Privacy notice
Version 2026-11-12. Applies to dpone.info, the DPOne platform, the DPOne Assistant and Telegram @DPOneBot.
1. Who we are
The controller is MBZ Compliance, Vegelinsoord 148, 3079KN Rotterdam, the Netherlands (KvK 98446932), trading as DPOne. Contact: info@dpone.info. Our data protection lead is Mahdi Barkabian Zanjani.
2. What we process, why and on which basis
| Purpose | Data | Lawful basis (GDPR) | Retention |
|---|---|---|---|
| Account & sign-in | Name, email, authentication identifiers, sign-in logs | Art. 6(1)(b) contract | Account lifetime + 30 days |
| Delivering services (assessment, reports, monitoring, DPO) | Company profile, questionnaire answers, uploaded documents, scan results, photo (member card, optional) | Art. 6(1)(b) contract | Contract term + 30-day export window, then deletion within 60 days |
| Contracts & e-signatures | Typed name, timestamp, IP address, user agent, document hash | Art. 6(1)(b) and (c) legal obligation (evidence, tax) | 7 years (art. 52 AWR) |
| Payments & invoicing | Billing details, VAT ID (card data handled only by Stripe) | Art. 6(1)(b), (c) | 7 years |
| Security (bot protection, rate limiting, audit logs) | IP address, request metadata, Turnstile signal | Art. 6(1)(f) legitimate interest in securing the service | Logs: up to 12 months |
| DPOne Assistant (web chat & Telegram) | Your messages, conversation ID; for linked accounts a company-level status summary | Art. 6(1)(b) (answering your request) / 6(1)(f) | 30 days, then automatic deletion; delete any time with “Clear” or /forget |
| Contact form | Name, email, company, message | Art. 6(1)(b)/(f) | 12 months |
| Newsletter (optional) | Art. 6(1)(a) consent (double opt-in) | Until you unsubscribe |
3. AI processing
We use AI providers (OpenRouter-routed models and Google Gemini) on paid tiers whose terms exclude training on your prompts and outputs. For reports we send only minimised, company-level facts — no names or emails. AI drafts; it does not make decisions with legal effects about you (no Art. 22 automated decisions). Critical findings are reviewed by a human DPO. Chatbot answers are general information, not formal legal advice.
4. Recipients and transfers
We use the processors listed on our sub-processor page. Primary storage is in the EU (Firebase Firestore, eur3). Where a provider processes data outside the EEA, we rely on an adequacy decision (incl. the EU–US Data Privacy Framework) or Standard Contractual Clauses with a transfer impact assessment (GDPR Art. 44–49).
5. Cookies
We use only strictly necessary cookies and no third-party trackers. See the cookie policy.
6. Your rights
You have the right to access, rectification, erasure, restriction, portability and objection, and to withdraw consent at any time (GDPR Art. 15–21). Signed-in users can export their data and delete their account under Settings. Otherwise email info@dpone.info; we respond within one month. You may lodge a complaint with the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
7. Security
Encryption in transit and at rest, strict Content-Security-Policy, MFA for administrators, role-based access, hash-chained audit logs, bot protection and rate limiting. We notify the AP within 72 hours of a qualifying breach (Art. 33).
8. Changes
We version this notice and inform account holders of material changes.