Denkploeg Privacy Statement

Denkploeg is a platform on which agencies and businesses work with a crew of AI agents. An action with a large outward effect does not go out unless a human signs off (see section 6). This statement explains which personal data we process in doing so, why, for how long, with whom we share it and what your rights are.

1. Who we are

Denkploeg is part of Het Creatieve Bureau (sole proprietorship of J. Katgerman, Chamber of Commerce number 72101121, VAT ID NL001154747B27, postal address Loudonstraat 51, 3317 PA Dordrecht, not a visiting address).

For privacy questions: privacy@denkploeg.nl. Denkploeg has not appointed a data protection officer. None is required (Article 37 GDPR): we are not a public authority and our core activities do not consist of regular and systematic monitoring of individuals on a large scale or of large-scale processing of special categories of data.

2. Two roles

It is important to know in which role we process your data.

• We are the controller for the data needed to make Denkploeg work and keep it secure: your account, your sessions and login attempts, a request for a workspace, the email the platform sends and the audit trail. We are also the controller for the contact form and the chat assistant on our own site. This statement covers that data.
• We are the processor for everything a customer puts into or lets into its workspace: its relations and contact persons, notes, files, chat messages from visitors to its site, WhatsApp messages, forms and sign-ups. The customer (or the agency working for that customer) determines why and how that data is used; we process it only on its instructions, under a data processing agreement. If you are a visitor, contact person or guest of such a customer, please direct your privacy questions to that customer first. We help the customer to carry out your request. This also applies to the personal data of visitors to a customer's website (forms, the support assistant, cookies on a site made with Denkploeg): the customer is the controller for that and we are the processor. The privacy and cookie statement on that site belongs to the customer, even if it comes from our templates (see the terms, Article 9).

3. Which data, why and for how long

The retention periods come from the platform's code (bewaarbeleid); a row that is no longer needed for anything is deleted automatically. Where no period has been set yet, this is stated.

After logging in, in the portal and the studios, we use no analytics, no advertising cookies and no trackers. On our public sales pages we measure visits with Google Analytics and Microsoft Clarity (on the sign-up form, the demo page and the legal pages only with Google Analytics and the Meta Pixel, without recordings), only if you say yes in our own cookie banner (legal basis: consent, which you can withdraw at any time via Cookie settings at the bottom of the page). If you say no or choose nothing, we do not load their scripts and nothing goes to them. If you say yes, they receive your IP address (Google Analytics does not store it, according to Google), device and browser data, the pages you view and, for Clarity, a recording of mouse movement, clicks and scrolling (input fields are masked). Retention at Google 14 months, at Clarity 13 months for statistics and 30 days for recordings (the settings of Microsoft). See the cookie statement.

With a separate yes for marketing we also load the Meta Pixel (Meta Platforms Ireland) on the same pages as Google Analytics, to measure which visits lead to interest and to be able to show and measure Denkploeg advertisements. Meta then receives your IP address, device and browser data, the pages you view, a package choice on the pricing page and the _fbp cookie (3 months). We send the pixel no email address or phone number from the browser. Without a yes for marketing we do not load the pixel; if you withdraw the yes, the pixel is no longer loaded and we send nothing more. The pixel is never present on sign-in, at checkout or inside a workspace. For collecting and passing on that data we and Meta are jointly responsible (Article 26 GDPR); what Meta then does for its own purposes, Meta does itself as a controller (see Meta's privacy policy). For your rights concerning collecting and passing on you can turn to us.

Special categories of data. We do not ask for special categories of personal data (such as health, religion or ethnicity) or criminal data, and there is no field for them. If you put them in a chat or file anyway, we process them only as part of that content. Only do so if you have a legal basis.

Where does the data come from? Mostly from you. Exceptions: the email address of a colleague whom you invite (from the inviting administrator), the Meta ID (from Meta, when connecting) and the reason when a Denkploeg employee looks into a workspace (from that employee).

Do you have to provide it? Without an email address and password you cannot use an account. You provide all other data voluntarily.

4. With whom we share data

We share only what is necessary. Parties that work for us are sub-processors; Meta and Google are, for an integration that you or your organisation turn on yourselves, independently responsible for their own part. A data processing agreement exists with every sub-processor, or the provisions of Article 28 GDPR are part of its terms. For fal and Discord this has not been established: that is why we send fal no customer material until that agreement exists, and Discord no personal data.

• Hosting and network: Hostinger (account region still to be confirmed; DNS of our domains), Let's Encrypt (certificates). These are sub-processors.
• Bot check: Cloudflare (Turnstile), on sign-up, starting a demo and the contact form. Cloudflare is a sub-processor here.
• Payments and administration: Mollie (payment page and collection of subscriptions and credits, with your name, email address, billing address and the amount) and Moneybird (invoices and bookkeeping). Mollie is independently responsible for carrying out the payment (as a payment institution it has its own legal duties) and processes other data for us as a sub-processor; Moneybird processes data for us as a sub-processor. We do not store full card or account numbers, only the last four characters and a fingerprint (HMAC) with which we recognise the same account, for example for one trial per account. For the webshop of a customer, the customer is the controller for the orders of its own buyers and we are the processor; the buyer pays at Mollie, which is independently responsible for the payment, and we receive only the status of the payment.
• Email: Resend, to send email from the platform, including a client's newsletter to its confirmed subscribers, and Google Workspace (Google Ireland) for the mailboxes of our support and privacy addresses. These are sub-processors.
• AI models: what you ask the crew or an assistant goes to the model that carries out the task. By default we use our own keys, paid for with credits: Anthropic for the crew and the assistants, Google (Gemini) and fal for image and video. These suppliers are then our sub-processors. An agency or Enterprise customer can connect its own key (for example Anthropic or OpenAI); that supplier is then the customer's own supplier.
• Image, video and speech: Image and speech suppliers are listed in the current register below. Platform credits and connected customer accounts follow different processing routes; the configured key source determines which applies.
• Integrations that a customer turns on: Meta (advertising, Instagram, WhatsApp), Google (Analytics, Search Console, Tag Manager, Drive), the WhatsApp provider Kapso, shop platforms and other services from the list in the app.
• Looking up company data: KvK (Dutch Chamber of Commerce) and PDOK, with only the search term, and your VAT number at VIES of the European Commission.
• Maps and addresses: Google Maps Platform, for addresses, maps and travel times in Planning and Relations. Google receives the address.
• Statistics and advertising measurement on our sales pages, only after a yes: Google Analytics (Google Ireland) and Microsoft Clarity (Microsoft), which are sub-processors for measuring our own traffic, and, only after a yes for marketing, the Meta Pixel (Meta Platforms Ireland, transfer to Meta Platforms Inc.).
• Conversion measurement, only after a yes to marketing: Meta (Conversions API) receives a hashed email address and the event (Lead, CompleteRegistration, Purchase). For collecting and passing on we and Meta are jointly responsible (Article 26 GDPR); for what Meta then does for its own purposes, Meta is independently responsible (see Meta's privacy policy).
• Backups: encrypted backups; the destination and account region still need account evidence. These are sub-processors.
• Monitoring and notifications: Discord (short platform notifications, without the content of a workspace), Uptime Kuma.

The current list with name, purpose and country is at subprocessors. We do not sell personal data and do not share it with advertisers or data brokers. An AI or image supplier that a customer chooses itself has its own terms; some share input with partners or train on it (see section 5).

4a. Data from your Google connection

Signing in with Google. If you choose Google on the sign-in page, we request the openid, email and profile permissions. We use them only to find an existing Denkploeg account with an email address verified by Google. We never create an account through Google: if you do not have an account yet, signing in with Google stays closed. We store the Google subject (the fixed ID Google gives your Google account) and the email address, so we recognise you next time. Your second step still applies after signing in with Google.

Which permissions we request, and what for. Per service we request only the permissions below, and only when you connect that service.

