Privacy

Keep your privacy safe

This privacy policy applies to the website Reinspire.nl, operated by Reinspire Studio, a creative studio based in Amsterdam working on branding, websites, digital products, AI, marketing, content and creative technology.

It governs the privacy of users who choose to interact with our website and services, and of the people whose data we handle while working on projects for our clients.

Questions about privacy? Contact us at info@reinspire.nl.

Privacy policy

This policy outlines:

• How we handle and protect your personal data
• Your rights under the General Data Protection Regulation (GDPR)
• Our obligations as the website owners and service providers

We are committed to ensuring transparency, security, and respect for your privacy. Where we describe what we do, we mean what we do today. Where something is arranged per project, or is still an ambition, we say so.

How we use AI and how we handle confidential client documents is explained in our Superintelligence and Confidentiality policies. Cookies are covered in our Cookie policy.

Privacy by design

When we design new digital products, we start from data minimisation: we only process personal data when it is necessary for a clearly defined purpose. If a feature works without personal data, we build it without.

This is a design principle, not a guarantee that no personal data is ever processed. Websites and apps always involve some technical processing, such as IP addresses on a server. What we promise is that we consciously decide what is needed, and leave out what isn’t.

Data collection

We may collect the following types of personal data when you interact with our website or services:

• Identifiable Information: Name, email address, phone number and company details (submitted voluntarily through forms, email or when booking a call).
• Technical Data: IP address, browser type, operating system, and related technical details.
• Cookies & Tracking Data: Information collected through cookies and similar technologies, only after consent where consent is required. See our Cookie policy.
• Usage Data: Pages visited, time spent, interaction data, and navigation paths.
• Project Data: Information you or your organisation share with us to carry out an assignment, such as briefings, documents and feedback.

How we use your data

We process collected data for the following purposes:

• To provide, maintain, and improve our services.
• To communicate with you regarding inquiries, proposals, and updates (with consent).
• To enhance website functionality and user experience.
• To analyze performance and usage through tools like Google Analytics, only after your consent.
• To comply with legal obligations and protect against fraud or misuse.

Prototypes & demonstrations

Where possible, we start a new product with simulated user experiences, fictional test data and prepared scenarios. That lets us test an idea without involving real people’s data.

Accounts, live AI calls, user photos or collecting research data are not required by default in our prototypes. We only add them when a test really needs them, and after we’ve agreed on it with the client.

Even a simple prototype is hosted somewhere. Hosting providers can technically process IP addresses and server logs, for example to keep the service secure and running.

From prototype to real application

When a prototype is developed into an application that people actually use, we assess per project which additional privacy and security measures are needed.

The documents and checks required, such as a processing agreement, a data flow overview or a DPIA screening, are determined in advance for that project. They are not automatically drawn up for every small prototype.

User tests & informing participants

When people try a prototype or take part in a user test, we inform them briefly and clearly beforehand when that’s relevant. For example with a short information step before a test environment opens, explaining:

• what the test is for,
• what you can and can’t enter (for example: no real personal or sensitive information),
• which data is processed, by whom and for how long,
• who you can contact with questions.

Confirming that you have read this information is not the same as giving consent under the GDPR. Where consent is actually the legal basis, we ask for it separately and explicitly, and you can withdraw it at any time.

Recording & transcribing meetings

Reinspire may record or transcribe internal work meetings for minutes, action points and project continuity. Not every conversation is recorded.

When we do:

• employees and any other participants are informed beforehand,
• the recording has an appropriate legal basis and is necessary for its purpose,
• access is limited to the people who need it,
• we determine how long the recording or transcript is kept, and delete it afterwards.

Calls with clients or external participants are only recorded if this has been announced beforehand. You can always say you’d prefer not to be recorded.

Roles & responsibilities

For our own website, contacts and administration, Reinspire is the controller of your personal data.

In client projects this can differ. For each project we establish who is the controller and who is the processor, and we make clear agreements about the roles of Reinspire, the client and any technical partners. A label in an agreement should always match the actual division of responsibilities, not the other way around.

Data processing agreements

When we process personal data on behalf of a client, we conclude a data processing agreement where the GDPR requires one.

We can work with the client’s own template, provided it fits the actual processing and has been legally reviewed. These agreements are project-specific and are not automatically needed for every prototype.

Partners & suppliers

We work with external partners, specialists and freelancers. One of them is Future Ready, our partner for further app development, technical architecture and additional software expertise. Their involvement differs per project.

