter referred to as "user", "you" or "your") and Schuldhulpje B.V. (hereinafter referred to as "Schuldhulpje", "we", "us" or "our").

Introduction

At Schuldhulpje, one of our core values is the privacy of our users. We will only use the information that we collect about you lawfully, in accordance with the General Data Protection Regulation (GDPR / AVG), the Dutch GDPR Implementation Act (Uitvoeringswet AVG / UAVG), the Dutch Telecommunications Act (Telecommunicatiewet), and other applicable European and Dutch legislation.

This privacy policy pertains to your access to and use of the Schuldhulpje debt-assistance platform, including the website (the "Site") and any related mobile website, mobile application, or connected media form (collectively, the "Services"). The Services are available exclusively to users within the European Union, as further described in our Terms of Service.

This privacy policy should be read in conjunction with our Terms of Service, which govern your use of the Services.

Data Controller and Processor

For the purposes of the GDPR:

• Schuldhulpje B.V. is the data controller. Schuldhulpje determines the purposes and means of processing personal data collected through the platform.
• Arkintel B.V., a software and AI service provider based in Delft, The Netherlands, acts as a data processor on behalf of Schuldhulpje. Arkintel processes personal data solely in accordance with Schuldhulpje's documented instructions and under a data processing agreement (verwerkersovereenkomst) that meets the requirements of Article 28 GDPR.

If you have any questions about data protection or wish to exercise your rights, please contact us at the privacy contact email address listed at the top of this document.

Data Protection Officer

Schuldhulpje B.V. has not appointed a Data Protection Officer (DPO) as defined in Article 37 GDPR. The processing carried out by Schuldhulpje does not meet the thresholds requiring a DPO appointment under Article 37(1) GDPR, given the limited scale of the current pilot programme and the nature of the data processed.

If you have any questions or concerns regarding data protection, please contact Schuldhulpje at the privacy contact email address listed at the top of this document.

Data Protection Impact Assessment

Schuldhulpje will conduct a Data Protection Impact Assessment (DPIA) in accordance with Article 35 GDPR when the pilot programme transitions to extended or long-term use. The DPIA will cover the use of AI technology for chat assistance and document data extraction, the processing of financial data (debt, income, and expenses), and the involvement of potentially vulnerable data subjects.

Contractual Basis for Processing

By creating an account, you enter into a contract with Schuldhulpje. The processing of your personal data is necessary for the performance of this contract as described in this privacy policy. Where processing is based on other legal grounds (such as legitimate interest), this is specified in the Legal Basis for Processing section below.

If we make material changes to this privacy policy, we will notify you by email so that you are always aware of what information we collect, how we use it, and under what circumstances we process it.

What Information Do We Collect?

We will not collect any personal information about you unless you voluntarily provide it to us. However, you may be required to provide certain information when you register and during your use of the Services in order for us to deliver the service.

Information You Provide Directly

Data we explicitly do not collect: BSN (burgerservicenummer), bank account numbers, identification document copies, or payment information. The service is provided free of charge to users during the current pilot programme.

Providing the data marked as "Yes" (required) in the table above is a contractual requirement necessary for the delivery of the Services. If you do not provide the required data, Schuldhulpje will be unable to provide you with access to the platform. Providing your name is optional and has no effect on your ability to use the Services.

Information from Uploaded Documents

When you upload a document (e.g. a debt letter or invoice), the AI extraction service processes it to extract structured financial data only (creditor names, amounts, dates). The original document is immediately scheduled for deletion after extraction and is typically removed within minutes. We do not store, retain, or make downloadable any uploaded files. Only the extracted structured data is persisted.

Information Collected Automatically

When you access the Services, we may automatically collect the following technical information:

• IP address used to connect to the Services
• Browser type and version
• Device type and operating system
• Date and time of access
• Pages visited and interaction patterns within the platform
• Error logs and technical diagnostic data

This information is collected for the purposes of platform security, error detection, performance monitoring, and service improvement.

Sensitivity of Financial Data

Schuldhulpje acknowledges that debt, income, and expense data — while not classified as "special category data" under Article 9 GDPR — is considered sensitive personal data by the Autoriteit Persoonsgegevens. Users of a debt-assistance platform may be in a financially vulnerable position, which requires heightened care in the handling of their data. Schuldhulpje applies technical and organisational safeguards appropriate to the sensitivity of this data and the vulnerability of its users, as described in the Security Measures section of this policy.

Legal Basis for Processing

Schuldhulpje processes your personal data on the following legal bases (Article 6 GDPR):

Where a specific processing activity is not covered by the above bases, Schuldhulpje will request your explicit consent (Article 6(1)(a)) before processing. You may withdraw such consent at any time by contacting us, without affecting the lawfulness of processing carried out before the withdrawal.

For processing based on legitimate interest, Schuldhulpje has conducted a balancing assessment and concluded that these interests do not override your fundamental rights and freedoms, taking into account the nature of the data, the security measures in place, and the limited scope of such processing.

With respect to the use of postcode and date of birth for demographic pilot evaluation (the legitimate interest use; note that postcode is also processed under contract performance for municipality eligibility verification), Schuldhulpje has conducted a specific balancing assessment in which the following factors were considered:

• Purpose: the legitimate interest pursued is understanding which demographic groups use the platform so that Schuldhulpje can improve its debt-assistance services for those groups.
• Necessity: postcode and date of birth are the minimum data points required for meaningful demographic analysis without collecting more sensitive identifiers (such as full address or BSN).
• Balancing: this data is used exclusively in aggregated and anonymised form for internal analysis. Individual-level postcode or date of birth data is never shared with any third party. Date of birth can be removed from the platform if no longer needed for demographic analysis.
• Safeguards: the data is stored with the same technical and organisational security measures applied to all other user data on the platform, and access is restricted to authorised personnel only.

How Do We Use Your Information?

We use the information we collect for the following purposes:

• Service delivery: to provide and operate the Schuldhulpje platform, including the AI chat assistant, document extraction, and debt tracking features.
• Authentication: to verify your identity when you log in via the email-based authentication system (Keycloak).
• Service improvement: to understand how the platform is used and to improve its features and performance. This is done using aggregated and anonymised data only.
• Security and integrity: to detect, prevent, and respond to security incidents, fraud, abuse, and technical issues.
• Legal compliance: to comply with applicable legal obligations, including responding to lawful requests from public authorities.

We do not use your personal data for:

• Marketing or advertising purposes.
• Selling or renting to third parties.
• AI model training (the AI provider operates under a zero-retention policy).
• Automated decision-making or profiling as defined in Article 22 GDPR.

How Do We Store Your Data?

Storage Locations

• Primary storage: all persistent user data is stored in a database on servers in Delft, The Netherlands, managed by Arkintel B.V. These servers are dedicated to the Schuldhulpje platform.
• Disaster recovery backup: data is backed up to an encrypted offsite location in Dublin, Ireland (EU). This backup exists solely for disaster recovery purposes and is encrypted at rest and in transit.

All data storage and backup locations are within the European Economic Area (EEA).

Security Measures

Schuldhulpje and Arkintel apply appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS 1.3 with modern cipher suites (HTTP/2 and above).
• Encrypted offsite backups.
• Passwordless two-factor authentication via time-limited, single-use login links.
• Backend servers not directly exposed to the public internet; all traffic routed through a CDN with DDoS protection and Web Application Firewall (WAF).
• Access to production systems restricted to authorised Arkintel engineering staff, protected by strong authentication.
• Automated monitoring and alerting for security anomalies.

While we take all reasonable precautions to protect your data, no method of electronic storage or transmission over the internet is 100% secure. We cannot guarantee absolute security, but we commit to addressing any security incident promptly and in accordance with our data breach notification obligations.

