Privacy Statement

1. Who is responsible for your data

Grundsätzlich IT B.V. is the provider of Bolzano Fact Modeller and the data controller for the personal data described in this statement.

• Address: Cascademuur 2, 3991 VP Houten, the Netherlands
• Chamber of Commerce (KvK) no.: 63610795
• Contact person: Ronald Kunenborg (owner)
• Email: info@bolzanofactmodeller.nl
• Phone: +31 (0)6 41966000

2. About this service and the website

Bolzano Fact Modeller is a web application for fact-oriented information modelling (FCO-IM), available at https://app.bolzanofactmodeller.nl. The service is not freely accessible: you gain access by invitation, as a member of an admitted organisation or as an individually admitted user.

This statement also applies to our public website https://bolzanofactmodeller.nl, which explains Bolzano and links to the service. You do not log in on the website. A visit to the website records only what is described in point 9.

3. How you log in

You log in through Cloudflare Access, the login service of our supplier Cloudflare. You choose one of three methods:

• Google
• Microsoft (Entra ID)
• A one-time passcode by email

With Google and Microsoft you go through that provider's own login screens; they process your login under their own terms and privacy statement. We only see the data listed below.

After a successful login we receive from the chosen login method:

• your email address;
• with Google and Microsoft: your display name;
• which of the three login methods you used.

Your session lasts a maximum of 24 hours. After that you must log in again. You can also log out yourself through the application's settings.

Data from your Google or Microsoft account

• What data. Only your email address, your display name and which of the three login methods you used. Nothing else: we do not request access to your email, calendar, files or contacts.
• How it is used. Solely to log you in, determine your access to the service and establish your membership of an organisation.
• Who it is shared with. Only with Cloudflare, Inc., as the processor that handles the login and the hosting of the service (see point 7). With no one else, and never sold or used for marketing.
• How it is protected. See point 10 for the security of the traffic; the data is stored under European jurisdiction (see point 4); only Grundsätzlich IT B.V. has access to this data.
• Retention and deletion. The same periods as in point 11: for as long as your membership or admission exists, and after that until final billing is completed — at most one year after the end of that. You can request earlier deletion at info@bolzanofactmodeller.nl (see point 12).

4. What data we keep about you

We store the following:

• your email address;
• a user number: an internal number we assign to you (not personal data by itself, but linkable to you);
• your display name, if known;
• which organisation(s) you belong to, with which membership and which role or roles (member, expert, modeller, administrator);
• pending invitations: email addresses an organisation administrator has entered to give someone access;
• whether your email address is, separately, individually admitted to the service, and the reason for that;
• date and time, such as when your account was created and when you last logged in;
• whether your account has been deactivated, when that happened and by which administrator. A platform administrator can deactivate your account, for example when you have not logged in for a long time. Your account and the models in your personal space then remain stored for a while longer: for up to one year after deactivation if you still have a model in your personal space at that time, otherwise for up to thirty days. One month before that date you receive, where feasible, a reminder email. After that, your account and the models and concept schemes in your personal space are permanently deleted, at the latest one day after that date (see point 11 for what remains in an organisation's models). A platform administrator can also reactivate a deactivated account;
• in our administration log: when a platform administrator changes something about your access or your account, such as an admission, an invitation or a deactivation, what happened, when and by which administrator;
• when you create, import, re-import, fetch to a device, transfer (for example from your personal space to the organisation), delete or restore a model within an organisation: who did it (your user number; shown in the overview as your email address), the name of the model, what happened and when. This is also recorded when an administrator deletes or restores a model on the server. This record is visible to the administrators of your organisation (see point 7);
• data about your terms acceptance: the time at which you confirmed the terms of use in the application, which version of the terms of use and of this privacy statement applied at that time, which articles you checked, the language in which you read them, and the type of browser at that moment;
• once you are logged in: the content of your models, with their change history and revisions, and of your concept schemes (personal, of your organisation or bound to a model), with, for each change, who made it and when, and for a model change or a revision also from which device (see point 5);
• the devices you synchronise with: an identifier with which we tell your devices apart, the type of browser and operating system, the name you may give the device yourself, and when the device first and last made contact. Within the application, only you can see your devices.

Your data is kept at Cloudflare, under European jurisdiction. Its processing may also take place on Cloudflare systems outside the EU; this is therefore not a full EU guarantee, and we state that explicitly.

5. Your model data: local, with synchronisation via the server

Your model data — the information models themselves, populations, concepts — is always stored first on the device you work on (in your browser).

Since version 1.4: your models on the server too. Once you are logged in, we keep your models, with their changes, with us in the background as well — for both a personal model and an organisation model. For every change we record who made it and when, and for a model change or a revision also from which device (see point 4). This happens in the same place as your user data (point 4). If you work without logging in (local use), this does not happen: nothing is then sent to our server.

Since version 1.6: a model on more than one device, and together with your organisation. Once you are logged in, you can also open a model that is stored on the server on another device: you then see the model in full on that device. Members of an organisation can work on the same organisation model, each according to the role they hold. Changes are exchanged in the background; if changes conflict, our service determines the order. Changes are not exchanged live: working together in one model at the same time, seeing each other's changes immediately, follows in a later phase, which we will announce beforehand.

Working without an internet connection remains possible: you then work on the device, and your changes go to the server as soon as the connection is back.

