1. Who we are
priceq is a service of Outflanq B.V., Boekweitstraat 62, 2153 GL Nieuw-Vennep, the Netherlands, Dutch Chamber of Commerce (KvK) no. 42160759, VAT ID NL869980646B01. Questions about this statement: [email protected].
Two roles, keep them apart:
- Our website, the sign-up form, invoicing and payments, support and feedback: we are the controller.
- The application: your organisation is the controller for the data of its employees; we are the processor. The arrangements are set out in the data processing agreement.
2. Which personal data we process
Website visitors and sign-ups: what you enter in a contact, demo or sign-up form (name, business e-mail address, company name, your message) plus the IP address and the browser with which you submitted the form. A sign-up is stored in our database, not merely forwarded to a mailbox.
Acceptance of the terms: for each document you accept, which version it was, a fingerprint (SHA-256) of the text shown, the time, the IP address and the browser. We record this when you sign up, and again if you later accept a new version.
Users of the application: name, business e-mail address, role, an Argon2id-hashed representation of the password, personal settings (language, display, alerts), the time and IP address of the most recent login, and, if e-mail to your address bounced, when that happened and the reason the receiving mail server gave.
Login sessions: for each device you are logged in with, we retain a session identifier, the IP address and the browser, so that a session can be revoked.
Audit log: actions relating to accounts and access (inviting someone, changing a role, deactivating or reactivating an account, one of our employees looking along, a request to delete the account), together with who did it, when, from which IP address and with which browser, and what the action concerned, for example the e-mail address of the person invited. That log exists so that it can be established afterwards what happened to accounts. The application cannot modify or delete it; a separate maintenance task erases each entry twelve months after it was written.
Alerts sent: the e-mail address an alert was sent to and whether it arrived.
Company and billing data: the legal name and the address of your organisation as you enter them in the application. If you take out a subscription, you provide a name, e-mail address, billing address and, optionally, a VAT number at checkout. That data goes to Stripe, which processes the payment, and to Moneybird, in which we create the invoice; see §5. You enter your payment details (account or card) with Stripe; we neither see nor store them. We ourselves keep, for each payment, the amount, the date, the VAT treatment and the references to Stripe and Moneybird.
Ad clicks: if you reach our sign-up page through an ad on Google or Microsoft, the address bar carries a click identifier (such as gclid or msclkid) along with the name of the campaign. We store that identifier only if you tick the separate box for it on the sign-up form; that box is not ticked in advance. If you leave it unticked, we store nothing. We set no cookies for this and store nothing in your browser for it.
Deletion request: if an administrator requests deletion of the account in the application, we record the time; who requested it is in the audit log.
Support messages: if you send an e-mail to our support address, we keep your name, your e-mail address, the subject, the text of the message, the name and size of any attachments, and our replies.
Feedback in the application: when you are logged in, the application passes your name, your e-mail address and the name of your organisation to the feedback button. If you submit feedback through that button, that data goes with your message to our own feedback service, so that we know who it is from and can reply to you.
We do not process special categories of personal data and we do not carry out automated decision-making about individuals.
3. What we retrieve from shop sites
The core of priceq is following prices on webshops. From a product page we record the price, the availability, the product designation and the time of measurement. Nothing more. We do not store names, reviews or seller data. We only visit pages that are visible to every visitor without logging in.
That is market data, not personal data; the GDPR does not apply to it. If you nevertheless come across something in your data that is traceable to a person, report it to the address above: we will delete it.
4. Why we process this data
| For what | Legal basis |
|---|---|
| Answering your question, demo request or sign-up | Performance of, or steps prior to, a contract (art. 6(1)(b) GDPR) |
| Giving access to the application, sending the alerts you have set up | Performance of the contract |
| Checking out a subscription and collecting payments | Performance of the contract |
| Answering support questions and feedback | Performance of the contract; for someone who is not a customer: legitimate interest (art. 6(1)(f) GDPR) |
| Recording what you agreed to | Legitimate interest: being able to demonstrate what was agreed |
| Preventing misuse, maintaining the audit log, detecting errors | Legitimate interest: a working and secure service (art. 6(1)(f) GDPR) |
| Invoicing and administration | Legal obligation (art. 6(1)(c) GDPR) |
We do not send commercial e-mail without your consent or an existing customer relationship.
5. Whom we share with, and where it is held
We do not sell data and we do not share it with third parties for their own purposes. We do engage service providers who work for us: hosting, e-mail, error monitoring, backup storage, payments, bookkeeping and the support mailbox. The complete list, stating for each party the purpose, the data category, the country and the transfer mechanism, is set out in the sub-processor list. We announce changes thirty days in advance.
Payments, bookkeeping and support. For these we are ourselves the controller, and these parties work for us, not on behalf of your organisation:
- Stripe processes the payment and receives for that purpose name, e-mail address, billing address, the VAT number if you provide one, and your payment details. Stripe is a US group; transfers to the United States take place on the basis of standard contractual clauses and the EU-US Data Privacy Framework.
- Moneybird (the Netherlands) creates and sends the invoice and receives for that purpose company name, e-mail address, address and VAT number.
- Vimexx (zxcs) (the Netherlands) hosts the mailbox of our support address and thereby receives the name, the e-mail address and the content of the messages you send us.