• Google Analytics: with analytics.readonly we read reports of the Analytics property your workspace selects. With analytics.edit we create a property and a web data stream after you confirmed.
• Search Console: with webmasters.readonly we read the search performance of sites verified for your workspace. With webmasters we add your workspace's site and submit the sitemap after your confirmation.
• Google Drive: with drive.file we read only the files you choose yourself in the Google file picker and store files that Denkploeg itself created. Never your whole Drive.
• Google Ads: with adwords we read advertising results and carry out only campaign changes you explicitly approved.
• Tag Manager: with tagmanager.readonly we read the configuration of the container your workspace selects. We write nothing to it.
• Google Calendar: with calendar.events we create an appointment after you confirmed a proposal. With calendar.freebusy we only see when you are free or busy, without the contents of your appointments.
• Confirming site ownership: with siteverification.verify_only we only verify new sites of your workspace, after you confirmed a DNS record or meta tag.

If you connect a Google service to Denkploeg (Google Analytics, Search Console, Google Ads, Google Drive, Google Calendar or Tag Manager), Google asks your permission for exactly the rights the chosen function needs. We request only the smallest rights needed for that and never access to your mailbox or to all your Drive files.

• What for: only to make that function work, such as reading reports, verifying a site, saving a chosen file or creating an appointment after you approved a proposal.
• Not for: advertising, resale, building a profile of you, or training a general AI model. People at Denkploeg read your Google data only with your permission, to investigate abuse, or when the law requires it.
• Storage and withdrawal: the access keys are encrypted and never go into a log. You withdraw the connection in Denkploeg or on your Google account (myaccount.google.com/permissions); we then delete the keys and the data we retrieved with them, within the retention period in Article 3.

Denkploeg's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Outside the EU

A number of these parties are established outside the European Economic Area or process data there, in particular for AI models and integrations with Meta and Google. We do this only with an appropriate transfer mechanism. For a US supplier that participates in the EU-US Data Privacy Framework, the transfer rests on the European Commission's adequacy decision of 10 July 2023; for the others on the standard contractual clauses (Implementing Decision (EU) 2021/914). Per supplier the mechanism is stated at subprocessors. Suppliers that train on input or share input with partners (according to our overview currently including ElevenLabs, Higgsfield and OpenArt; for others it has not been checked) are off by default for customer material; a workspace turns them on only after a recorded choice. Per supplier it is stated in subprocessors. Per supplier you receive a copy of the safeguards on request via privacy@denkploeg.nl.

6. Human and machine

On Denkploeg, AI agents make proposals. High-risk actions (R3) are always carried out by a human. Other outward actions, for example a message, an advertisement or a change to a site, wait for a signature, unless the customer turns on the autopilot for low or medium risk, within a budget and per channel. A customer's support assistant answers visitors on its own, within the knowledge the customer sets up; the widget states that it is an AI assistant; this notice cannot be switched off. We ourselves take no decisions about you that are based solely on automated processing and that produce legal effects or similarly significantly affect you; a customer who does so with the assistant is itself responsible for that.

7. Security

Passwords are never stored in readable form. Keys and tokens are stored encrypted, shielded per workspace. A second step at login is mandatory for platform administrators and configurable for workspaces. Every action is recorded in an immutable audit trail. Through the platform, Denkploeg staff look into a workspace only with a stated reason, and you can see this in your workspace's history. Administrators with access to the server itself are limited to the owner (J. Katgerman) with an SSH key; deployment and tools work under his supervision and with his key, and no third parties have access, and bound by confidentiality; that access currently leaves no trace in the history. More in the data processing agreement.

8. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability. Where processing is based on consent, you can withdraw it at any time; what we did before remains lawful. A request is free of charge. We may ask you to prove who you are, for example by replying from your account's address. We reply within one month. If a request is complex or there are many, we can extend that by two months; we will tell you within the first month, with the reason.

Objection. Where we rely on a legitimate interest as the legal basis, you can object to it on grounds relating to your situation. An objection to direct marketing we always honour, without reason: you can unsubscribe from our newsletter at any time, with the link in every email or via privacy@denkploeg.nl. After that we no longer use your data for direct marketing. Send your request to privacy@denkploeg.nl; we reply within one month. If it concerns data in a customer's workspace, we refer you to that customer or carry it out on the customer's instructions. To have your account or data deleted, see deleting data.

If you disagree with our response, you can lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

9. Children

Denkploeg is intended for businesses and professionals and not for children. You must be at least 18 years old to have an account.

10. Changes

If we change this statement in substance, we will notify account holders in advance. The date of the latest version is at the bottom.

Effective date: 18 October 2026.