Privacy Policy

Introduction

Distriqo B.V. ("Distriqo", "we", "us" or "our") respects your privacy and is committed to protecting personal data. This Privacy Policy explains how we collect, use, store, disclose and protect personal data when you visit our websites, use our software platform, customer portals, APIs, integrations, AI-powered features, mobile applications, support services or any related services operated by Distriqo B.V. (together, the "Services").

Distriqo provides business software for companies, including ERP, order management, inventory management, invoicing, logistics, integrations and AI-assisted functionality. In providing these Services, we may process personal data relating to customers, users, employees of customers, suppliers, business contacts and website visitors.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Dutch GDPR Implementation Act (Uitvoeringswet AVG) and other applicable European and Dutch data protection laws.

This Privacy Policy should be read together with our Cookie Policy, Terms & Conditions and, where applicable, our Data Processing Agreement (DPA).

Who we are

The controller for personal data processed for our own business purposes is:

For personal data contained in customer-uploaded business data, Distriqo generally acts as a processor on behalf of the customer. In those cases, the customer is the controller and determines the purpose and means of processing.

Scope of this Privacy Policy

This Privacy Policy applies to all websites, software applications, customer portals, APIs, integrations, AI-powered features and related services operated by Distriqo B.V., unless a specific service provides a separate privacy notice.

This Privacy Policy applies to:

• Visitors to Distriqo websites
• Prospects who request a demo, quote or information
• Customers and their authorized users
• Users of Distriqo applications, portals and APIs
• People who contact Distriqo for support or commercial inquiries
• Recipients of service communications and, where consent is provided, marketing communications

This Privacy Policy does not apply to third-party websites, applications or services that are not controlled by Distriqo, even if they are linked to or integrated with our Services.

Definitions

Personal data we collect

The personal data we process depends on how you interact with Distriqo and which Services are used.

5.1 Identity and business contact data

• First and last name
• Job title or role
• Company name
• Business email address
• Business telephone number
• Business address

5.2 Account and authentication data

• Username or login identifier
• Password or authentication information in protected form
• User roles, permissions and access rights
• Account settings and preferences
• Security logs and login history

5.3 Billing and payment data

• Billing address
• VAT number
• Payment status
• Subscription plan and order details
• Invoice information
• Payment method details processed through Stripe, Mollie or bank transfer

Distriqo does not store full payment card details. Card and payment data are processed by the relevant payment provider.

5.4 Technical and usage data

• IP address
• Device and browser information
• Operating system
• Log files
• Session information
• Pages visited and actions performed
• Feature usage and performance metrics
• API usage and integration logs

5.5 Support and communication data

• Support requests
• Email communications
• Feedback and survey responses
• Demo requests
• Commercial inquiries
• Internal notes required to handle a support or sales request

5.6 Customer Data uploaded or stored in the Services

Customers may upload, enter, store or generate Customer Data in the Services. This may include personal data about their customers, suppliers, employees, contractors or other business contacts. Examples include:

• Customer and supplier records
• Employee or team member information
• Orders, invoices and transaction data
• Inventory and logistics information
• Uploaded documents and files
• Notes, messages, workflows and operational records

For Customer Data, Distriqo processes the data only to provide the Services and in accordance with the customer's instructions, unless we are legally required to do otherwise.

5.7 Cookies and similar technologies

We use cookies and similar technologies to operate and secure our websites and Services. With consent where required, we may also use analytics and marketing technologies. More information is available in our Cookie Policy.

How we collect personal data

We collect personal data in several ways:

• Directly from you when you contact us, request a demo, create an account, subscribe to Services or communicate with support.
• Automatically when you use our websites, platform, APIs or integrations.
• From customers who invite users, add team members or upload Customer Data.
• From authorized integrations selected by customers.
• From payment providers where necessary for payment confirmation and administration.
• From consent management, analytics or marketing tools where enabled and permitted.

Customers are responsible for ensuring that personal data they upload or connect to Distriqo is collected and processed lawfully.

