Privacy Policy

Last updated: March 2026

Summary

Who we are: Kostavo B.V., [ADDRESS PLACEHOLDER], [CITY, POSTCODE PLACEHOLDER], the Netherlands. Contact: privacy@kostavo.com.

What we process: Account information (name, email address, organisation name) and usage data from your interactions with the Kostavo platform.

Why: To provide and improve the Kostavo service, communicate with you about your account, and, where applicable, comply with legal obligations.

1. Identity and contact details

The controller responsible for your personal data is:

Kostavo B.V.
[Street address placeholder]
[Postcode and city placeholder]
The Netherlands

Email: privacy@kostavo.com
KvK: [Chamber of Commerce number placeholder]

We do not currently have an EU representative or a Data Protection Officer (DPO), as we do not meet the thresholds that require one. If this changes, this section will be updated.

2. Purposes and legal basis for processing

We process personal data for the following purposes:

Providing and managing the Kostavo service

Data: Name, email address, organisation name, payment information.

Legal basis: Performance of a contract (Article 6(1)(b) GDPR). Processing is necessary to deliver the service you have signed up for.

Account communication and support

Data: Email address, support messages.

Legal basis: Performance of a contract (Article 6(1)(b) GDPR) and, for transactional notifications, legitimate interest (Article 6(1)(f) GDPR). Our legitimate interest is to keep users informed about their account status and service updates.

Product analytics and improvement

Data: Usage data, feature interaction logs, error reports.

Legal basis: Legitimate interest (Article 6(1)(f) GDPR). Our legitimate interest is to improve the reliability and utility of the platform. We do not sell this data or use it for advertising.

Legal and financial obligations

Data: Invoice and payment records.

Legal basis: Legal obligation (Article 6(1)(c) GDPR). Dutch tax law requires us to retain invoicing data for at least 7 years.

Marketing communications (optional)

Data: Email address.

Legal basis: Consent (Article 6(1)(a) GDPR). You can withdraw your consent at any time by clicking the unsubscribe link in any marketing email, or by contacting us at privacy@kostavo.com.

3. Recipients of personal data

We share personal data only where necessary to deliver the service. Categories of recipients include:

Cloud infrastructure providers: we use [CLOUD PROVIDER PLACEHOLDER, e.g. Microsoft Azure] to host the platform. Data is processed on their infrastructure under a data processing agreement.
Payment processor: [PAYMENT PROVIDER PLACEHOLDER, e.g. Stripe] processes payment information on our behalf.
Email and transactional communication: [EMAIL PROVIDER PLACEHOLDER] handles delivery of account and notification emails.
Analytics tooling: [ANALYTICS PROVIDER PLACEHOLDER, if applicable]. We do not share personally identifiable information with third-party advertising platforms.

We do not sell personal data to third parties. We do not share personal data with third parties for their own marketing purposes.

4. International transfers

[PLACEHOLDER: to be completed based on actual data flows. Example: "We primarily store and process data within the European Economic Area (EEA). Where a sub-processor is based outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission."]

5. Retention periods

Data type	Retention period
Account data (name, email, organisation)	Duration of the account + 30 days after deletion request
Invoicing and payment records	7 years (Dutch tax law requirement)
Usage and analytics data	[PLACEHOLDER: e.g. 12 months]
Support correspondence	[PLACEHOLDER: e.g. 2 years after resolution]
Marketing consent records	Until consent is withdrawn, plus [PLACEHOLDER] to demonstrate compliance

6. Your rights

Under the GDPR you have the following rights with regard to your personal data:

Right of accessYou may request an overview of the personal data we hold about you.
Right to rectificationYou may ask us to correct inaccurate or incomplete data.
Right to erasureYou may ask us to delete your personal data, where we are not legally required to retain it.
Right to restrictionYou may ask us to temporarily stop processing your data in certain circumstances.
Right to portabilityYou may request a copy of your data in a machine-readable format, for data processed on the basis of consent or contract.
Right to objectYou may object to processing based on legitimate interest. We will stop processing unless we have compelling legitimate grounds.
Withdraw consentWhere processing is based on your consent, you may withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us at privacy@kostavo.com. We will respond within one month.

7. Right to lodge a complaint

If you believe we are not handling your personal data in accordance with the GDPR, you have the right to lodge a complaint with the Dutch supervisory authority:

Autoriteit Persoonsgegevens (AP)
Postbus 93374
2509 AJ Den Haag
www.autoriteitpersoonsgegevens.nl

8. Obligation to provide personal data

To create an account and use the Kostavo platform, providing your name, email address, and organisation name is required. Without this information we cannot provide the service. You are not legally obliged to provide this data. It is a contractual requirement for using Kostavo. If you choose not to provide it, you will not be able to use the platform.

Payment information is required to access paid plans. Free trial users are not required to provide payment details unless they upgrade.

9. Automated decision-making and profiling

We do not make decisions about individuals based solely on automated processing that have a legal or similarly significant effect. Kostavo's automated policies run against Databricks workspace resources (clusters, warehouses, pipelines, etc.). These are technical scans on infrastructure objects, not decisions about natural persons.

10. Source of personal data

We collect personal data directly from you when you sign up, use the platform, or contact us. We do not obtain personal data about you from third parties or public sources, except where your organisation's administrator adds your account on your behalf.

11. Changes to this policy

We may update this privacy policy from time to time. If we make material changes, we will notify you by email or via a notice in the platform before the change takes effect. The "last updated" date at the top of this page reflects the most recent revision.