Privacy Statement

Who is responsible

CyberMatic, located at Hofmanweg 5A, 2031 BH Haarlem, the Netherlands (Chamber of Commerce 96925469), is responsible for the processing of personal data as described in this statement. The statement applies to the PipeEnrich app and the related pages on cybermatic.nl. Contact: info@cybermatic.nl.

Our two roles

We process data in two roles:

• As controller for your account data, billing, usage logs and support contact.
• As processor for the data in your Pipedrive that the app reads or writes on your behalf. You decide through the field mapping and settings which data that is. If you want to sign a data processing agreement, email us.

Which data we process

• Account data: name and email address of the Pipedrive users who use the app and the details of your Pipedrive company (name, id, API domain).
• Connection data: the OAuth tokens the app uses to communicate with Pipedrive on your behalf.
• Billing data: company name, address, Chamber of Commerce number, VAT number, invoice email address, reference and the payment and subscription status.
• Usage data: one log entry per KvK lookup with who performed it, when, which KvK number or search term, and whether it succeeded. Needed for credit administration and support.
• KvK data: we keep the fetched Business Register extracts in an archive, so repeated lookups come from the cache and cost no credits. Business Register data can contain personal data, for example of sole proprietorships.
• Partner data: if you sign up for the partner programme, we also process contact details, billing details and payout details (IBAN). Visits through a referral link are recorded with a hashed IP address, browser information and timestamp.
• Support: emails you send us and our replies.

Purposes and legal basis

We use this data to:

• provide and run the app (performance of the agreement);
• invoice and keep our records (performance of the agreement and legal obligation);
• prevent abuse, trace errors and secure the service (legitimate interest);
• help you with support questions (performance of the agreement).

We do not sell data and do not use your data for advertising.

Sub-processors and recipients

The app and the database run at Scaleway in a data centre in Amsterdam. In addition we use these parties:

• Pipedrive: your CRM. The app reads and writes there only what you decide through the mapping and settings.
• Dutch Chamber of Commerce (KvK): lookups run through the official KvK API.
• Mollie: payments (iDEAL and SEPA direct debit).
• WeFact: creating and emailing invoices.
• Sentry: error tracking in production. Error reports are technical in nature; we do not include personal data by default.
• Anthropic: only when you use the AI field mapping. We then send the field definitions (names and types) of your Pipedrive organisation fields and the KvK field catalogue, not the contents of your records.

Retention periods

• We keep account data, connection data and settings for as long as you use the app. If you remove the app and want us to erase your data, email info@cybermatic.nl; we then delete your account data from our systems.
• We keep invoices and payment records for 7 years (Dutch fiscal retention obligation).
• We keep usage logs for as long as needed for credit administration and support.
• The KvK archive contains Business Register data and serves as a shared cache for lookups; it is not linked to individuals beyond what the register itself contains.

Security

• All traffic runs over TLS. Every request from the panel is verified through the Pipedrive iframe JWT; routes are shielded by default (deny-by-default).
• Data is strictly separated per Pipedrive company (multi-tenant); there is never cross-company reading.
• The infrastructure runs within the EU (Amsterdam) and access keys are managed outside the codebase, in a secrets manager.

Your rights

For the data for which we are the controller, you have the right to access, rectification, erasure, restriction, portability and objection. Email your request to info@cybermatic.nl; we respond within 30 days. If it concerns data in your Pipedrive, direct your request to the organisation managing that CRM. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Cookies

These pages use no tracking or analytics cookies. The website only remembers your language choice in a functional cookie. The app sets a functional session cookie during installation and login; the panel itself works without cookies, through a secured Pipedrive token.

Changes

We update this statement when the service or regulations require it. The current version is always on this page, with the date of the last change at the top.

Contact

CyberMatic · Hofmanweg 5A, 2031 BH Haarlem, the Netherlands · Chamber of Commerce 96925469
Questions about privacy? Email info@cybermatic.nl.