When Future Ready or another partner needs access to client information or personal data, their role is laid down in a contract beforehand, including any sub-processor arrangements and confidentiality.

We also use external software, cloud, hosting and AI services. We assess per supplier how data is used, stored and secured. More on this in our Superintelligence policy.

Data flows & technical documentation

For relevant software projects we can draw up a data flow overview: which data is received, where it goes, which suppliers are involved, where it is stored and when it is deleted.

Per project we decide whether a technical data sheet, a document with technical and organisational measures (TOM), a record of processing activities or other evidence is needed. Sensitive architecture details are kept internal.

Privacy impact assessment (DPIA)

For projects with a potentially high privacy risk, we assess in advance whether a Data Protection Impact Assessment (DPIA) is needed.

Education data, sensitive personal data, large-scale processing and certain AI applications can require extra assessment. A DPIA is not a standard requirement for every simple demo.

Data security

We take appropriate technical and organisational measures to secure personal data. What we do today:

• Our website and forms use encrypted connections (HTTPS).
• Access to project files is limited to the people working on that project.
• We use multi-factor authentication for our main business accounts where the service supports it.
• We keep our software, plugins and devices up to date.
• Accounts of people who no longer work on a project are removed or closed.

Additional measures for specific software projects, such as a TOM document or security testing, are agreed per project. We don’t publish technical details that would make misuse easier, and no system is 100% secure.

Incidents & data breaches

In the event of a security incident or data breach:

• We will act as fast as possible to assess and mitigate risks.
• We record the incident: what happened, which data is involved and what we did about it.
• If necessary, we will notify affected users.
• Where we are the controller, we report the breach to the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) within 72 hours of becoming aware of it, where required.

Where Reinspire acts as processor for a client, we inform that client without undue delay. The client, as controller, then assesses whether the breach must be reported to the Autoriteit Persoonsgegevens, generally within 72 hours of becoming aware of it. Project-specific notification periods are laid down in the processing agreement.

Data retention

We retain personal data only as long as necessary to fulfill the purposes outlined:

• Contact form submissions: Up to 12 months unless a longer engagement follows.
• Proposals, invoices and financial records: As long as the statutory retention obligation for business records requires (in the Netherlands generally 7 years).
• Project documents: During the project, then archived or deleted as agreed with the client.
• Recordings and transcripts: Only as long as needed for minutes and action points, as determined per recording.
• Technical logs and backups: According to the retention periods of our hosting and software providers; backups are overwritten in their regular cycle.
• Cookies & Analytics: Retention periods set by service providers (e.g., Google).
• Legal Compliance: Certain records may be stored longer if required by law.

We distinguish between active project files, archived files and data we have to keep by law. Where a project needs specific retention periods, we agree them with the client.

Data transfers outside the EU

Some data may be processed outside the EU (e.g., by third-party service providers such as Google, Meta or cloud hosting).

We ensure safeguards through:

• Services operating under EU adequacy decisions, such as the EU-US Data Privacy Framework
• Standard Contractual Clauses (SCCs) when applicable

Your rights under GDPR

As a user, you have the following rights regarding your personal data:

• Right to Access: Request a copy of your data.
• Right to Rectification: Correct inaccurate or incomplete data.
• Right to Erasure: Request deletion when data is no longer needed.
• Right to Restrict Processing: Limit certain uses of your data.
• Right to Data Portability: Receive your data in a structured format.
• Right to Object: Object to data use based on legitimate interests.
• Right to Withdraw Consent: Withdraw consent at any time.

To exercise your rights, email us at info@reinspire.nl. Tell us what you’d like us to do; we may ask you to confirm your identity. We respond within one month.

Not happy with how we handle your data? Let us know, we’d like to resolve it together. You also have the right to file a complaint with the Autoriteit Persoonsgegevens.

External links

While we include only relevant and safe external links, we cannot guarantee their content.

Users click external links at their own risk. Reinspire Studio is not liable for damages caused by visiting external sites.

Social media platforms

Engagement with our social media accounts is subject to the policies of those platforms. We encourage caution when sharing personal details.

This website may feature social sharing buttons. Social media platforms may track interactions even if you do not click on them.

Shortened links

We may share shortened links on social media. Although we take care, malicious links can exist. We cannot be held responsible for any damages from external or shortened links.

Changes to this policy

Our services and tools evolve, and so does this policy. The latest version is always on this page, with the date it was last updated.