Privacy Policy

1. Who we are

This Privacy Policy explains how Gilbert RegTech B.V. ("we", "us", "our") processes personal data in connection with our websites and our software-as-a-service platforms FPR and EmpCo (together, the "Platform").

Controller and contact details:
Gilbert RegTech B.V.
Keizerstraat 5 D, 2584 BA 's-Gravenhage, the Netherlands
Privacy contact: sales@gilbert-regtech.eu

2. Our roles: controller and processor

Our role under the General Data Protection Regulation (GDPR) depends on the data concerned:

2.1 Customer data in the Platform — we are processor. For personal data that our business customers (or their users) upload to, enter into or generate through the Platform, the customer is the controller and determines the purposes and means of processing. We process such data only on the customer's documented instructions, as processor. This processing is governed by a Data Processing Agreement (verwerkersovereenkomst) concluded with the customer under Article 28 GDPR. If you are an employee, contact or other individual whose data a customer has placed in the Platform, please address your privacy requests to that customer in the first instance; we will assist the customer as required.

2.2 Our own data — we are controller. For personal data we process for our own purposes — such as account, contact and billing data of our customers' representatives, website-visitor data, and data used to secure, support and improve the Platform — we are the controller. This Policy describes that processing.

3. What personal data we process

Depending on your relationship with us, we may process the following categories of personal data as controller:

• Account and identification data: name, business email address, telephone number, job title, employer, login credentials and account settings.
• Billing and contract data: billing address, VAT number, order and invoice details, payment status.
• Usage and technical data: log data, IP address, device and browser information, actions within the Platform, and security and audit logs.
• Communication data: correspondence with our support and sales teams.
• Website data: data collected via cookies and similar technologies (see Section 10).

Personal data contained in materials that a customer uploads to the Platform is processed by us as processor on the customer's behalf, not as controller, and is not described further here (see the Data Processing Agreement).

4. Purposes and legal bases

As controller we process personal data for the following purposes, on the following legal bases (Article 6(1) GDPR):

• To enter into and perform the agreement with our customer, including providing the Platform, account management, support and billing — performance of a contract (Article 6(1)(b)), or our legitimate interest where you are a representative of a corporate customer (Article 6(1)(f)).
• To secure the Platform, prevent abuse and maintain audit and security logs — our legitimate interest in the security and integrity of our services (Article 6(1)(f)).
• To improve and further develop the Platform, including by analysing usage in aggregated or anonymised form — our legitimate interest (Article 6(1)(f)).
• To comply with legal obligations, such as tax and accounting retention duties — compliance with a legal obligation (Article 6(1)(c)).
• To send service messages and, where permitted, relevant commercial communications — legitimate interest (Article 6(1)(f)) or your consent (Article 6(1)(a)), which you may withdraw at any time.

Where we rely on legitimate interest, we have balanced that interest against your rights and freedoms. You may object to such processing as described in Section 7.

5. Recipients and sub-processors

5.1 We share personal data only where necessary, with: our staff on a need-to-know basis; service providers acting as our processors (such as hosting and cloud infrastructure, payment and invoicing, support tooling, analytics and security providers); and professional advisers and authorities where required by law.

5.2 Our processors act under written processing agreements and may process personal data only on our instructions. A current list of sub-processors is available on request via sales@gilbert-regtech.eu.

5.3 We do not sell personal data.

6. International transfers

We process personal data within the European Economic Area (EEA). Where a sub-processor operates globally, we configure the service to keep data within the EEA wherever that option is available. If a transfer to a country outside the EEA becomes necessary, we will ensure an appropriate safeguard under the GDPR — such as an adequacy decision of the European Commission or the European Commission's Standard Contractual Clauses, together with any additional measures required. You may request more information about these safeguards using the contact details in Section 1.

7. Your rights

Subject to the conditions in the GDPR, you have the right to:

• request access to your personal data (Article 15);
• request rectification of inaccurate or incomplete data (Article 16);
• request erasure of your data (Article 17);
• request restriction of processing (Article 18);
• receive your data in a structured, commonly used and machine-readable format and have it transmitted to another controller (data portability, Article 20);
• object to processing based on our legitimate interest, and to object at any time to direct marketing (Article 21);
• withdraw consent at any time, where processing is based on consent, without affecting prior lawful processing.

You can exercise these rights using the contact details in Section 1. We will respond within the statutory period. If your data was placed in the Platform by one of our customers, we will refer your request to that customer as controller.

8. Complaints

If you have a complaint about how we process your personal data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (Bezuidenhoutseweg 30, 2594 AV The Hague; autoriteitpersoonsgegevens.nl), or with the supervisory authority in your country of residence or work.

9. Automated processing

The EmpCo Platform uses automated processing to scan labels, websites, documents and environmental claims and to produce compliance indications and risk classifications. The FPR Platform uses automated processing to assist in generating documentation.

These automated functions assess products, claims and documents of our business customers; they are designed as decision-support tools and are subject to independent human review by the customer. They are not intended to take decisions producing legal or similarly significant effects on a natural person based solely on automated processing within the meaning of Article 22 GDPR. Our customers are required by our terms to review each result independently and to obtain their own professional advice before acting on it. If you believe an automated function has produced a decision with legal or similarly significant effect on you, please contact us or the relevant customer so that human review can be provided.

10. Cookies

Our websites use cookies and similar technologies. We place functional cookies that are necessary for the website to work without your consent. Our website statistics (Plausible Analytics) work without cookies and without personal identifiers.

With your consent only, we use marketing cookies from Google Ads (Google Ireland Limited) and LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company) to measure the results of our advertising. These providers receive data such as the pages you visit, your browser details and your IP address. These tools load only after you click "Accept" in our cookie banner. You can withdraw your consent at any time via "Cookie settings" in the footer of our website, with effect for the future.

11. How we protect your data

We take appropriate technical and organisational measures to protect personal data against loss and unlawful processing, including access controls, encryption in transit, logging and monitoring, and confidentiality obligations for our staff and processors (Article 32 GDPR).

12. Retention

We retain personal data no longer than necessary for the purposes for which it is processed, taking into account statutory retention periods. Indicatively:

Personal data processed on behalf of a customer in the Platform is retained and deleted in accordance with the Data Processing Agreement with that customer.

13. Changes to this Policy

We may update this Privacy Policy from time to time. The current version, with its date, is available on our website. Where changes are material we will take appropriate steps to inform you.

Version 0.1 (draft) — 2026-06-06. Draft for review by Dutch counsel — not yet legally binding.