Purposes of processing

We process personal data for the following purposes:

• Providing, operating and maintaining the Services
• Creating and managing customer accounts and user access
• Providing ERP, order management, inventory, invoicing, logistics, AI and integration functionality
• Processing subscriptions, invoices and payments
• Providing customer support and responding to inquiries
• Securing the Services and preventing fraud, abuse or unauthorized access
• Monitoring performance, reliability and service quality
• Improving and developing our products and services
• Complying with legal, tax, accounting and regulatory obligations
• Sending service-related communications
• Sending marketing communications where permitted or where consent has been obtained

Legal bases for processing

Where Distriqo acts as controller, we rely on one or more legal bases under the GDPR.

8.1 Performance of a contract

We process personal data where necessary to provide the Services, manage subscriptions, administer accounts, process payments and deliver customer support.

8.2 Legal obligation

We process certain personal data to comply with legal obligations, including tax, accounting, bookkeeping and regulatory obligations.

8.3 Legitimate interests

We may process personal data where necessary for our legitimate interests, provided those interests are not overridden by the rights and freedoms of individuals. These interests include:

• Information security
• Fraud prevention
• Service improvement
• Business administration
• Customer relationship management
• Internal analytics and performance monitoring
• Enforcing our Terms & Conditions

8.4 Consent

We rely on consent where required by law, including for certain cookies, analytics, marketing communications and advertising technologies. Consent can be withdrawn at any time.

8.5 Processing as processor

Where Distriqo processes Customer Data as a processor, the customer determines the legal basis for processing. Distriqo processes that data under the customer's documented instructions and the applicable DPA.

Customer Data ownership and use

Customers retain all rights, title and interest in Customer Data uploaded, stored or processed through the Services. Distriqo does not claim ownership of Customer Data.

Distriqo receives only the limited rights necessary to host, process, transmit, back up, display and otherwise handle Customer Data as required to provide the Services, support the customer and comply with legal obligations.

Unless expressly agreed otherwise, Distriqo will not:

• Sell Customer Data
• Use Customer Data for advertising
• Use Customer Data to train Distriqo's own AI models
• Access Customer Data except where necessary for support, security, maintenance, legal compliance or service delivery

User accounts and access management

Customers may create accounts, invite users, assign roles and permissions, upload documents and store business data. Customers are responsible for managing user access, ensuring that only authorized users have access, and removing access when it is no longer required.

Users are responsible for keeping login credentials secure and for promptly reporting suspected unauthorized access to the customer administrator or Distriqo.

AI-powered features

Distriqo may offer AI-powered features to assist with business workflows, automation, analysis, document processing, data interpretation or other platform functions. Use of AI features is optional and may depend on the customer's configuration.

When a customer uses AI features:

• Data may be processed to provide the requested functionality.
• Processing may be performed by approved AI service providers, such as OpenAI, where applicable.
• Customer Data is not used to train Distriqo's own AI models.
• Distriqo does not claim ownership of customer inputs or outputs.
• AI outputs may be inaccurate, incomplete or unsuitable for a particular purpose and should be reviewed by a human before business decisions are made.

Customers are responsible for ensuring that they have the legal right to submit data to AI features and that AI outputs are used appropriately within their organization.

Payments and billing

Distriqo may offer payment through Stripe, Mollie and bank transfer. Payment providers process payment information according to their own terms and privacy notices. Distriqo receives payment confirmation, invoice details and related administrative information necessary to manage subscriptions and accounting.

Financial records, invoices and accounting information are retained in accordance with applicable Dutch tax and bookkeeping obligations.

Marketing and newsletters

Distriqo may send marketing communications, product updates or newsletters where permitted by law or where consent has been obtained. Newsletter functionality is planned and may be provided through Mailchimp or similar providers.

Recipients can unsubscribe from marketing communications at any time using the unsubscribe link in the message or by contacting privacy@distriqo.com. Service-related communications, such as security notices, billing information and important platform updates, may still be sent where necessary.

Analytics and advertising

Distriqo currently uses limited analytics and may introduce or expand analytics and advertising technologies in the future. Analytics may include Google Analytics or similar tools. Advertising may include remarketing, conversion tracking or campaign measurement.

