Privacy statement

1Who is responsible?

For the data that reaches us through this website and in our contact with you, FloraSpark B.V. is the data controller. FloraSpark B.V. is part of SparkBI Group.

Data controller

FloraSpark B.V.

Chamber of Commerce number

42143808

VAT number

NL869912343B01

Email

info@floraspark.nl

Phone

+31 6 15 29 85 04

2Which personal data do we process?

Demo or trial month request

If you fill in the demo form, or request a free trial month on the flyer page, we process:

• your name
• the name of your company
• your email address
• your phone number
• the content of your message and anything you include in it yourself

The request arrives as an email in our own mailbox. No request travels through a form service outside the EU.

Quote request

If you put a subscription together in the configurator, we process:

• the name of your company and your own name as the contact person
• your email address and, if you fill it in, your phone number
• the package, the number of users and the modules you select
• your company's Chamber of Commerce number and registered address, plus the name of the person signing on behalf of the company

We need that last set of details to draw up the quote and the data processing agreement in your company's name. You first receive a confirmation email; the quote is only drawn up after you click the link in that email.

Newsletter

If you sign up for the newsletter, we process:

• your email address
• the language of the page you sign up on, so you get the news in that language
• as proof of your consent: when you sign up, the time, your IP address, your browser's user agent and the text you saw when you signed up
• whether you are subscribed or unsubscribed, and which newsletters we sent you when

We ask for nothing more: no name and no company. You are on the list right away, and you can always unsubscribe with the link in every newsletter.

If you tick the newsletter box with a trial month request, your name and company are stored with that request, not on the newsletter list.

Use of the website

When you visit the website, technical data may be processed:

• your IP address, in the web server logs
• data about your browser and device
• which pages were requested and which errors occurred

When a form is submitted we briefly hold your IP address in memory, so that the same address cannot send hundreds of requests in a row. For the newsletter we do store your IP address and user agent, as proof of your consent; see above.

If you consent to the LinkedIn Insight Tag, LinkedIn also receives data about your visit. See Cookies and measurement.

Data inside the FloraSpark Suite

If your company works with the platform, it holds company data (auction, growing and sales data) and data about the employees who have an account. For that data your employer is the controller and we are the processor. See the section about the platform.

3What do we use your data for?

1. Getting in touch and handling your question or request.
2. Scheduling and preparing a demo.
3. Drawing up a quote and an agreement, and carrying it out.
4. Our administration and invoicing.
5. Sending you the newsletter, if you signed up for it.
6. Keeping the website working and secure, and preventing abuse of the forms.
7. Knowing how many visitors view which page, without profiling the visitor.
8. Only with your consent: seeing what kind of companies our visitors come from, and tailoring our LinkedIn ads to that.

We do not sell data, and we do not use your details to send you unsolicited commercial email.

4On what legal basis?

We only process your data when there is a legal basis for it:

• Legitimate interest: handling requests, and keeping the website secure and working.
• Performance of the agreement: drawing up a quote and, if you become a customer, meeting the agreements we made.
• Legal obligation: administration and the statutory retention period, for invoices for instance.
• Consent: the LinkedIn Insight Tag. We only load it when you accept in the cookie banner, and you can withdraw that consent at any time.
• Consent: the newsletter. We only send it if you signed up yourself. You withdraw that consent with the unsubscribe link in every newsletter.

5Data inside the platform

The FloraSpark Suite runs on your company's own data. That data stays your company's: your company is the controller for it and we only process it on instruction. What we may do with it, which sub-processors we engage and what happens to the data when the agreement ends is set out in the data processing agreement that comes with the subscription. That text takes precedence over this statement.

Processing and storage take place within the European Union. Access to a customer's data is limited to the people who need it for their work.

If you are an employee of a customer and want to know what the platform holds about you, such a request goes through your employer. We are not allowed to hand over or delete that data on our own initiative.

6How long do we keep data?

