ENDOXIA B.V.
PRIVACY STATEMENT
Privacy Statement
How Endoxia B.V. processes personal data as a data controller under the GDPR.
VERSION
1.1
STATUS
Final
EFFECTIVE DATE
[to be completed]
DOCUMENT TYPE
Privacy Statement
Endoxia B.V.
Tweede Jan van der Heijdenstraat 16-1, 1073 VH Amsterdam, Netherlands
endoxia.com · privacy@endoxia.com
Confidential · © 2026 Endoxia B.V. · All rights reserved.
Table of Contents
1. Who are we? 2
2. Contact details 2
3. What personal data do we process? 2
4. Users of the Platform 2
5. Representatives of customers and suppliers 3
6. Website visitors 4
7. Cookies 4
8. Contact requests 4
9. Newsletter 5
10. Job applicants 5
11. Personal data in customer data 5
12. AI functionalities 6
13. Purposes of processing 6
14. Obligatory information 6
15. Retention periods 6
16. Sharing of personal data 7
17. Subprocessors 7
18. International transfers 7
19. Security 8
20. Your rights 8
21. Third-party websites 8
22. Complaints 9
23. Amendments 9
24. Contact 9
PRIVACY STATEMENT endoxia.com
1. Who are we?
Endoxia B.V. (“Endoxia”, “we”, “us”, “our”) develops and operates an AI-driven software platform for professional service providers and organisations working with complex documents, knowledge-intensive processes, regulations, transactions, compliance issues and advisory activities.
This Privacy Statement describes how Endoxia processes personal data when acting as a data controller within the meaning of the General Data Protection Regulation (“GDPR”).
For personal data processed by customers through the Platform, Endoxia acts in principle as a data processor. The Data Processing Agreement applies to those processing operations.
2. Contact details
Endoxia B.V.
Tweede Jan van der Heijdenstraat 16-1
1073 VH Amsterdam
Netherlands
Website: endoxia.com
E-mail: privacy@endoxia.com
3. What personal data do we process?
We process personal data of:
users of the Platform;
representatives of customers;
suppliers;
website visitors;
newsletter recipients;
job applicants;
persons who contact Endoxia.
4. Users of the Platform
When a user is granted access to the Platform, we may process the following data.
ACCOUNT DATA
name;
business e-mail address;
organisation;
user ID;
authentication data.
USAGE DATA
login times;
session data;
IP address;
device data;
browser information;
usage statistics;
log files;
interactions with functionalities.
PURPOSES
account management;
authentication;
security;
support;
product improvement;
performance analysis;
fraud prevention.
LEGAL BASIS
performance of the contract;
legitimate interest;
legal obligations where applicable.
5. Representatives of customers and suppliers
We may process:
name;
job title;
company name;
e-mail address;
telephone number;
invoice details;
payment details;
correspondence.
PURPOSES
relationship management;
contract management;
invoicing;
administration;
support;
compliance with legal obligations.
LEGAL BASIS
performance of the contract;
legal obligations;
legitimate interest.
6. Website visitors
When you visit our website, we may process:
IP address;
browser type;
device type;
operating system;
language settings;
visited pages;
times of visits;
cookie data.
PURPOSES
functioning of the website;
security;
performance improvement;
statistical analysis;
error detection.
LEGAL BASIS
legitimate interest;
consent where legally required.
7. Cookies
Our website and the Platform use cookies and similar techniques. A cookie is a small text file that is placed on your device during a visit and recognises your browser or device on a subsequent visit.
We use functional, analytical and tracking cookies. We only place tracking cookies with your consent. For a full overview and your setting options, please refer to our Cookie Policy.
8. Contact requests
When you contact us, we may process:
name;
e-mail address;
telephone number;
content of the correspondence.
PURPOSES
answering questions;
handling complaints;
providing support;
improving support services.
LEGAL BASIS
legitimate interest;
performance of the contract.
9. Newsletter
When you sign up for our newsletter, we process:
name;
e-mail address.
PURPOSES
sending newsletters;
product updates;
events;
company news.
LEGAL BASIS
consent.
