1. About us 

Who we are

Itsperfect consists of several group companies (as mentioned below). Together they are referred to as “Itsperfect” or “we”.

Essence of the arrangement between the joint controllers

Itsperfect has laid down the respective responsibilities in a joint-controller arrangement. Under that arrangement, our central point of contact receives all questions and requests on behalf of all Itsperfect companies. You may exercise your rights against each of them (Article 26(3) GDPR). The essence of the arrangement, including the allocation of responsibilities, is available on request from our central point of contact.

2. For what purposes do we process personal data?

I. LEADS, CUSTOMERS AND THEIR CONTACTS

a. Lead generation and follow-up

What does this purpose entail?

We look for organizations that may be interested in our services and approach their contact persons by telephone, where the applicable national rules permit this, or by email with your prior consent or where those rules otherwise permit it. If you show interest, for example by requesting pricing information or a demonstration (see II.b), we follow up on your request, give the demonstration and prepare a quotation.

What personal data do we process for this purpose?

Business name, address and contact details, job title, employer, the source of the lead (such as a business database, our website or an event), notes of conversations and quotation details.

What is the legal basis?

Our legitimate interest in acquiring new customers and following up on requests (Article 6(1)(f) GDPR) and, if you are yourself our prospective contracting party, taking steps at your request prior to entering into an agreement (Article 6(1)(b) GDPR).

We retain the data for this purpose for 24 months if no agreement follows; after an objection, we only keep what is needed to avoid approaching you again. If an agreement follows, the retention period under I.b applies.

b. Performance of the agreement and customer relationship management

What does this purpose entail?

We perform the agreement with your organization and manage the customer relationship, including onboarding, implementation, management of the contract, subscription, licences and modules, and communication with you as a contact person.

What personal data do we process for this purpose?

Name, job title, email address and telephone number of the contact person, company details, bank account number, company registration number, billing details, subscription and licence details, and notes of conversations.

What is the legal basis?

Performance of the agreement, if you are yourself our contracting party (Article 6(1)(b) GDPR); otherwise our legitimate interest in performing the agreement with your organization (Article 6(1)(f) GDPR). For documents we must keep by law, our statutory retention obligations (Article 6(1)(c) GDPR).

We retain the data for this purpose for the term of the agreement plus 2 years; for invoices and financial records, the retention period under I.d applies, and documents we must keep by law (such as business correspondence that the German company must keep for six years from the end of the calendar year in which it was received or sent) are kept for that period.

c. Support and customer service

What does this purpose entail?

We handle your questions and reports, resolve malfunctions and incidents and assist you as a customer. We also keep a history of the tickets of your organization, so that we and you can see at a later stage which settings were changed and which malfunctions occurred, and can act on that history.

What personal data do we process for this purpose?

Name, job title and contact details of the person reporting, organization, the content of the ticket and related correspondence, and the information you share with us during contact.

What is the legal basis?

Performance of the agreement, if you are yourself our contracting party (Article 6(1)(b) GDPR), and our legitimate interest in performing the agreement with your organization, in providing good service, in keeping a service history for the term of our relationship with your organization and in using support tickets (but not the customer data from the Itsperfect environment they may contain) to improve our software (Article 6(1)(f) GDPR).

We retain the tickets and related correspondence for 6 years after the ticket has been closed; we then delete the tickets or keep only technical information that can no longer be traced back to you. Personal data from the Itsperfect environment that you share in a ticket (such as a screenshot or an export) we process on behalf of your organization and keep only for as long as we need them to handle your report. d. Invoicing and debt collection

What does this purpose entail?

We invoice our services, process and monitor payments, keep our financial records and collect outstanding claims. If payment remains outstanding after reminders, we may block access to the Itsperfect environment until payment is received.

What personal data do we process for this purpose?

Name and contact details of the contact person, billing address, company registration number and VAT number, bank account number, invoicing and payment details, payment behaviour and access status.

What is the legal basis?

Performance of the agreement, if you are yourself our contracting party (Article 6(1)(b) GDPR), our statutory bookkeeping and retention obligations, for example under Article 52 of the Dutch General Tax Act or Section 147 of the German Fiscal Code (Article 6(1)(c) GDPR), and our legitimate interest in performing the agreement with your organization and, in the event of non-payment, in collecting our claims (Article 6(1)(f) GDPR).

