Privacy policy

Vantion Labs is the controller of your personal data within the meaning of the EU General Data Protection Regulation (GDPR, in Dutch the AVG).

Name

Vantion Labs

Address

Smaragdstraat 2, 9743 KV Groningen

KvK

91500982

VAT (BTW)

NL004895851B52

Contact

hello@vantion.co

We are not required to appoint a Data Protection Officer. Privacy questions and requests reach us directly at hello@vantion.co.

We keep it to four groups:

• Website visitors. Which pages are visited and what is clicked, counted without cookies. If you allow cookies, we also recognise a returning browser and record sessions with form fields hidden. If you then send a form or book a call, that visit is linked to the email you gave. No cross-site tracking. On our ad landing pages, the Google Ads click id is kept with a booking, so we know which ad it came from.
• Call bookings. Your name, work email, company and any message you add when you book a call.
• Clients. Business contact details, project communication (email, chat, reviews) and the billing details we need to invoice you and meet our tax obligations.
• Email. Whatever you choose to send to hello@vantion.co.

We do not knowingly collect personal data from anyone under 16. This site is for business buyers.

Every use of your data rests on one of these legal bases:

• Call bookings and replies: steps you ask us to take before a contract (Art. 6(1)(b) GDPR).
• Delivering our services: performing our contract with you (Art. 6(1)(b)).
• Invoicing and tax records: complying with Dutch tax law (Art. 6(1)(c)).
• Website analytics: counting visits without cookies rests on our legitimate interest in knowing which parts of the site are useful (Art. 6(1)(f)). Cookies, session recordings and linking a visit to a form or booking rest on your consent (Art. 6(1)(a)), which you can withdraw under Cookie settings in the footer.
• Measuring our ads: the Google Ads cookie rests on your consent (Art. 6(1)(a)); keeping the ad click id with a booking rests on our legitimate interest in knowing which ads work (Art. 6(1)(f)).

We use a small number of processors to run the business, each under a data processing agreement. We do not sell, rent or trade your data, and we do not share it with advertising networks beyond measuring our own Google Ads campaigns.

• Analytics: PostHog, hosted in the EU (Frankfurt).
• Advertising: Google Ads, to measure which of our ads lead to a booked call.
• Scheduling: Cal.com, the tool you use to book a call.
• Email and documents: correspondence and contracts, and Resend for the emails this site sends and the newsletter list.
• Payments and accounting: invoicing and bookkeeping. The provider is named on each invoice.
• Project infrastructure: hosting, monitoring and similar services, only where a client engagement needs them and with the client's knowledge.

Before a new processor gets material access to your personal data, we tell you.

The software we build for clients often calls AI models from providers such as Anthropic, OpenAI or Google. Data that passes through those systems belongs to the client and is processed only for the engagement, under the client's instructions and a data processing agreement.

• We use model providers under terms that exclude training on your data, and we name them in the engagement.
• Where a client needs data to stay in the EU, we choose EU-hosted models or regions.
• We do not use one client's data to build or improve work for another.

• Website analytics: session recordings are deleted after 30 days. Usage data is only tied to a named visitor when you allowed cookies and then gave us your email, and we delete it on request.
• Enquiries that do not become work: up to 12 months, then deleted.
• Client records: for the length of the engagement and any warranty period.
• Invoices and tax records: 7 years, as Dutch tax law requires (Algemene wet inzake rijksbelastingen, art. 52).

After that, we delete the data or anonymise it fully.

Some processors sit outside the European Economic Area. Those transfers happen under an adequacy decision or the EU Standard Contractual Clauses. We do not transfer personal data anywhere without one of the two.

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased, where the legal basis allows it;
• restrict or object to processing;
• receive your data in a portable format;
• withdraw consent at any time, where consent is the basis.

Email hello@vantion.co and we respond within 30 days. You can also complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (opens in a new tab).

Without your consent we only use what the site needs to work, and count visits without cookies. If you allow cookies in the banner, PostHog sets a first-party cookie to recognise your browser and records sessions with form fields hidden. You can change your choice at any time under Cookie settings in the footer. Every cookie is listed in our cookie policy. On our ad landing pages, allowing cookies also lets Google Ads set a cookie to measure which ads lead to a booked call. We do not use it for retargeting or ad personalisation.

We protect personal data with encryption in storage and in transit, access on a need-to-know basis, and two-factor authentication on every account that touches client data. No system is perfectly secure; we keep our practices current and share them on request.

When the business or the law changes, this policy may too. The date at the top shows the latest revision. Clients hear about material changes by email at least 30 days before they apply.

Questions, requests or anything unclear: email hello@vantion.co. For how we work with clients, read our terms of service.