6. Why we process this data

• Performance of the agreement. Without your email address, user number and membership data we cannot give you access to the service, and storing and synchronising your model data is the service itself — this is the legal basis for the data in points 4 and 5.
• Legitimate interest. We use the check at login and the limited logs of the service and the website (point 9) to secure both and prevent misuse. In our judgement that interest outweighs the limited effect on your privacy, because the processing stays limited to what is needed for that security.

If you use the service as an individual trial user without an organisation, your consent may in specific cases also be the legal basis; we will mention that at the relevant step itself.

7. Who else sees your data

• Members of your organisation — an organisation model and the concept schemes of the organisation are visible to the members of that organisation, each according to their role: all roles may read, only a modeller or expert synchronises changes to a model. For an organisation model, they see who created or imported the model (email address), for each revision the modeller's name and the time, who retracted a revision, who is editing the model at that moment, and for each change the time and the internal user number of its maker. They do not see the device you work on. A model in your personal space is seen only by you, until you yourself transfer it to an organisation.
• Grundsätzlich IT B.V. — as the administrator of the platform, we see the email addresses and roles of users and organisation members, the pending invitations, the terms acceptances, who created, imported or deleted a model and, for as long as a permanently deleted model can still be restored (thirty days, see point 11), its name with the owner or organisation; within that period we can restore the model. We use this solely for administering and supporting the service, on the same legal basis as the member management performed by organisation administrators.
• Cloudflare, Inc. — provides the login and the hosting of the service and of the website, and keeps your data, including your model data (see points 4 and 5). Cloudflare sends the invitation email on our behalf when an organisation administrator invites you (from info@bolzanofactmodeller.nl, containing the name or email address of that administrator and the organisation's name), and the reminder email before a deactivated account is permanently deleted (see point 4).
• Google LLC and Microsoft Corporation — solely for logging in, and only if you choose that login method yourself.

We do not sell your data and do not share it for marketing purposes. There are no advertisements and no tracking or statistics programs in the application or on the website.

8. Cookies and storage in your browser

• When you log in, Cloudflare places one functional cookie to recognise your 24-hour session.
• The application itself keeps your model data and your personal settings in the browser on your own device; once you are logged in, your model data also goes to the server (see point 5).
• The website itself places no cookies and stores nothing in your browser.

In our judgement no cookie banner is needed for this: everything is strictly functional, there is no free choice that gains you anything by refusing, and nothing is used for tracking or profiling.

9. Logging

• Our supplier Cloudflare retains data about login attempts for 24 hours.
• For every request to the service and every visit to the website, Cloudflare records your IP address, the time, the page requested and the country.
• We record technical errors, and, for every login attempt, your email address, whether you were admitted and, if not, for what reason.
• For an invitation email or a reminder email we only record whether sending succeeded, not the content or the email address.

10. Security

• Without a valid login you see nothing of the application.
• All traffic between you and our service is encrypted.
• The service's administrator account is secured with two-factor authentication.

We deliberately do not mention any technical details here.

11. How long we retain data

• Your user and membership data: for as long as your membership of an organisation or your individual admission exists, and after that until final billing is completed — at most one year after the end of your membership or admission.
• For a deactivated account: your account and the models and concept schemes in your personal space are kept until the deletion date from point 4 — one year after deactivation with a model in your personal space, thirty days without. After that we permanently delete them, at the latest one day after that date. The thirty days in which a platform administrator can still restore a deleted model do not apply in that case. Of your account, only a number remains, without an email address or name; an organisation's models still refer to it.
• After your account has been permanently deleted, the provenance in an organisation's models remains for as long as that model exists: the email address of whoever created or imported the model, the modeller's name on revisions and releases, and your internal user number on the changes you made. This data belongs to the organisation's models. A personal concept scheme that is still linked to a model outside your personal space is kept with that model. In our administration log we delete your email address.
• Your model data on the server: for as long as the model exists, even if it has been archived. If a model is permanently deleted (in the application a separate step after archiving), the platform administrator can still restore it for thirty days; after that the content of the model is permanently deleted from our systems.
• Your device data: for as long as your account exists.
• Pending invitations: until you accept them or they expire.
• Data about your terms acceptance: for as long as your account exists, and after that until final billing is completed — at most one year after the end of your membership or admission. For a deactivated account, this data remains linked to your account unchanged — not anonymised — until the deletion date described above: it must be able to show precisely who agreed.
• Data about login attempts at Cloudflare: 24 hours.
• Data about requests to the service and visits to the website at Cloudflare: 30 days.
• Our own log entries (technical errors, login attempts and the sending of emails, see point 9): 7 days.
• We can restore our database up to 30 days back, to recover the service after an outage or an error. Data we delete can therefore remain in that restore facility for another 30 days.

Would you like us to delete your data sooner? See point 12.

12. Your rights

You have the right to:

• access to the data we hold about you;
• rectification of incorrect data;
• erasure of your data;
• restriction of processing;
• objection to processing;
• data portability.

To exercise any of these rights, contact us at info@bolzanofactmodeller.nl. We verify your identity through the account you are logged in with, to prevent someone else from requesting or changing your data.

Do you disagree with how we handle your data? Please let us know at info@bolzanofactmodeller.nl — we would be glad to sort it out together with you. If we cannot resolve it between us, you always have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

13. Changes to this statement

If this statement changes, we update the version and date at the top of this document. A significant change — for example working together live in one model (see point 5) — we announce beforehand.

14. Contact

Questions about this statement or about your data? Email info@bolzanofactmodeller.nl.