Sub-processors

Schuldhulpje and Arkintel engage the following sub-processors for the delivery of the Services:

No data sent to Google is stored, retained, or used for model training after the response is returned. The engagement of Google as a sub-processor is governed by a data processing agreement between Arkintel B.V. and Google that meets the requirements of Article 28(2) and 28(4) GDPR.

Schuldhulpje reserves the right to engage additional sub-processors in the future. Where a new sub-processor is engaged that materially affects the processing of your personal data, this privacy policy will be updated accordingly and users will be notified. If you object to a new sub-processor, you may terminate your account and request deletion of your data. Continued use of the Services after such an update constitutes acceptance of the new sub-processor arrangement.

Data Sharing

• No personal data is shared with third parties. Individual user data is never disclosed, sold, rented, or made available to any external party.
• Anonymised data does not constitute personal data under the GDPR. Schuldhulpje may use such anonymised and aggregated data for research, statistical, and product improvement purposes. If anonymised data is shared with external parties, Schuldhulpje will update this privacy policy accordingly and identify the receiving parties.

Cookies and Tracking Technologies

The Schuldhulpje platform uses only strictly necessary cookies required for the technical operation of the Services. These include:

• Session cookies: to maintain your authenticated session while using the platform.
• Security cookies: to support the authentication flow and protect against cross-site request forgery.

We do not use:

• Analytics cookies (e.g. Google Analytics)
• Advertising or tracking cookies (e.g. Facebook Pixel)
• Third-party cookies for profiling or behavioural tracking

Because the platform uses only strictly necessary cookies, no cookie consent banner is required under the ePrivacy Directive (Directive 2002/58/EC) and the Dutch Telecommunicatiewet.

Web Analytics

Schuldhulpje uses Vercel Web Analytics, a privacy-friendly, cookieless analytics service provided by Vercel Inc. This service collects anonymous, aggregated usage data (such as page views, visitor counts, referring sources, and geographic regions) to help us understand how the platform is used and to improve its performance.

Vercel Web Analytics does not place cookies on your device, does not store IP addresses, and does not track individual users across sessions or websites. Because no information is stored on or read from your device, this service does not require consent under the ePrivacy Directive (Directive 2002/58/EC) or the Dutch Telecommunicatiewet. The legal basis for this processing is legitimate interest (Article 6(1)(f) GDPR) as set out in the Legal Basis for Processing section of this policy.

Data Retention

The Schuldhulpje platform is licensed per subscribing municipality. If a subscribing municipality ceases its use of Schuldhulpje, all user accounts with a postcode belonging to that municipality will be terminated, and personal data will be deleted in accordance with the account termination retention period above (within 30 days). Schuldhulpje will notify affected users by email before such termination takes effect.

Schuldhulpje reserves the right to anonymise personal data upon or after account termination and to retain such anonymised data indefinitely for statistical, research, or product improvement purposes.

International Data Transfers

All primary data storage and backup locations are within the EEA (Delft, Netherlands and Dublin, Ireland).

The Google Gemini AI Enterprise API may process data on infrastructure outside the EEA. This transfer is governed by the EU-US Data Privacy Framework (DPF), under which Google LLC is certified (European Commission adequacy decision of 10 July 2023), and is supplemented by Standard Contractual Clauses (SCCs) between Arkintel and Google. Given the zero-retention policy (no data is stored after processing), the exposure to non-EEA jurisdictions is transient and minimal.

No other international data transfers take place.

Children's Information

The Services are not intended for children. You must be at least 18 years of age to use the Services, which exceeds the Dutch age of digital consent (16 years) under Article 8 GDPR and the UAVG.

Schuldhulpje does not knowingly collect personally identifiable information from children. If we become aware that we have collected personal data from a person under 18, we will take steps to delete that information promptly. If you believe that we have inadvertently collected data from a minor, please contact us immediately at the privacy contact email address listed at the top of this document.

