Privacy Policy

Conciar (“Conciar”, “we”, “us”, or “our”) is the data controller responsible for your personal data. We are a sole proprietorship (eenmanszaak) registered in the Netherlands and headquartered in Rotterdam.

If you have questions or concerns about how we handle your personal data, please contact our Data Protection Officer at dpo{'@'}conciar.com.

We collect personal data in the following categories:

We do not knowingly collect personal data from children under the age of 16. If you believe we have inadvertently collected such data, please contact us immediately.

We process your personal data on the following legal bases and for the following purposes:

We do not sell your personal data. We share data only in the following circumstances:

• Service providers. We engage trusted third-party processors (such as cloud hosting, payment processing, and email delivery providers) who act on our instructions and are bound by data processing agreements.
• Analytics and advertising partners. Only if you allow analytics or marketing cookies: Google receives your visits to our website for statistics (Google Analytics), and Meta Platforms Ireland receives your visits and — when you create an account — your email address and name in hashed (scrambled) form, to measure our ads on Facebook and Instagram. For ad measurement Meta and Conciar are joint controllers. You can withdraw consent at any time in the cookie settings.
• Business transfers. If Conciar is acquired, merged, or sold, your data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.
• Legal requirements. We may disclose your data if required to do so by law or in response to valid requests from public authorities (e.g. courts or government agencies).
• Protection of rights. We may share data to enforce our Terms of Service, prevent fraud, or protect the rights, property, or safety of Conciar, our customers, or the public.

Conciar is headquartered in the Netherlands and primarily stores and processes data within the European Economic Area (EEA). Some of our third-party service providers may process data outside the EEA. This includes Google (website analytics) and Meta (ad measurement), which may process data in the United States under the EU–U.S. Data Privacy Framework.

Where we transfer personal data outside the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or we rely on an adequacy decision confirming the destination country provides an equivalent level of data protection.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, to provide the Service, and to comply with our legal obligations.

After termination of your account, your Customer Data is retained for 90 days to allow data export requests, after which it is permanently deleted unless required by law.

Under the GDPR and applicable Dutch law, you have the following rights with respect to your personal data:

To exercise any of these rights, please submit a request to privacy{'@'}conciar.com. We will respond within 30 days. We may request proof of identity before processing your request.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl if you believe we have not handled your data in accordance with applicable law.

We use cookies and similar technologies to run our website and, only with your consent, to analyse usage and measure our ads. You choose which categories you allow, and you can change that at any time. More in our Cookie Policy.

You can control cookie settings through your browser preferences or our cookie consent tool. Note that disabling certain cookies may affect the functionality of the Service.

We implement appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These include:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256);
• Role-based access controls limiting employee access to personal data on a need-to-know basis;
• Regular security testing, penetration testing, and vulnerability scanning;
• Incident response procedures with notification obligations compliant with GDPR Article 33.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, notify affected individuals without undue delay.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by email and/or by displaying a prominent notice on our website at least 30 days before the changes take effect.

The date at the top of this page indicates when the policy was last revised. Your continued use of the Service after the effective date of a revised policy constitutes your acceptance of the changes.

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us: