What we do with your team's data

Last updated: 13 October 2026.

This is an English translation, offered to help you read along. The Dutch version of this agreement is the official one. If the English and Dutch texts differ, the Dutch text applies.

Want to keep this agreement or have it signed? Print this page, or save it as a PDF from your browser. Would you like a copy signed by us? Email info@inklaretaal.nl.

1. Who is who

This agreement is between your organisation and inklaretaal (vof), Edisonstraat 13, 1098 SZ Amsterdam. Chamber of Commerce (KvK) number: 42104394.

• Your organisation decides about the data of its staff. In the law (the GDPR) that is called the controller.
• inklaretaal stores and uses that data for your organisation. In the law that is called the processor.

This agreement is part of our terms for teams. When you create an organisation and tick the box, you agree to it.

2. What for and how long

We use the data for one purpose: to give your colleagues the newsletter and the Learning curve, and to give you the team management. We only do what this agreement and the terms say, or what an administrator does in the team management. We never use the data for advertising, and we never sell it.

This agreement runs as long as your organisation has seats with us. Part 9 says what happens after that.

3. Which data, about whom

It is about the colleagues you invite, and about the administrators of your organisation.

• Name, if you or your colleague fill it in;
• work email address;
• choice of field: which newsletter someone receives;
• thumbs: a thumbs up or down a colleague gives a story, so the newsletter gets better;
• whether an invitation has been accepted.

We ask for no special categories of data, such as health or religion. Please do not put them in a name field either.

What your organisation sees: how many colleagues take part, and per colleague whether access is switched on. If it is not, you also see why: not accepted yet, stopped themselves, or their own subscription. What your organisation never sees: what someone reads, which lessons someone did, or how far someone is.

4. Other companies we use

Some companies help us run the service. In the law they are called sub-processors. We have an agreement with each of them about protecting the data. These are them:

• Supabase, Ireland (EU): the secure database, and logging in.
• Vercel, United States: hosts our website.
• Resend, United States: sends our emails. Gets the email address.
• GitHub, United States: runs the program that writes the newsletter every week and gets it ready to send.
• Anthropic, United States: the AI company that helps write the newsletter. It gets the field, the level and a first name. Never an email address.
• Stripe, Ireland and United States: handles your organisation’s payment. Gets the details of the administrator who pays, nothing about colleagues.
• Sentry, Germany (EU): gets a report when something goes wrong on the site. Without a name or email address.

When data goes to the United States, that happens in one of two ways:

• through the EU-US Data Privacy Framework, an arrangement between Europe and the US that applies to American companies that have signed up for it; or
• through standard contractual clauses, contracts approved by the European Commission that require the data to stay just as well protected as in Europe.

Our privacy policy says more about this.

Do we want to add or replace a company? Then we email your administrator at least 30 days in advance. Do you object? Tell us. If we cannot solve it, you may stop right away, without costs for the period after that.

5. Confidentiality and security

Only people who work for inklaretaal can reach the data, and only when the service needs it. They keep it confidential. In addition:

• every connection to our site and our database is encrypted;
• only our own server can reach the database, and it shows an administrator only the data of their own organisation;
• logging in goes through a personal link in your email, or through Google;
• we record what an administrator changes in the team management;
• our emails contain no tracking pixel.

6. A data breach

Data can end up with someone who should not have it. That is called a data breach. If that happens with your organisation’s data, we email your administrator within 48 hours after we find out. We say what happened, which data it concerns, and what we are doing about it.

Your organisation decides whether to report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). That has to happen within 72 hours. We help with everything you need for it.

7. Access and deletion

A colleague may ask to see, correct or delete their data. We help your organisation with that, usually within a few days. If such a request reaches us directly, we tell your administrator. A colleague can also stop on their own, with one click at the bottom of every email. An administrator can remove a colleague in the team management.

8. Audits

Do you want to check that we keep to this agreement? Ask us. We give you the information you need for that.

9. When you stop

When your organisation stops, we delete the list of colleagues and their seats within 30 days. Would you like a copy first? Ask us before then. Invoices we keep for 7 years, because the law requires it.

A colleague who wants to keep reading on their own subscription keeps their own account. That is then between them and us, and no longer part of this agreement.

10. Other terms

Everything not in this agreement is in our terms, including liability. If this agreement and the terms differ about data, this agreement applies. Dutch law applies.

Questions? Email info@inklaretaal.nl.