We retain records subject to statutory bookkeeping obligations for the statutory period, for example 8 years after the end of the financial year in the Netherlands and, in Germany, 8 years for invoices and accounting vouchers and 10 years for books and annual accounts, from the end of the calendar year concerned. We retain other payment and access-status data for 8 years after the end of the agreement. If a claim remains outstanding, we retain the data relating to that claim until it has been finally settled and, thereafter, for as long as the applicable limitation or enforcement period requires.

II. WEBSITE VISITORS

a. Handling questions, comments and complaints

What does this purpose entail?

When you contact us via the contact form, by email or by telephone, we handle your question, comment or complaint.

What personal data do we process for this purpose?

Name, company name, email address, telephone number and the information you provide during contact.

What is the legal basis?

Our legitimate interest in handling questions, comments and complaints (Article 6(1)(f) GDPR) and, if your question concerns an existing or intended agreement with us, the performance of that agreement (Article 6(1)(b) GDPR).

We retain the data for this purpose for 12 months after we have handled your question or comment. If your contact concerns interest in our services, the retention period under I.a applies; if it leads to an agreement, the retention period under I.b applies. We retain complaints and the related correspondence for 6 years after the complaint has been settled, so that we can deal with any claim arising from it. b. Pricing and demo requests

What does this purpose entail?

When you request pricing information or a demonstration via our website, we handle your request and send you the requested information. For a demonstration, you receive a personalised link to our demo environment. We record your request in our CRM system, together with, if you have consented to this via our cookie banner, the advertisement or channel through which you reached our website, and follow it up as described under I.a.

What personal data do we process for this purpose?

Name, business email address, telephone number, organization and job title, the content of your request, the advertisement or channel through which you reached our website (if you have consented to this), and your use of the demo environment.

What is the legal basis?

Taking steps at your request prior to entering into an agreement, if you are yourself our prospective contracting party (Article 6(1)(b) GDPR); otherwise our legitimate interest in handling and following up requests from organizations (Article 6(1)(f) GDPR). For the advertisement or channel data, your consent, which we ask for via our cookie banner (Article 6(1)(a) GDPR).

We retain the data for this purpose for 24 months if no agreement follows; if an agreement follows, the retention period under I.b applies.

c. Operating and improving our website

What does this purpose entail?
We analyse how our website is used and compile statistics in order to improve our website, products and services. We also record your choices in our cookie banner, so that we can respect them and demonstrate that we do so.

What personal data do we process for this purpose?
IP address, browser and device data, website language, click behaviour, cookie identifiers and your cookie choices.

What is the legal basis?
For analytical cookies, your consent, which we ask for via our cookie banner (Article 6(1)(a) GDPR). For functional cookies that are necessary for our website to work, our legitimate interest in a properly functioning website (Article 6(1)(f) GDPR). For recording your cookie choices, our legal obligation to demonstrate consent (Article 6(1)(c) GDPR, read with Article 7(1) GDPR) and, for refusals, our legitimate interest in respecting your choice (Article 6(1)(f) GDPR).
 Information about the cookies we use, their purposes and applicable retention periods can be found in our cookie statament, which is accessible via the cookie banner. d. Marketing and measuring our campaigns

What does this purpose entail?
We measure the effectiveness of our marketing: which advertisement or channel brought you to our website and whether your visit leads to a request. Based on your website visits, we compile target audiences and show you personalised advertisements via platforms such as Google, Meta and LinkedIn, which involves creating a profile of your interests. We also use Leadinfo and Hubspot to recognise, on the basis of the IP address, which organisation visits our website and which pages it views; we may record that organisation as a lead in our CRM system and approach it (see I.a). If you are known to us as a contact person, we may link this information to your contact details in our CRM system.
For collecting data on our website, passing them on to an advertising platform and using them to target our advertisements, we are joint controllers with that platform (Article 26 GDPR); the essence of that arrangement is available on request. For its further processing for its own purposes, the platform is an independent controller.

What personal data do we process for this purpose?
IP address and the organisation identified on that basis with its business contact details, online and cookie identifiers, pages visited and time of visit, the advertisement or channel through which you reached our website, interactions, conversions and interest data derived from these.

