This Privacy Policy explains how Opttab B.V. ("Opttab", "we", "us") processes personal data when you visit opttab.com, contact us, sign up for or use the Opttab platform, attend our events, or otherwise interact with us. It is written to meet the EU General Data Protection Regulation (GDPR), the Dutch GDPR Implementation Act (UAVG), the Dutch Telecommunications Act and, where they apply, US state privacy laws including the California Consumer Privacy Act as amended by the CPRA.

1. Who is responsible

Opttab B.V., Keizersgracht 520H, 1017 EK Amsterdam, the Netherlands, Chamber of Commerce number 42094716, is the controller for the processing described in this policy.

Contact for privacy questions: privacy@opttab.com
Data protection officer: We have not appointed a data protection officer because we are not required to.

2. When Opttab is a processor, not a controller

Our customers use Opttab to process data about their own website visitors, shoppers and contacts, for example website analytics, crawler logs, product feeds, and End Customer data handled by a Brand Agent. For that data, the customer is the controller and Opttab is a processor acting on the customer's instructions under our Data Processing Agreement. If you are a shopper or visitor of one of our customers, please contact that brand to exercise your rights. We will assist them.

3. What we collect, why, and on what legal basis

Who	Personal data	Purpose	Legal basis (GDPR art. 6)	Retention
Website visitors	IP address, device and browser data, pages viewed, referrer, cookie identifiers	Operate and secure the website	Legitimate interest (art. 6(1)(f))	30 days
Website visitors (with consent)	Analytics cookie data	Measure website use	Consent (art. 6(1)(a))	See Cookie Policy
Prospects and contacts	Name, business email, phone, company, role, messages, meeting notes, demo bookings	Respond to requests, sales follow-up	Steps prior to a contract (art. 6(1)(b)) or legitimate interest (art. 6(1)(f))	24 months after last contact
Business leads from public sources	Name, business email, role, company, public profile data	B2B outreach about our services	Legitimate interest (art. 6(1)(f))	24 months after last contact or until objection
Account users	Name, email, password hash, role, workspace, login and usage logs, settings, support tickets	Provide the platform, security, support, billing	Contract (art. 6(1)(b)); legitimate interest for security and product improvement	Duration of the account plus 12 months
Billing contacts	Name, company, billing address, VAT number, payment status (card data is handled by our payment provider)	Invoicing, payment, accounting	Contract; legal obligation (art. 6(1)(c))	7 years (Dutch tax law, art. 52 AWR, and art. 2:10 BW)
Newsletter subscribers	Email, name, preferences, open and click data	Send product news and content	Consent, or for existing customers soft opt-in (art. 11.7 Telecommunications Act)	Until unsubscribe
Event and webinar participants	Name, email, company, attendance	Organize events, follow-up	Contract or legitimate interest	24 months
Security researchers	Name, email, report content	Handle vulnerability reports	Legitimate interest	3 years
Job applicants	CV, contact details, interview notes	Recruitment	Steps prior to a contract	4 weeks after the process ends, or 1 year with consent

Where we rely on legitimate interests, our interests are running and securing our business, B2B marketing, and improving our services. You can object at any time (section 8).

We do not collect special categories of personal data and ask you not to send them to us.

4. Where data comes from

Mostly directly from you. We also receive data from your employer when it invites you to a workspace, from integrations you connect, from our payment providers, from event partners, and from public professional sources and B2B data providers (such as Apollo and LinkedIn). When we obtain data from third parties, we inform you within one month (art. 14 GDPR), usually in our first message.

5. Who we share data with

Service providers (processors) who host, secure, analyze, support, email and bill for us. See our Subprocessors list.
AI model providers (OpenAI, Anthropic and Google) that power AI features, under terms that do not allow them to train their models on data we send through their APIs. Opttab does not use customer data to train AI models.
Our payment provider, Stripe, which acts as independent controllers for payment processing and fraud prevention.
Professional advisers, such as lawyers, accountants and auditors.
Authorities, where the law requires it.
A buyer or successor in a merger, acquisition or sale of assets, under confidentiality.

We do not sell personal data. We do not share personal data for cross-context behavioral advertising (see section 10 for US residents).

6. International transfers

We store data in the EU, on Amazon Web Services (AWS) in Ireland (eu-west-1). Some providers are located outside the European Economic Area, including in the United States. For these transfers we rely on an adequacy decision (including the EU-US Data Privacy Framework where the recipient is certified) or on the European Commission's Standard Contractual Clauses with supplementary measures. You can ask us for a copy of the relevant safeguards.

7. Security

We use technical and organizational measures appropriate to the risk, including encryption in transit, access controls and logging. See Security and Trust. If a personal data breach occurs that is likely to result in a risk to you, we will notify the Autoriteit Persoonsgegevens within 72 hours and inform you where required.

8. Your rights under the GDPR

You have the right to access, rectify and erase your personal data, to restrict processing, to data portability, and to object to processing based on legitimate interests, including profiling for direct marketing (absolute right). Where processing is based on consent, you can withdraw it at any time without affecting earlier processing. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

To exercise your rights, email privacy@opttab.com. We respond within one month, which can be extended by two months for complex requests. We may need to verify your identity.

You also have the right to lodge a complaint with the Autoriteit Persoonsgegevens (https://autoriteitpersoonsgegevens.nl) or the supervisory authority in your EU country of residence or work.

9. Marketing emails

We send marketing emails to business contacts only with consent or, for customers, about similar products under the soft opt-in rule. Every email includes an unsubscribe link and our postal address. You can unsubscribe at any time.

10. Notice for United States residents

This section applies to residents of US states with comprehensive privacy laws, including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others, to the extent those laws apply to Opttab.

Categories collected in the last 12 months: identifiers (name, email, IP address), commercial information (plan, purchases), internet or network activity (website and platform usage), professional information (company, role), and inferences drawn for sales purposes. Sources, purposes and retention are described in sections 3 and 4. We do not collect sensitive personal information for the purpose of inferring characteristics.

Selling and sharing: We do not sell personal information and do not share it for cross-context behavioral advertising. Our website does not use advertising cookies. If we introduce them, we will ask for consent first and update this policy. The cookie icon in the bottom-right corner of our website also serves as our "Do Not Sell or Share My Personal Information" link, and we honor Global Privacy Control signals.

Your rights: Depending on your state, you can request to know, access, correct, delete and port your personal information, and opt out of sale, sharing, targeted advertising and profiling. We will not discriminate against you for exercising your rights. You may use an authorized agent. If we deny your request, you can appeal by replying to our decision; if we deny the appeal, you may contact your state attorney general.

Children: our services are for businesses and are not directed at children under 16 (or under 13 for COPPA purposes). We do not knowingly collect their personal data. If you believe we have, contact us and we will delete it.

11. Cookies

We use cookies and similar technologies as described in our Cookie Policy.

12. Changes

We may update this policy. We will post the new version here with a new date and, for material changes, inform account holders by email.

13. Contact

Opttab B.V., Keizersgracht 520H, 1017 EK Amsterdam, the Netherlands. Email: privacy@opttab.com.