An unsubscribe link is included in every newsletter. You can unsubscribe at any time.
10. Job applicants
If you apply for a job at Endoxia, we may process:
name;
contact details;
curriculum vitae;
covering letter;
work experience;
education details;
LinkedIn profile and other public profiles;
interview notes.
PURPOSES
assessment of job applications;
selection procedures;
communication during the recruitment process.
LEGAL BASIS
legitimate interest;
consent where required.
11. Personal data in customer data
Personal data entered by customers or users into the Platform is, in principle, processed on behalf of the customer.
In that situation:
the customer is the data controller;
Endoxia is the processor.
For these processing activities, the Data Processing Agreement applies. Data subjects should in the first instance contact the respective customer.
12. AI functionalities
The Platform uses artificial intelligence.
When customers process documents or information through the Platform, personal data may be part of that processing. Endoxia uses such personal data solely to provide the agreed services.
NO AI TRAINING WITHOUT CONSENT
Endoxia does not use customer data for:
training of AI models;
fine-tuning of AI models;
improvement of AI models,
unless the customer in question has given prior explicit consent for this.
13. Purposes of processing
We process personal data for:
delivery of the Platform;
account management;
security;
support;
invoicing;
contract management;
product improvement;
statistical analysis;
fraud prevention;
compliance with legislation;
communication;
recruitment.
14. Obligatory information
In certain cases, it is legally or contractually required that you provide us with certain personal data, for example your contact details. If you do not provide this data, this may mean that we cannot provide you with certain Services or execute part of our agreement with you.
15. Retention periods
We do not retain personal data longer than necessary. In principle, the following periods apply:
Category
Retention period
Account data
30 days after deletion
Contract data
5 years after end of relationship
Invoice details
7 years
Correspondence
2 years
Newsletter data
Until unsubscription
Job applications
4 weeks after rejection, or up to 1 year with consent
Log files
Maximum 12 months
If legal obligations require a longer period, that longer period applies.
16. Sharing of personal data
We may share personal data with:
hosting providers;
cloud providers;
e-mail providers;
support suppliers;
security suppliers;
payment providers;
accountants;
legal advisers;
supervisory authorities;
government bodies.
We only share data to the extent necessary.
17. Subprocessors
For the delivery of the Platform, Endoxia uses specialised suppliers.
An up-to-date overview of Subprocessors can be requested via privacy@endoxia.com.
18. International transfers
Endoxia in principle processes personal data within the European Economic Area.
If transfer outside the EEA is necessary, we ensure appropriate safeguards in accordance with the GDPR, including where necessary:
adequacy decisions;
Standard Contractual Clauses;
additional security measures.
19. Security
Endoxia takes appropriate technical and organisational measures to protect personal data. These measures include:
encryption during transport;
access control;
authentication;
logging;
monitoring;
network security;
backups;
incident management;
supplier assessments.
20. Your rights
You have the following rights under the GDPR:
access – you can ask us for access to and a copy of your personal data;
rectification – you can ask us to correct inaccurate or incomplete data;
erasure – you can ask us to erase your data (the “right to be forgotten”);
restriction – you can ask us to temporarily restrict the use of your data;
data portability – you can ask us to transfer your data in a commonly used format;
objection – you can object to certain processing operations, including direct marketing;
withdrawal of consent – where the processing is based on consent, you can withdraw it at any time.
Requests can be addressed to privacy@endoxia.com. We may ask for additional information to verify your identity.
21. Third-party websites
Our website may contain references (hyperlinks) to websites, products or services of third parties. Endoxia has no control over these websites and is not responsible for their content or for the way in which these third parties handle personal data. The terms and conditions and privacy statements of those third parties apply to the use of third-party websites.
22. Complaints
You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via autoriteitpersoonsgegevens.nl.
23. Amendments
Endoxia may amend this Privacy Statement. The most current version is published on endoxia.com.
We will inform users and customers of any material changes.
24. Contact
For questions about privacy or data protection:
Endoxia B.V.
Tweede Jan van der Heijdenstraat 16-1, 1073 VH Amsterdam
Privacy Officer: privacy@endoxia.com
Website: endoxia.com