Your Rights Under the GDPR

Under the General Data Protection Regulation, you have the following rights:

• Right of access (Article 15): the right to request confirmation of whether personal data concerning you is being processed, and if so, to request a copy of that data.
• Right to rectification (Article 16): the right to request correction of inaccurate personal data or completion of incomplete personal data.
• Right to erasure (Article 17): the right to request deletion of your personal data where certain conditions apply (e.g. data is no longer necessary for its original purpose, or you withdraw consent).
• Right to restriction of processing (Article 18): the right to request that processing be restricted in certain circumstances (e.g. while the accuracy of data is being verified).
• Right to data portability (Article 20): the right to receive your personal data in a structured, commonly used, and machine-readable format (JSON and/or CSV), and to transmit it to another controller.
• Right to object (Article 21): the right to object to processing based on legitimate interest. Schuldhulpje will cease processing unless it demonstrates compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defence of legal claims.
• Right related to automated decision-making (Article 22): the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Schuldhulpje does not currently engage in such processing.
• Right to withdraw consent: where processing is based on consent, you may withdraw that consent at any time, without affecting the lawfulness of processing before the withdrawal.

How to Exercise Your Rights

To exercise any of these rights, please contact Schuldhulpje at the privacy contact email address listed at the top of this document.

Schuldhulpje will respond to your request within one (1) month of receipt. This period may be extended by a further two (2) months where necessary, taking into account the complexity and number of requests. We will inform you of any such extension within one month, together with the reasons for the delay.

Schuldhulpje may require verification of your identity before processing any request, to protect against unauthorised access to or disclosure of personal data.

Schuldhulpje reserves the right to refuse requests that are manifestly unfounded or excessive, in particular because of their repetitive character, and may charge a reasonable administrative fee in such cases, in accordance with Article 12(5) GDPR.

If the fulfilment of a data subject request results in Schuldhulpje being unable to provide the Services to you, Schuldhulpje will inform you of this and may initiate termination of your account.

Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the GDPR. The competent supervisory authority in the Netherlands is:

Autoriteit Persoonsgegevens Postbus 93374, 2509 AJ Den Haag Website: https://autoriteitpersoonsgegevens.nl

Schuldhulpje encourages you to contact us first so that we can attempt to resolve your concern directly.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Schuldhulpje will notify the Autoriteit Persoonsgegevens without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with Article 33 GDPR.

Where the breach is likely to result in a high risk to your rights and freedoms, Schuldhulpje will also notify you without undue delay, in accordance with Article 34 GDPR. Such notification is not required where:

• Schuldhulpje has implemented appropriate technical and organisational measures that render the personal data unintelligible to unauthorised persons (e.g. encryption);
• Schuldhulpje has taken subsequent measures which ensure that the high risk is no longer likely to materialise; or
• the notification would involve disproportionate effort, in which case a public communication or similar measure will be used instead.

Changes to This Privacy Policy

Schuldhulpje keeps this privacy policy under regular review and will place any updates on this page. The "Version" and "date" fields at the top of this document indicate the current version and effective date.

In the case of material changes that affect your rights or the way your data is processed, we will inform you by email at least fourteen (14) days before the updated policy takes effect. The determination of whether a change is material is at the sole discretion of Schuldhulpje.

For material changes that adversely affect your rights, you will be given the opportunity to reject the changes by terminating your account before the effective date without penalty. If you do not agree with the revised policy, you may terminate your account and request deletion of your data in accordance with the Data Retention section.

Your continued use of the Services after the updated privacy policy takes effect constitutes acceptance of the changes.

Third-Party Links

The Services may contain links to other websites or services. Schuldhulpje is not responsible for the privacy practices or content of any third-party websites. We advise you to review the privacy policies of any external websites before providing personal information to them.

Applicable Law

This privacy policy is governed by the laws of the Netherlands and the General Data Protection Regulation (EU) 2016/679. For dispute resolution, please refer to the Governing Law and Dispute Resolution section of our Terms of Service.

Nothing in this privacy policy limits your right to lodge a complaint with the Autoriteit Persoonsgegevens or to bring proceedings before the courts of your habitual residence in accordance with Article 79 GDPR.