Privacy policy

1. Controller

Automatevia is the controller for the personal data processed through this website and our business communication.

• Trade name: Automatevia
• Chamber of Commerce (KvK) number: 99787113
• Privacy contact: info@automatevia.com
• General contact: info@automatevia.com

Automatevia is a sole proprietorship and has no legal obligation to appoint a Data Protection Officer (DPO). For all privacy requests you can use the email address above.

2. Which personal data we process

We process the following categories of personal data:

• When you contact us by form, email or phone: name, business email address, phone number, company name, job title and the content of your message. If you say yes to the measurement question and submit a scan request, we also receive the available campaign details (UTM parameters) and the Google Ads click identifier (gclid) from the page address or from tab storage permitted for that purpose. We include these with your request in our internal notification email to identify the source of your request. Without that consent, we do not read or include these details for source measurement. You can also voluntarily tell us how you found us when submitting your request; we receive that answer with your request, independently of your measurement choice. If you consent to Google Analytics, that measurement program also receives the page address, including campaign details and the gclid if present.
• For business outreach on LinkedIn: business contact details (name, job title, LinkedIn URL, company name, company address) taken from public sources such as your employer's website, LinkedIn and professional business directories.
• US business selection and contact by email, and existing UK records: see section 10.
• When you visit the website: technical log data such as IP address, browser type and pages visited (through Netlify hosting). We also use this log data to count visits, only as totals (see section 7). If you say yes to the question about measuring, then also data about your visit through Google Analytics (see section 7).
• For client engagements: additional data needed to deliver the agreed services (such as login details for systems we are allowed to work with), in accordance with a data processing agreement where applicable.

3. Purpose and legal basis

We process personal data for the following purposes:

• Answering incoming contact requests and preparing quotes, legal basis: performance of or preparation for a contract (Art. 6(1)(b) GDPR).
• For reading and including campaign details (UTM parameters) and the Google Ads click identifier (gclid), and for temporarily storing and later reading them in your tab, we rely on your consent (Article 6(1)(a) GDPR). For your voluntary answer about how you found us, we rely on our legitimate interest in understanding the source of requests (Article 6(1)(f) GDPR); answering is optional and independent of your measurement consent.
• Business outreach to professionals at potentially relevant companies on LinkedIn, legal basis: legitimate interest (Art. 6(1)(f) GDPR). Our interest is identifying companies that may benefit from AI automation; we focus exclusively on business contact details in a B2B context, limit the frequency, and respect every opt-out (see section 9).
• US business selection and contact by email, and existing UK records: see section 10.
• Carrying out client engagements, legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Legal obligations (for example the 7-year retention obligation for administration), legal basis: legal obligation (Art. 6(1)(c) GDPR).
• Improving our website and services based on aggregated, non-identifiable data, legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Counting visits to the website from the log data of our hosting provider, only as totals, without cookies and without placing or reading anything on your device, legal basis: legitimate interest (Art. 6(1)(f) GDPR). Our interest is knowing how many people visit the site and which pages they read.

4. Retention periods

• Contact form and email correspondence: up to 2 years after the last contact, unless a client relationship arises.
• Outreach lists and communication logs for LinkedIn: up to 2 years after the last interaction, or sooner on request.
• US business selection and contact by email, and existing UK records: see section 10.
• Client data and invoicing: 7 years on the basis of the tax retention obligation.
• Server and website logs: up to 12 months.

5. Sharing with third parties and processors

We do not sell personal data. We share data with processors under a data processing agreement and, for AI services, as described below. The processors at this moment include:

• Hosting and infrastructure providers (including Netlify, Google Workspace)
• Email and outreach tooling (for example Resend, LinkedIn, SendPilot, and Hostinger for the mailboxes on automateviahq.com and automatevia-agency.com)
• Accounting and invoicing software
• Apify, for public search results as described in section 10.

When processing by these processors takes place outside the EEA, we ensure an appropriate level of protection through EU Standard Contractual Clauses (SCCs) or an adequacy decision.

AI services: We use ChatGPT by OpenAI and Claude by Anthropic to assess business contact details and draft and review messages. These services may receive contact details and message content and process them in the United States and other countries. We use personal subscriptions. OpenAI and Anthropic process the information we submit under their own privacy policies: OpenAI and Anthropic.

In addition, the following services receive data when you use our website:

• Google (Google Analytics, visit measurement): only after you have said yes to the question about measuring. Google receives your IP address, the pages you view (with the address as you arrived, even if an advertisement has attached an identifier to it), the page you came from, data about your browser and device, and a visitor number from the two cookies.
• Cal.com (calendar): only on the contact page and on personal proposal pages, after you have clicked the calendar button. Cal.com receives your IP address, data about your browser, and when booking what you enter: your name, your email address and the chosen time.
• Unsplash (images): on the homepage and in the blog. Unsplash receives your IP address and data about your browser.

If you book an appointment in the calendar, we receive the data of your booking, including your name, your email address and the time. This data is stored with our hosting provider (Netlify). Your name, your email address and the time are also sent as a notification to our own account with the messaging service Telegram.