What is the legal basis?
Your consent, which we ask for via our cookie banner (Article 6(1)(a) GDPR).
 We retain personal data for this purpose for up to 14 months. Aggregated data that can no longer be linked to an identifiable individual may be retained for longer, as such data no longer qualifies as personal data under the GDPR. If we record an organisation as a lead, the retention period under I.a applies to its business contact details. The retention periods of the cookies are stated in our cookie declaration.  f. Newsletter and marketing communications

What does this purpose entail?

We send you our newsletter and other messages about our products, new releases, events and services and, if we use an email pixel, measure whether they are opened and clicked. We record your subscription or consent, your unsubscription and any objection, so that we can respect them and demonstrate that we do so.

What personal data do we process for this purpose?

First name, surname, email address, employer, job title, the date, time and manner of your subscription or consent, your unsubscription status and, if an email pixel is used, your reading and click behaviour.

What is the legal basis?

Your prior consent if you have subscribed to our newsletter or are not yet a customer, and always for the email pixel (Article 6(1)(a) GDPR). For contact persons of existing customers, our legitimate interest in informing our customers about our own similar products and services (Article 6(1)(f) GDPR), but only where the existing-customer exception permits this: we obtained your email address in connection with a sale, offered you a simple opt-out when collecting it and in every message, and you have not opted out; otherwise, we ask for your prior consent. The national rules on electronic marketing and on storing and accessing information on your device also apply, for example Articles 11.7 and 11.7a of the Dutch Telecommunications Act and, in Germany, Section 7 of the Act against Unfair Competition (UWG) and Section 25 of the Telecommunications Digital Services Data Protection Act (TDDDG).

 We retain your personal data for this purpose until you unsubscribe or withdraw your consent. If you are not a customer, we will delete your personal data upon withdrawal of your consent. If you are an existing customer, we may continue to retain your personal data for other purposes, such as sending service-related communications, and will place your email address on a suppression list to ensure that you no longer receive marketing communications. We retain records of your consent or unsubscription for up to five years to demonstrate compliance with applicable legal requirements.

III. CONTACT PERSONS OF SUPPLIERS, PARTNERS AND INTEGRATION PARTNERS

a. Performance of agreements, orders and assignments

What does this purpose entail?

We enter into and perform agreements with suppliers, service providers, partners and integration partners (whose software is integrated with the Itsperfect solution), settle orders and assignments, record the arrangements made, process and pay purchase invoices, keep our financial and tax records and communicate with you as a contact person.

What personal data do we process for this purpose?

Name, salutation, job title, telephone number, email address, address details, company registration number, bank account and VAT number, the arrangements made (including any confidentiality agreements) and other information you provide in the course of the agreement.

What is the legal basis?

Performance of the agreement, if you are yourself our contracting party (Article 6(1)(b) GDPR); otherwise our legitimate interest in performing the agreement with your organization and in recording and complying with the arrangements made (Article 6(1)(f) GDPR). For our financial and tax records and other documents we must keep by law, our statutory bookkeeping and retention obligations (Article 6(1)(c) GDPR).

We retain the data for this purpose for the term of the agreement or cooperation plus 8 years.

IV. POTENTIAL COLLEAGUES

a. Recruitment and selection

What does this purpose entail?

To fill vacancies at Itsperfect, our recruiter actively searches for suitable candidates, for example on LinkedIn, and may ask you whether you want to apply; a recruitment agency engaged by us may also approach you or introduce you to us. We assess your application, whether you apply yourself or after being approached, and share the progress and outcome of the procedure with any recruitment agency involved.

What personal data do we process for this purpose?

Contact details (name, address, email address and telephone number), job title, employer, work experience, education and skills from your public professional profile (such as LinkedIn) or provided by a recruitment agency, the personal data in your CV and cover letter, notes of contacts and interviews, the results of any assessment, information from reference checks if you have agreed to these, and a proposal for terms of employment.

What is the legal basis?

If we approach you before you apply, our legitimate interest in finding suitable candidates for our vacancies (Article 6(1)(f) GDPR). Once you apply, taking steps at your request prior to entering into an employment contract (Article 6(1)(b) GDPR) and our legitimate interest in an effective recruitment and selection process (Article 6(1)(f) GDPR).