Where required by law, analytics cookies, advertising cookies and tracking technologies will only be used after valid consent has been obtained through a consent management solution such as Cookiebot. Users can manage or withdraw consent through the cookie preference tool.

Cookies

Cookies are small files placed on your device to help websites and applications function properly. Distriqo may use strictly necessary cookies, functional cookies, analytics cookies and marketing cookies. Non-essential cookies are used only where permitted and, where required, after consent.

More information about the cookies we use, their purposes and how to manage preferences is available in our Cookie Policy.

Hosting, storage and infrastructure

Distriqo aims to host and process Customer Data within the European Economic Area (EEA). Hosting providers may vary depending on customer requirements, service configuration, availability, security, compliance needs and contractual arrangements.

Where hosting or infrastructure providers are used, Distriqo requires appropriate security and data protection safeguards. Customers with specific hosting or data residency requirements should agree those requirements in writing.

Subprocessors and third-party service providers

Distriqo uses selected third-party providers to operate, secure, improve and deliver the Services. Depending on the Services used and customer configuration, these may include:

Where required, Distriqo enters into appropriate agreements with subprocessors or service providers. Distriqo remains responsible for its subprocessors as required by applicable data protection law.

International transfers

Distriqo aims to process Customer Data within the EEA. If personal data is transferred outside the EEA, Distriqo will use appropriate safeguards where required, such as adequacy decisions, Standard Contractual Clauses or other approved transfer mechanisms.

Some providers may have group companies or support operations outside the EEA. In those cases, we require appropriate contractual and organizational safeguards where applicable.

Security measures

Distriqo takes appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. Measures may include:

• Encryption of data in transit where appropriate
• Role-based access controls
• Authentication and access management
• Least-privilege access principles
• Logging and monitoring
• Backup and recovery procedures
• Secure development and deployment practices
• Incident response procedures
• Confidentiality obligations for personnel
• Review of suppliers and subprocessors

No system can guarantee absolute security. Customers and users also have responsibility for secure use of the Services, including appropriate access management and protection of credentials.

Data retention

Distriqo retains personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required by law, contractual obligations, dispute resolution, security or legitimate business needs.

When data is no longer required, we delete it, anonymize it or retain it only where legally permitted or required.

Data export and deletion

Customers may request export or deletion of Customer Data in accordance with the applicable agreement, DPA and technical capabilities of the Services. Certain data may be retained where required by law, for security purposes, to resolve disputes or to maintain legitimate business records.

After termination of the Services, Customer Data may remain in backups for a limited period before being overwritten or deleted according to backup retention cycles.

Your GDPR rights

Where applicable, individuals have the following rights under the GDPR:

To exercise your rights, contact privacy@distriqo.com. We may need to verify your identity before responding. If your request relates to data processed on behalf of a customer, we may refer the request to that customer or assist the customer in responding.

Complaints and supervisory authority

If you have concerns about how we process personal data, please contact us first at privacy@distriqo.com so we can try to resolve the matter.

You also have the right to lodge a complaint with a data protection authority. In the Netherlands, the supervisory authority is the Autoriteit Persoonsgegevens.

Children and age restriction

The Services are intended for business users aged 18 years and older. Distriqo does not knowingly collect personal data from children. If we become aware that personal data of a child has been collected without appropriate authorization, we will take reasonable steps to delete it.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our Services, technology, legal requirements or business operations. The latest version will be published on our websites. Material changes may also be communicated through the Services or by email where appropriate.

Contact

For privacy questions, data subject requests or other privacy-related matters, contact:

• Distriqo B.V.
• Kempenbaan 5, 5121 DM Rijen, The Netherlands
• Email: privacy@distriqo.com

Appendix — Practical privacy summary

This summary is provided for convenience and does not replace the full Privacy Policy above.

• You own your data.
• Distriqo does not sell customer data.
• Customer Data is not used to train Distriqo's own AI models.
• Distriqo aims to host data in Europe.
• DPA available for customers.
• You can contact privacy@distriqo.com for privacy requests.