6. Security

We take appropriate technical and organisational measures to protect personal data against loss or unlawful processing, including encrypted connections (HTTPS), access control and separated storage of client environments. Despite these measures, no method of transmission or storage over the internet is 100% secure.

7. Cookies and visit measurement

On your first visit, we ask whether we may measure your visit with Google Analytics and remember in your tab which advertisement or link brought you here, so we can include that source with your scan request. We also ask permission to read and include campaign details (UTM) and the Google Ads click identifier (gclid). As long as you have not chosen, and if you choose no, we do not load that measurement program. No measurement cookies are placed and no data about your visit goes to Google.

If you choose yes, we use Google Analytics to measure which pages are visited, and whether you send the free scan form, book an appointment or click a WhatsApp link or an email address. What you enter in the form does not go to Google with this. Google Analytics then places two cookies on our domain: _ga and a cookie whose name starts with _ga_. Both have a lifetime of 400 days. The measurement data goes to Google.

We keep your choice in your own browser for six months. This is not a cookie, and the choice is not sent to us or to anyone else. After that we ask again. You can change your choice through the link Cookie settings in the footer. If you go from yes to no, we remove the two Google Analytics cookies and no longer load the measurement program.

Only if you consent to source measurement do we temporarily store the campaign details and click identifier in the current tab's sessionStorage, so we can include them with your scan request after you navigate to another page. This is not a cookie, but it is browser storage for the duration of the tab session. We also remove the stored source details once you have submitted the scan or withdraw your consent through Cookie settings. Without that consent, we do not use this storage or read or include UTM parameters or a gclid from the current page address for source measurement. We do not send your scan request back to Google as an offline conversion. Google Analytics receiving the page address after consent is described separately above.

Separately from that question, we count visits from the log data of our hosting provider, with Netlify Web Analytics. Nothing is placed on or read from your device for this, not even a cookie, and it works the same whether you choose yes or no. Netlify turns this into totals, such as the number of page views, the number of different IP addresses per day, the most visited pages, the locations visits came from and the sites visitors came from. We only see those totals, not data per visitor.

If you switch language on the site, a cookie named locale remembers that language for one year. In addition, your browser stores on your own device whether you have seen a language suggestion, and the draft of an intake form you have not yet sent.

On the contact page and on personal proposal pages you can book an appointment in a calendar from Cal.com. We only load that calendar when you click the button. Cal.com then places three cookies of its own: two disappear when you close the browser, the third within a day. The calendar then also fetches an image from Google itself and reports errors to an error reporting service (Sentry).

The homepage and the blog show images that your browser fetches from Unsplash. In our check Unsplash did not place a cookie when doing so; your IP address and data about your browser do go to Unsplash.

8. Your rights

Under the GDPR and, where it applies, the UK GDPR you have the following rights, as far as they apply to the legal basis of the processing:

• Access the personal data we process about you;
• Ask for correction of incorrect or incomplete data;
• Request deletion of your data ("right to be forgotten");
• Restrict the processing or have it paused temporarily;
• Have your data transferred in a commonly used format (data portability);
• Object to processing based on legitimate interest, in particular to direct marketing / outreach. We honour this objection without conditions, as described in section 9.
• Withdraw consent you gave earlier.

Send your request to info@automatevia.com. We respond within 30 days. For verification we may ask for additional information.

9. Opting out of business outreach

You can object to direct marketing at any time, free of charge and without giving a reason. Do you receive email or LinkedIn messages from us and no longer want to receive them? Then the following applies:

• Reply to our message, for example with STOP. Any clear opt-out is sufficient, also without that word.
• Or send an email to info@automatevia.com.

For email we then stop marketing to you immediately, including scheduled messages and profiling for marketing. For LinkedIn we set you to opted out in our outreach program the same working day, so that no new messages follow. After that we only keep a separate opt-out record: the address or identifier needed to recognise your opt-out and its date, not your full prospect profile. We keep it for as long as needed to avoid approaching you again and review that need every year.

10. US business selection and contact by email, and existing UK records

Automatevia is responsible for the personal information used for this business contact. You can reach us at info@automatevia.com. Our identification details appear at the top of this privacy policy. Messages from automateviahq.com and automatevia-agency.com are also sent by Automatevia.

Since 23 October 2026, new business selection and outreach focus exclusively on US companies. We research these companies to assess suitable business opportunities for our automation services and digital systems and may contact selected companies about relevant services. We do not initiate new UK contacts. We retain records from the earlier UK selection until no later than their applicable deletion dates under the periods below. Where the information identifies you personally, we use your name, professional role, work email address, company name, the source and collection date, the business reason for selecting the contact and our correspondence. For the earlier UK selection our sources were the company's own website, for the contact details and for the reason we selected the company, public search results and trade association lists, only to find that website, and the UK Companies House register, only to check that the company was active. When we sent a first message, we stated where we found your contact details. Publication of an address does not mean you have consented.

