REVIEW DRAFT — 11 August 2026 This Privacy Statement is a complete working draft. It must not be published until Daisycon and thinQit have confirmed that the stated retention periods are technically enforced.
1. Identity and scope
Daisycon B.V., P.J. Oudweg 5, 1314 CH Almere, the Netherlands, Chamber of Commerce number 39073684, provides the Daisycon-branded customer relationship. This statement explains how personal data is handled when a Customer or its users register for and use the thinQit-powered platform.
Daisycon is controller for its own customer onboarding, account administration, contracting, invoicing, relationship management and communications. For Customer Data submitted to the platform, the Customer normally determines the purposes and legal basis. thinQit B.V. operates the platform and processes that data to provide hosting, AI teammates, support, usage metering, security and incident response. thinQit acts as processor under the Customer Data Processing Addendum and may act as an independent controller only for its own mandatory legal, fraud-prevention and security obligations.
2. Personal data
Depending on use, the service may process names, business contact details, employer and role; account identifiers, MyDaisycon identifiers and authentication events; subscription, invoice and usage information; IP address, device, browser, operating system and timestamps; settings, integrations and workspace configuration; support communications; prompts, uploaded content and AI outputs; audit, security, error and diagnostic events; and information about other people that the Customer chooses to include in Customer Data.
MyDaisycon OAuth provides the identity information needed to establish and link the workspace account. A limited email/password route may be available where Daisycon authorizes it. The same privacy and security rules apply to both routes.
3. Purposes and legal bases
Personal data is used to create and secure accounts, perform the Customer contract, provide and improve reliability of the service, operate AI functions, meter usage, invoice the Customer, provide support, prevent abuse and fraud, investigate incidents, comply with law and establish or defend legal claims. Legal bases include performance of contract, legitimate interests in operating and protecting a business service, compliance with legal obligations and consent where consent is legally required. The Customer is responsible for the legal basis and notices covering personal data it places in prompts, uploads, integrations or outputs.
4. AI processing
Prompts and relevant context may be sent to approved AI providers only to generate the requested response or perform the requested task. thinQit and its providers do not use Customer Data, prompts or outputs to train general models by default. AI output is probabilistic and must be reviewed by a human. The service is not designed for prohibited high-risk decisions or for special-category, criminal-offence, biometric, medical or children's data unless a written statement of work and an appropriate legal basis expressly permit that processing.
5. Recipients and service providers
Data may be made available only where necessary to Daisycon and authorized Linehub personnel, thinQit personnel, Microsoft Azure and Azure AI Foundry, approved OpenAI and Anthropic entities, email/support/monitoring/security providers, and authorities where disclosure is legally required. Stripe or a banking provider may process data for direct charges between thinQit and Daisycon; thinQit does not process Daisycon end-customer payments through Stripe Connect. Daisycon's downstream administration, including Exact Online, is controlled by Daisycon and is outside thinQit's responsibility unless a separate integration or statement of work says otherwise.
6. International transfers and hosting
The executed Daisycon order selected EU-only hosting for the customer environment. Production hosting is therefore restricted to approved EEA regions for the covered service. If an approved provider or exceptional support, backup or security process involves a transfer outside the EEA, the responsible party uses an adequacy decision, EU Standard Contractual Clauses and appropriate supplementary safeguards as required by law.
7. Retention
The contractual working schedule is: debug and application logs up to 30 days; prompts and outputs up to 90 days unless a shorter setting or statement of work applies; security and audit logs up to 180 days; account data for the contract term plus up to 12 months where needed for closure and claims; support correspondence up to 24 months after ticket closure; and invoice, payment and legally required audit records for seven years. Legal-bundle versions and acceptance evidence are retained for the agreement term plus three years. Customer content is returned, deleted or anonymized within 30 days after termination unless continued retention is required by law or a written instruction.
These periods are maximum contractual defaults, not permission to retain data unnecessarily. Data may be deleted earlier when no longer needed. Publication is blocked as a legal-readiness matter until Daisycon and thinQit confirm that operational deletion, backups and provider settings match this schedule.
8. Security
Daisycon and thinQit use proportionate technical and organizational safeguards, including encryption in transit, encryption at rest where supported, role-based access, multi-factor authentication for privileged access, tenant isolation, logging, monitoring, vulnerability management, backups and incident-response procedures. No system is completely risk-free. Suspected unauthorized access or a personal-data incident should be reported promptly through Daisycon's official contact channel and, for platform-security issues, to [email protected].
9. Rights
Subject to the GDPR and applicable exceptions, people may request access, correction, deletion, restriction, portability or objection and may withdraw consent without affecting earlier lawful processing. Requests concerning Daisycon's own account, contract or billing data should be directed to Daisycon. Requests concerning Customer Data should normally be made first to the Customer that controls that data; Daisycon and thinQit will assist as required by the DPA. A complaint may be submitted to the Dutch Data Protection Authority or another competent supervisory authority.
Daisycon privacy questions and rights requests can be made through the contact route published at https://daisycon.com/en/legal-information/privacy-policy/ or by post to Daisycon B.V., P.J. Oudweg 5, 1314 CH Almere, the Netherlands. thinQit privacy questions may be sent to [email protected].
10. Cookies
Login, security and preference cookies are handled in a separate Cookie Statement and consent interface. Acceptance of this Privacy Statement does not by itself consent to optional analytics or marketing cookies.
11. Changes
Material changes are issued through the versioned legal-bundle workflow. After Daisycon publishes a new version, the Customer receives a Legal terms have changed notice and must accept the required documents again on the next login. Earlier acceptance evidence is preserved. The current version and publication date are shown in the platform.