Privacy Policy for SurikaS

1. Who this Policy applies to

This Privacy Policy explains how Yaghma B.V. (“we,” “us,” “our”), registered with the Dutch Chamber of Commerce under number 84842857, with its registered office at Mercuriusweg 20, 2624 BC Delft, the Netherlands, collects, uses, discloses and protects personal data in connection with SurikaS, our software-as-a-service platform (the “Service”), as well as your choices and rights with respect to your personal data, where we act as a data controller.

This Policy covers personal data for which we act as a controller in connection with SurikaS. This includes personal data relating to:

• Individuals who create or use a SurikaS account on behalf of a Customer organisation (“Account Holders”);
• Individuals who visit or interact with the SurikaS website;
• Individuals who contact us about SurikaS, including to request information, support or a demonstration of the Service; and
• Individuals who receive SurikaS-related communications from us.

This Policy does not apply to personal data submitted or uploaded by Customers as part of Customer Content, for example within project documentation or evidence submitted through the Service. This may include personal data about individuals who do not themselves hold a Service account — such as a person named in an uploaded organisational chart or project team list, mentioned in an email thread or memo submitted as evidence, or listed as an external auditor, consultant, or contractor in a technical document. Our processing of Customer Content is governed by our Data Processing Agreement with the relevant Customer, not by this Policy.

2. What personal data we collect

When you create or use a Service account, we collect: name, email address, organisation name, job title (where provided), and phone number (where provided, for account recovery purposes). This information may be provided directly by you or by the Customer organisation or account administrator that creates or manages your access to the Service.

If you contact us about SurikaS, including through the SurikaS website, to request information, support or a demonstration of the Service, we may collect your name, email address, organisation, and the content of your communication, including any information or attachments you choose to provide.

We may automatically collect limited technical data necessary to operate, maintain and secure the Service, including login timestamps, login attempts and failed logins, session or user identifiers, error and crash logs, usage and activity logs, pages and features used, IP addresses, cookie or similar technical identifiers, and operating system, device and browser information. We use this information only for service maintenance, security and troubleshooting purposes.

Providing your name and email address is necessary to create and use a Service account; without this information, we cannot provide the Service to you. Providing a job title or phone number is optional.

3. Cookies and similar technologies

The SurikaS website may use cookies and similar technologies to enable essential website functionality and, where applicable, to understand how visitors use the website. Where required by law, we will obtain your consent before using non-essential cookies.

4. Why we process your data, and our legal basis

We process personal data covered by this Policy for the following purposes:

• Creating and managing your account — legal basis: our legitimate interests in providing, administering and managing access to the Service.
• Authenticating you and enabling account recovery — legal basis: our legitimate interests in protecting accounts and maintaining the security of the Service.
• Providing customer support — legal basis: our legitimate interests in responding to support requests and assisting Account Holders with the use of the Service.
• Responding to enquiries and demonstration requests — legal basis: our legitimate interests in responding to individuals who contact us about SurikaS and providing information about the Service.
• Billing and invoicing, where the Account Holder is the billing contact — legal basis: our legitimate interests in administering billing and payments, performance of a contract with you where applicable, and compliance with our legal obligations, including applicable accounting and tax requirements.
• Sending service-related communications, such as changes to the Service or our Terms and Conditions — legal basis: our legitimate interests in administering the Service and keeping Account Holders informed about important service-related matters, and compliance with legal obligations where applicable.
• Marketing communications, where you have consented to receive them — legal basis: your consent.
• Ensuring the security of the Service — legal basis: our legitimate interests in protecting the Service, preventing and detecting security incidents, fraud, misuse and unauthorised access.

If we intend to process your personal data for a purpose other than that for which it was collected, we will provide you with information about that purpose and any relevant additional information before beginning that processing.

5. Automated decision-making

We do not use personal data covered by this Policy for automated decision-making that produces legal or similarly significant effects. The Service's classification logic operates on information the Customer provides about its AI systems, not on personal data about Account Holders, and does not use AI or machine learning. Further detail is available in our Terms and Conditions, Section 7 (AI-Assisted Features).

6. Who we share your data with

We may share personal data covered by this Policy with: service providers that process personal data on our behalf, such as providers of hosting, infrastructure, authentication, communications, or technical support services, under appropriate data processing agreements; professional advisers, such as auditors, where necessary; and regulators or authorities, where required by law.

We may also disclose or transfer personal data in connection with a merger, acquisition, reorganisation, sale of assets, or similar corporate transaction, subject to appropriate confidentiality and data protection safeguards.

We do not sell personal data, and we do not share personal data covered by this Policy with other Customers.

7. International data transfers

We aim to store and process personal data within the European Economic Area (EEA). Where personal data is transferred to a country outside the EEA, we will ensure that the transfer is made in accordance with applicable data protection law. This may include relying on an adequacy decision of the European Commission or, where no adequacy decision applies, implementing appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

You may contact us using the details provided in Section 13 (Contact us) for further information about the safeguards used for international transfers.

8. How long we keep your data

We retain personal data only for as long as necessary for the purposes for which it was collected, including to provide and administer the Service, comply with legal and regulatory obligations, resolve disputes, and enforce our agreements.

Account and profile data is generally retained for as long as the associated account remains active and for 90 days after account closure. Different retention periods may apply to certain categories of data, such as billing and accounting records, security logs, and records that we are required to retain by law.

9. Your rights

Under the GDPR, you have the right to: access the personal data we hold about you; request correction of inaccurate or incomplete data; request deletion of your data; request restriction of certain processing; request data portability, where applicable; object to processing based on our legitimate interests, including the right to object at any time to processing for direct marketing purposes; withdraw your consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal; and lodge a complaint with a supervisory authority.

In the Netherlands, this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

To exercise these rights, contact us at info@yaghma.nl.

If your account is managed by a Customer organisation, for example your employer, some requests may need to be directed to that organisation, as they may also independently control certain data about you.

10. Security

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, or disclosure, as further described in Section 5.7 of our Terms and Conditions.

Access to personal data is restricted to authorised personnel who require access for legitimate operational, security or maintenance purposes.

In the event of a personal data breach affecting personal data covered by this Policy, we will notify the relevant supervisory authority and affected individuals where and within the timeframes required by applicable data protection law.

11. Children

The Service and SurikaS website are intended for business and professional use and are not directed at individuals under the age of 18. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have collected personal data from an individual under the age of 18 in circumstances where this is not permitted, we will take appropriate steps to delete that information.

12. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, the Service, or applicable legal requirements. We will update the effective date at the top of this Policy and, where changes materially affect how we process personal data or your rights, we will provide appropriate additional notice, such as by email, in-product notice, or a prominent notice on the SurikaS website, where appropriate.

13. Contact us

If you have questions about this Privacy Policy, how we process your personal data, or wish to exercise your data protection rights, you can contact us at: