Full Privacy Statement
Last updated: September 2026
1. Data Controller
The controller responsible for processing your personal data is:
2Scale Alliances B.V.
privacy@2scalealliances.com
2. What data we collect
2.1 Client & prospect relationship management
Categories: name, business email address, phone number, job title, organisation, LinkedIn profile, conversation notes.
2.2 Alliance Check (intake tool)
Categories: name, business email address, phone number, answers to intake questions, AI-generated summary.
The conversation itself is stored temporarily in your own browser so that you can continue after an interruption. It disappears after 24 hours, and sooner if you submit your details or start over. This copy never reaches our servers.
When you submit your details, we forward them to our CRM and send a notification e-mail. If that delivery fails temporarily, we hold your details in secure intermediate storage (Upstash, via our hosting provider Vercel) and retry automatically. As soon as delivery succeeds, they are deleted from there — at the latest after 30 days.
2.3 Newsletter
Categories: business email address, first name, language preference.
2.4 Website statistics
Categories: aggregated visit data — pages viewed, country, device type, referring site, and counts of anonymous actions (such as starting or completing the Alliance Check). We place no cookies and build no profiles; these figures cannot be traced back to you.
2.5 Contact form
Categories: name, email address, organisation (optional), subject and your message.
Your message is forwarded to us by email; you receive an automatic confirmation at the address you provided. The website itself does not store the message.
2.6 Protection against misuse
Categories: IP address.
To protect the website against spam and misuse, we count per IP address how often the Alliance Check, the contact form and the newsletter sign-up are used. This count is kept for no more than 24 hours, in intermediate storage within the EU (Upstash, Frankfurt), and is not linked to the other details you enter.
3. Who we share your data with
We only engage third-party processors where necessary for the services described above. All processors have a Data Processing Agreement (DPA) in place. For transfers outside the EU/EEA, we rely on the EU-U.S. Data Privacy Framework or Standard Contractual Clauses (SCCs, Art. 46 GDPR).
(Descriptions in Dutch — original language of this register)
| Party | Service | Country | Outside EU? | Transfer basis |
|---|---|---|---|---|
| Anthropic PBC | AI-Advisor in de Alliance Check (vraag-en-antwoord-flow) | Verenigde Staten | Yes | EU-U.S. Data Privacy Framework / SCCs (Art. 46 GDPR) |
| Cloud86 B.V. | SMTP-relay voor uitgaande mail (digest, password-reset) | Nederland | No | Within EU/EEA |
| GitHub Inc. | Versiebeheer (private repository) — alleen code, geen klantdata | Verenigde Staten (Microsoft) | Yes | EU-U.S. Data Privacy Framework / SCCs (Art. 46 GDPR) |
| MailerLite | Newsletter-platform — versturen + abonnee-beheer | Litouwen (EU) | No | Within EU/EEA |
| Resend (Plus Five Five, Inc.) | Transactionele e-mail — leadnotificaties en contactformulier | Verenigde Staten | Yes | EU-U.S. Data Privacy Framework / SCCs (Art. 46 GDPR) |
| Synology Inc. | Self-hosted NAS-hardware (DSM, Docker-runtime) | Taiwan (hardware) / Nederland (deployment-locatie) | No | Within EU/EEA |
| Upstash, Inc. | Tussenopslag website — spambescherming en vangnet voor Alliance Check-aanvragen | Verenigde Staten (bedrijf); opslag in de EU (Frankfurt) | Yes | EU-U.S. Data Privacy Framework / SCCs (Art. 46 GDPR) |
| Vercel Inc. | Hosting van de publieke 2SA-website, Alliance Check-formulier en websitestatistieken | Verenigde Staten | Yes | EU-U.S. Data Privacy Framework / SCCs (Art. 46 GDPR) |
4. Retention periods
- Client data: duration of the relationship + 5 years.
- Unprocessed leads: 12 months from last contact.
- Newsletter subscribers: until unsubscribe + 6 months.
- Invoice data: 7 years (statutory fiscal retention obligation).
- Messages sent via the contact form: as long as needed to handle them; if they lead to further contact, the period for client data or leads above applies.
- IP addresses for protection against misuse: no more than 24 hours.
5. Your rights
Under the GDPR you have the right to: access, rectification, erasure, restriction of processing, data portability, and the right to object. Send your request to privacy@2scalealliances.com. We will respond within one month. Please include a copy of a valid identity document so we can verify your identity.
6. Complaints
If you believe we have not handled your data correctly, you have the right to lodge a complaint with a supervisory authority. For EU/Netherlands residents: Autoriteit Persoonsgegevens (Tel. 070-8888 500). For UK residents: Information Commissioner's Office (ICO).
7. Changes
We may update this privacy statement from time to time. Last updated: September 2026.