For the US selection, we use the company's own website to assess its business needs and the fit with our services. We also consult public business requests for help, for example on professional forums, to assess whether there is a relevant request for external support. We use public search results to find the original source, including through Apify. Names and other personal information may be visible in this process. A search result or request for help does not establish consent to approach someone. We assess the business opportunity first. If personal information is needed for that assessment or for later contact, we record why it is necessary and weigh our business interest against your privacy and reasonable expectations before processing it. Any business contact details are obtained from the company's own website; we keep the source and collection date and tell you where we found the information when we first contact you. A general or role-based address can also be personal information if it identifies you.

Before contacting a US company, we consult public company registers only to check whether the company exists and is active. In doing so, we may incidentally see publicly listed personal names; we do not store personal information from the registers.

We rely on legitimate interests under Article 6(1)(f) of the EU GDPR and, where applicable, the UK GDPR. Our interest is finding suitable business customers for our automation services. We weigh this against your privacy, reasonable expectations and right not to receive marketing. We limit the information and frequency of contact to what is necessary for that purpose. You do not have to respond. If you object, we stop marketing to you.

Our retention policy for UK and US research records is to delete them no later than 30 days after collection if we do not contact the prospect, or 90 days after the first email if we do. Where a LinkedIn request is recorded, the collection-based period is replaced by 30 days after that request, or 90 days after that request if the recipient has replied. Where both email and LinkedIn contact dates exist, the earliest applicable contact deadline applies. A substantive conversation does not extend the research record to the longer retention period for correspondence.

For mailbox correspondence and the associated contact records, our retention policy is 90 days after the first email. Where a substantive conversation takes place, we retain the necessary correspondence for up to 730 days after the last substantive exchange. A follow-up sent by us alone does not restart that period. If a client relationship begins, the retention periods for client records apply; any statutory retention obligations still apply.

To avoid approaching someone again after an opt-out, a reply or an undeliverable email, we retain a record of the address or company domain, the reason, the date and a reference to the message. We keep this record for as long as we carry out business acquisition; every year we review whether retaining it and each item remains necessary.

After deleting addresses we have contacted, we retain a one-way hash of the address or company domain to prevent a new initial approach. Our policy is to delete this hash 730 days after deletion of the original record. For deleted addresses we never contacted, we retain a hash to redact those addresses from technical session logs, for a maximum of 730 days from the date the research record was actually deleted. These hashes are pseudonyms and remain personal information where they can be linked to an individual.

We keep encrypted backups locally on our own systems. We retain the last seven successfully created packages and remove older packages after a successful new build; this is not a fixed seven-day period. US research files are excluded from these packages. Other records and system state may be included. Technical session and work logs are separate from research records and may contain information that was consulted. Our retention policy is to delete the information in these logs no later than 100 days after it was recorded. We are still introducing the deletion process for these logs; until it first runs, they may contain older information.

These periods are our retention policy. Checks run daily; actual deletion processes are being introduced in stages no later than the first expiry dates. This does not mean that all the information mentioned is already deleted automatically.

We use Apify Technologies s.r.o. (Czech Republic) as a processor to collect public search results. Apify receives our search queries and settings and processes the resulting titles, links and snippets, which may contain personal information. We delete our raw Apify datasets once the necessary findings have been recorded, no later than seven days after the run, and verify and log deletion. For the remaining run storage, including run logs, input metadata in the key-value store and the request queue, our policy is likewise to delete it no later than seven days after the run and to verify and log deletion. Our session transcripts are not covered by this deletion of Apify run storage. Apify may also process data outside the EEA; its data processing terms provide for appropriate transfer mechanisms where legally required, including EU standard contractual clauses. Further information is available in Apify's data processing terms.

Access is restricted to authorised staff and the service providers needed for this processing. We keep the prospect records as files on our own computer in the Netherlands, not in an external contact management system. We send and receive the emails through mailboxes at Hostinger (HOSTINGER INTERNATIONAL LIMITED, Cyprus), and replies to info@automatevia.com arrive in Google Workspace. To assess contact details and draft and review messages we use AI services, as described under AI services in section 5. We do not sell your personal information.

Hostinger says it may also store data outside the EEA and uses the EU standard contractual clauses for that. Google Workspace uses an adequacy decision or the EU standard contractual clauses. Where UK GDPR applies: the EU has an adequacy decision for the United Kingdom, and the United Kingdom recognises the EEA as adequate. For the AI services, see AI services in section 5.

You can object to direct marketing at any time, free of charge and without giving a reason. Reply to our message, for example with STOP, or email info@automatevia.com. Any clear opt-out is sufficient. We then stop marketing to you immediately, including scheduled messages and profiling for marketing. You may also request access, correction, deletion or restriction of your personal information where those rights apply. You may complain to the Dutch Autoriteit Persoonsgegevens and, where UK GDPR applies, the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.

11. Filing a complaint

Can we not resolve it together? Then you have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) through autoriteitpersoonsgegevens.nl. Where UK GDPR applies, you can also complain to the UK Information Commissioner's Office through ico.org.uk/make-a-complaint.

12. Changes

We may change this privacy policy when our services or laws and regulations give reason to do so. The current version is always on this page, with the date of the last update at the top.

13. Contact

Questions about this privacy policy or about the processing of your personal data? info@automatevia.com.