Product & website privacy notice

Who is responsible

Trakkit is provided by De Bonte Koning. Contact privacy@trakkit.eu for privacy questions and requests. We act as controller for our own account, billing, security and business-contact administration. Your organisation controls the supplier-review information it puts in a workspace; we process it on its instructions under our data processing terms.

Information and purposes

Account information includes your name, work email, organisation, role and access permissions. Workspace information includes supplier details, forms, review assignments, scores, comments, history and necessary delivery records. Login, session and security records may include IP addresses, browser information and timestamps. Billing uses business details, VAT information, invoices and payment-provider references. We do not store full payment-card details.

We use these records to provide the service and support, protect accounts, maintain billing and meet legal obligations. Our bases for our own processing are performing the service contract, legitimate interests in secure operations and responding to business enquiries, and applicable legal obligations. Your organisation determines the lawful basis for its review data. Do not put sensitive personal information or unnecessary personal details in free text.

Accounts, billing, support and business contacts

For account and workspace administration, we use identity and access details to provide the service. Where you personally enter into the service agreement, performance of that agreement is the basis. Where you act for an organisation, our legitimate interest is administering that organisation’s account and its authorised users. Billing and payment references support the agreement and applicable accounting obligations.

We use support correspondence and service messages to answer requests, maintain the service and protect accounts. Business enquiries, contact preferences and sales follow-up are held in HubSpot on the basis of responding to a requested enquiry or our legitimate interest in relevant business contact. Contact details may come from you, your organisation or public business sources. We do not automatically add product users or reviewers to a newsletter. You can object to business marketing at any time by contacting support@trakkit.eu.

Providing an email address is necessary for passwordless login and review invitations. Without required account or billing details, we may be unable to provide the corresponding service. Optional onboarding questions and optional AI features are not required for ordinary supplier reviews. We do not use supplier scores to make solely automated decisions with legal or similarly significant effects on people.

Optional AI

Only when a user requests an AI function do we send the relevant instruction and form or review content to OpenAI. Summary content can include reviewer comments. Imported spreadsheets are not automatically sent to AI. You can run ordinary reviews and exports without AI. AI input and output may be stored in workspace history and technical records. We do not promise EU-only processing or zero provider retention for this integration.

Services that receive information

Railway hosts the application, database and storage. Lettermint delivers login links, review invitations, reminders and enquiry confirmations. Mollie processes payments and related billing information. OpenAI processes optional AI requests. HubSpot holds business enquiries and follow-up records; it does not automatically receive your supplier scorecards. Our support and privacy mailboxes use Microsoft 365. Our Security & data page explains hosting and international-processing limits.

Website enquiries and measurement

The optional onboarding form collects the details you submit about your role and review process, your contact preference and any campaign parameters. It creates a private delivery record, a HubSpot contact/follow-up task and confirmation emails. It does not create a product account, subscription or newsletter signup. Email open and click tracking are disabled for these enquiry emails. Anonymous campaign events contain no visitor identifier; technical server logs may still contain request metadata. A language preference cookie remembers your language, and the app uses necessary authentication cookies.

Retention and deletion

Workspace history remains available during active use. At the end of a paid or trial period, invitation links close and there are 30 days of read/export access. That access window is not an automatic deletion timer: workspace data remains for reactivation until deletion is requested or a separate retention arrangement applies. Ask us to delete an inactive workspace if you do not want it retained. We verify authority, agree the scope, remove the applicable active records and explain any retained legal records or backup expiry. Backups are not individually editable; deleted data must not be reintroduced through a restore.

Inactive enquiries are retained for at most six months unless a continuing business relationship or legal/security need justifies limited retention. Delivered queue payloads expire after seven days and delivery references after thirty days. Unresolved deliveries remain for recovery until resolved or deleted. Technical logs follow each provider’s configured retention; billing records are kept for applicable statutory obligations. Ask for the current settings if your procurement policy requires a fixed period.

Your rights and contact

You can request access, correction, deletion, restriction, portability or object where the relevant right applies. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. For review data, contact the organisation that invited you; we assist it with verified requests. For our own administration, email privacy@trakkit.eu. You may complain to the Dutch Autoriteit Persoonsgegevens or your competent supervisory authority. We do not make automated decisions with legal or similarly significant effects about you.