We retain the data for this purpose until 4 weeks after the end of the application procedure or, if we approached you and you do not apply, up to three months after our last contact; after an objection, we only keep what is needed to avoid approaching you again. If you join us, your data becomes part of your personnel file.

b. Talent pool

What does this purpose entail?

If you are not selected, or are not interested in a vacancy at that time, we may ask for your consent to keep your details in our talent pool for future vacancies.

What personal data do we process for this purpose?

Contact details and the personal data in your CV, cover letter or professional profile.

What is the legal basis?

Your separate consent (Article 6(1)(a) GDPR).

We retain the data for this purpose for up to 12 months.

3. Sources of personal data

We obtain most personal data directly from you, for example via the forms on our website. We also obtain personal data from:

• Your employer — when it designates you as a contact person for a customer, supplier or partner.
• Other Itsperfect companies — for the purposes in this privacy statement.
• Our website and systems — IP address, cookie and tracking data, click behaviour and the advertisement or channel through which you reached our website, and payment behaviour and access status from our own systems.

• Other service providers — advertising platforms, our email marketing provider and our cookie consent provider.

• Public sources — such as commercial registers (e.g. Chamber of Commerce), your employer’s website and public LinkedIn profiles.
• Events and introductions — business cards or organizer data from trade fairs and events, and partners or contacts who recommend you.
• Recruitment agencies, professional networks such as LinkedIn, job platforms and referees — in the context of recruitment.

4. With whom do we share personal data?

We share personal data with the following (categories of) recipients:

• Other Itsperfect group companies, for example for support, implementation or hosting
• Our hosting provider and other IT service providers, and the suppliers of our office software, CRM system, website, website analytics, visitor recognition (Leadinfo), email marketing software and cookie consent software
• Advertising platforms such as Google, Meta and LinkedIn, if you have consented to marketing and tracking cookies (see section 2, II.e)
• Recruitment agencies involved in your application procedure
• Our accounting firm, for our financial records and (annual) audits
• Banks, collection agencies and bailiffs
• Security specialists, certification bodies, auditors, (legal) advisers, dispute resolution bodies and courts
• Government authorities, such as tax authorities, the police, the judiciary and data protection authorities, where required by law or in the event of a suspected criminal offence

5. Transfer of personal data outside the EEA

Some service providers (such as the suppliers of our office, email marketing and website statistics software) and the advertising platforms we use are established, or belong to a group established, outside the European Economic Area (EEA), in particular in the United States. Where personal data is processed outside the EEA as a result, we rely on an adequacy decision of the European Commission (for the United States: the EU-U.S. Data Privacy Framework, Implementing Decision (EU) 2023/1795, insofar as the recipient is certified under it) or on the standard contractual clauses (Implementing Decision (EU) 2021/914). You may request a copy of these safeguards from our central point of contact (see section 8).

6. Automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR.

7. Your rights

Under the GDPR, you have the right of access, rectification, erasure, restriction of processing and data portability, and the right to withdraw your consent at any time, without affecting the lawfulness of the processing before the withdrawal. You can exercise these rights via our central point of contact (see below). You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state where you live or work or where the alleged infringement took place, for example the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the data protection authority of the German federal state concerned.

Right to object: you may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest, including related profiling. We will then stop, unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for legal claims. You may object to direct marketing at any time, without giving reasons; we will then stop processing your data for that purpose, including related profiling.

8. Contact

Itsperfect,

Baarnsche Dijk 12C, 3741 LS Baarn, the Netherlands

Phone: +31 85 016 0175

Email: support@itsperfect.io

Group Companies

Indigo BidCo B.V. (Dutch Chamber of Commerce number 42111278), IT’s Perfect Nederland B.V. (61349453), IT’s International B.V. (67527515), IT’s Perfect Marketing B.V. (86911449), IT’s Perfect Consultancy B.V. (86911430), IT’s Perfect Support B.V. (86911457), IT’s Perfect Personeel B.V. (86911473), IT’s Perfect Hosting B.V. (86911465), T2TT Holding B.V. (65638824) and IT’s Perfect Deutschland GmbH ([commercial register number]), together: “Itsperfect”.

Date: 21 October 2026

Version: 1