1. Controller
Capibaira B.V.
E-mail: [email protected]
2. Roles
2.1 For the SaaS service, the Customer is the controller for any personal data in Content; Capibaira acts solely as processor.
2.2 For website visits, support, and invoicing, Capibaira is independent controller.
3. Data we process
3.1 Website visits: truncated IP address, user agent, timestamps, and visited pages.
3.2 Website security: use of Google reCAPTCHA for protection against abuse/bots (this may place functional cookies).
3.3 SaaS usage: technical logs (request IDs, status codes) and hashed or anonymized cache for performance; no storage of personal data.
3.4 Invoicing and customer contact: company name, Chamber of Commerce and VAT number, billing address, business email, and phone number.
4. Purposes and legal bases
4.1 Performance of the agreement: providing functionality, support, and invoicing.
4.2 Legitimate interest: security, logging, abuse prevention, and performance improvement.
4.3 Legal obligation: compliance with fiscal retention requirements.
4.4 Capibaira never sells or trades personal data.
5. Recipients and subprocessors
5.1 Infrastructure and hosting: Google Cloud (EU data centers).
5.2 AI processing: OpenAI, xAI, and Microsoft, solely for functionality within the Service.
5.3 Email providers: for support and invoicing communication.
5.4 Website security: Google reCAPTCHA (only on capibaira.com).
5.5 Other vendors: monitoring, error tracking, and analytics (without tracking cookies where possible).
5.6 Data are processed exclusively within the EU, unless a third party is located outside the EEA. In that case, appropriate safeguards apply, such as Standard Contractual Clauses (SCCs).
6. Security
6.1 TLS encryption in transit.
6.2 Encryption at rest.
6.3 Logging and monitoring.
6.4 Tenant separation.
6.5 Backups and recovery procedures.
7. Retention periods
7.1 Technical cache: as long as needed for performance and cost optimization, solely in hashed or anonymized form without personal data.
7.2 Log files: as long as needed for security, error detection, and monitoring.
7.3 Backups: for a limited period necessary for incident recovery.
7.4 Invoicing and administrative data: as required by statutory fiscal retention obligations.
7.5 Support and communication data: as long as reasonably necessary for handling and follow-up of requests.
8. Data subject rights
8.1 Access to personal data.
8.2 Rectification or deletion of personal data.
8.3 Restriction of processing.
8.4 Objection to processing.
8.5 Data portability.
8.6 Requests can be sent to [email protected]. Capibaira will respond within statutory deadlines.
9. Cookies
9.1 Capibaira does not place marketing or tracking cookies.
9.2 On capibaira.com, technically necessary cookies may be placed by the infrastructure (e.g., load balancer, session management) and by Google reCAPTCHA.
9.3 For non-essential cookies, Capibaira requests consent via the cookie banner.
10. Data breaches
10.1 In case of a security incident that likely poses a risk to data subjects, Capibaira will report this in accordance with GDPR to the Dutch Data Protection Authority and, if necessary, to the affected data subjects.
11. Changes
11.1 Capibaira may amend this Privacy Policy. Material changes will be communicated in time and published on capibaira.com.