Website visits. If you accept the cookie bar on the website, Google Ireland Limited processes your visit data for us with Google Analytics. Google may also process that data in the United States, on the basis of standard contractual clauses and the EU-US Data Privacy Framework. Google also measures for us whether a click on one of our Google ads ends in a click on the sign-up button; we share that measurement with Google Ads. We use no personalised advertising and no remarketing. If you refuse, none of this happens.
Ad clicks. If you tick the ad-click box when you sign up, we pass the click identifier on to Google Ireland Limited and Microsoft Ireland Operations Limited respectively, so they can show us which ad led to a trial account or a subscription. Without that tick this does not happen. You can withdraw your consent at any time via [email protected], and we delete the identifier straight away.
Where it is held. The application and the database run within the EU, at Hetzner in Nuremberg. A copy of the backups goes to storage providers outside the EU. Those backups are encrypted before they leave the German cluster; the storage provider receives ciphertext only and does not hold the key. E-mail (alerts, confirmations, messages about your subscription and our replies to support questions) runs via a party in the United States, on the basis of standard contractual clauses and the EU-US Data Privacy Framework.
6. How long we retain data
| What | How long |
|---|---|
| Account data, including last login and bounced e-mail | For as long as the account exists |
| After termination | Anonymised upon closure of your file, no later than 30 days after termination. If an administrator requests deletion himself in the application, a 30-day cooling-off period first applies during which everything keeps working and the request can be withdrawn; after that we erase. We erase sooner on express request |
| Acceptance of the terms | For as long as the agreement runs; after that erased together with the other data of your organisation. The copy made at sign-up: 12 months after handling, like sign-up forms |
| Deletion request | Until the deletion has been carried out or the request withdrawn |
| Audit log | 12 months after the action, even if the account was terminated earlier |
| Login sessions | Until revocation or expiry, then 12 months |
| Alerts sent | 12 months |
| Contact and sign-up forms | 12 months after handling |
| Support messages | For as long as the agreement runs; after that erased together with the other data of your organisation. From someone who is not a customer: 12 months after the last message |
| Legal name and address of your organisation | For as long as the agreement runs; on invoices 7 years |
| Website visits in Google Analytics, after you accept the cookie bar | 14 months; the cookie in your browser six months |
Ad measurement on the website (_gcl_aw), after you accept the cookie bar | the cookie in your browser 90 days |
| Click identifier of an ad | 90 days after your e-mail address is confirmed; the campaign name stays, it says nothing personal about you |
| Price history (not personal data) | 13 months |
| Invoices and administration, including at Moneybird | 7 years (statutory retention obligation) |
7. Your rights
You have the right of access, rectification, erasure, restriction, objection and portability. If you are a user of the application, address your request first to the organisation that created your account: that organisation is the controller. We assist with this. An administrator can export all data of his organisation himself in the application.
You may lodge a complaint with the Autoriteit Persoonsgegevens (the Dutch data protection authority).
8. Security
We take appropriate technical and organisational measures. In brief: data belonging to different customers is separated from one another in the database and that separation is enforced by the database itself, with one deliberate exception: the user accounts and the one-time codes for invitations and password recovery, which are looked up at login before it is known which customer a person belongs to; there the application filters explicitly on the customer number or user number from the logged-in session. Further: passwords are not readable by us; all traffic is encrypted; an encrypted backup is made daily; the application cannot modify the audit log; and access to the production environment is limited to a small group of administrators.
We will send a detailed description of the measures on request; it is also set out in Annex III to the data processing agreement. No measure offers absolute certainty; see also article 8 of the terms of service.
9. Cookies and scripts
In the application we store in your browser only what is needed for the service to work: a cookie that keeps you logged in, and your preferences: your language, your theme and your display settings. No consent is required for these. The application uses no analytical or marketing cookies.
On the website we ask first. On your first visit a bar appears with two buttons. Choose "Accept" and we load Google Analytics, which sets cookies (_ga and _ga_<code>) to see which pages are visited and how visitors move through the site. Those cookies expire after six months. Google then also measures whether a click on one of our Google ads ends in a click on the sign-up button, and shares that measurement with Google Ads; for that, one more cookie is added, _gcl_aw, which expires after 90 days. We do not use Google for personalised advertising or remarketing. Choose "Only what is needed" and we do not load Analytics, and we delete such cookies if an earlier choice left any. Your choice itself is kept in your browser's storage, not in a cookie, and after six months we ask again. You can change your choice at any time through the "Cookies" link at the bottom of every page.
We also count visits with Cloudflare Web Analytics. It works without a cookie and without an identifier that recognises you: we see numbers per page, per country and per device type, not who you are. So we ask no permission for it, and that count keeps running if you choose "Only what is needed" above.
Two components that we do not ship within the application itself are loaded, each for one function: Cloudflare's bot protection (Turnstile) on the sign-up form, and, in the application, the feedback button of our own feedback service (see §2). In addition, the application reports errors that occur in your browser to our error monitoring, without personal data.
10. Changes
We amend this statement when the service changes. The current version is always available on our website, with the date at the top.
Fingerprint of this text (SHA-256): cbfde7d1b3496bed8a774e8f1c64ea97123aaf8bbf5071ac0de2bb752b33f0e5