• Requests that do not lead to a customer relationship: no longer than twelve months after the last contact.
• Customer and invoice data: seven years, because of the statutory retention period.
• Technical logs: usually no longer than six months, unless we need them longer to investigate an incident.
• Data inside the platform: for as long as the agreement lasts, and after that according to the period in the data processing agreement.
• Your cookie choice: one year, in your browser's storage. After that we ask again.
• Newsletter: if you unsubscribe, or the newsletter can no longer be delivered to your address, we delete your details after thirty days, along with the record of what we sent you. While you are subscribed we keep your address and the proof of your consent; the record of which newsletter we sent you when is deleted after twelve months.

7Do we share data with third parties?

We only share data when it is needed to deliver our service or when the law requires us to. That comes down to:

• Hosting and email: the website, the forms and the platform run on Microsoft Azure and our email runs through Microsoft 365, in data centres within the EU.
• Website statistics: Cloudflare Web Analytics, which counts pageviews without cookies and without a visitor profile.
• Advertising: LinkedIn (LinkedIn Ireland Unlimited Company), only if you give consent for it in the cookie banner. See below.
• Administration: the parties that handle our bookkeeping and invoicing.

With parties that process personal data on our behalf we conclude a data processing agreement.

The newsletter goes out through our own email at Microsoft 365, not through a newsletter service. It contains no open or click tracking: no tracking pixel and no redirected links. So we do not see whether or when you open it, or what you click.

8Cookies and measurement

This website does not set cookies itself. There is one part we ask your consent for first: the LinkedIn Insight Tag.

For visitor numbers we use Cloudflare Web Analytics. That script places no cookie, reads nothing from your browser and builds no profile. We see how many visitors request which page, not who you are. That is why it runs without consent.

LinkedIn Insight Tag

If you accept in the cookie banner, we load the LinkedIn Insight Tag. It places LinkedIn cookies and sends LinkedIn, among other things, your IP address, the page you are viewing, the page you came from, details about your browser and device, and the time. If you are signed in to LinkedIn, LinkedIn can link the visit to your profile.

We get no data about you as a person back from this. We only see aggregated figures, such as which industries and job roles our visitors come from, and we can later show visitors as a group an ad on LinkedIn.

LinkedIn and FloraSpark are jointly responsible for the collection through the tag. What LinkedIn does with the data afterwards falls under LinkedIn's privacy policy and cookie policy. LinkedIn may also process data in the United States, with the safeguards the GDPR requires for that, such as the EU-US Data Privacy Framework.

If you click Decline or make no choice, we do not load the tag. Through Cookie settings at the bottom of every page you can change your choice or withdraw your consent. The tag then stops straight away and we remove the LinkedIn cookies on our domain. Cookies LinkedIn has set on its own domain can be removed in your browser.

The Suite does not use cookies either: signing in runs through Microsoft Entra ID and your session lives in your browser's session storage, which empties when you close the tab. Whatever Microsoft places on its own sign-in page falls under Microsoft's privacy policy.

9Security

We take appropriate measures to secure data: encrypted connections, access only for those who need it, two-factor authentication on our accounts, and timely updates of the systems we run on. If you notice something that does not look right, let us know at info@floraspark.nl.

10Your rights

You have the right to:

• access the data we hold about you
• have incorrect data corrected
• have data deleted, as far as we are not required to keep it
• restrict the processing
• object to the processing
• have your data transferred, in the cases where that applies
• withdraw consent, where the processing is based on it

Send your request to info@floraspark.nl. We reply within one month. If your request concerns data held in your employer's platform, we refer you to that employer: they are the controller there.

11Complaints

If you are unhappy with how we handle your data, please tell us first so we can sort it out together. If we cannot resolve it, you can file a complaint with the Dutch Data Protection Authority.

12Changes

We may amend this statement, for instance when we add a module that processes different data. The current version is always on this page, with the date on which it was last updated at the top.