Privacy Policy
How we process your personal data under Regulation (EU) 2016/679 (GDPR) and the Dutch Implementation Act (UAVG) / Spanish Organic Law 3/2018 (LOPDGDD).
1. Data controller
2. Data Protection Officer (DPO)
We have appointed a Data Protection Officer in accordance with Article 37 GDPR. You may contact the DPO for any matter relating to the processing of your personal data at info@ahaborg.com.
3. Categories of data we process
- Identification and contact data: name, email address, and, where provided, phone number.
- Commercial data: selected product, order and license details, and message contents.
- Billing data: billing name, address, and tax identification (for invoices). Card data is processed directly by our payment provider; we do not store full card numbers.
- Technical and usage data: IP address, device and browser type, language, timestamps, and aggregated analytics.
We do not knowingly process special categories of data (Article 9 GDPR), nor data from children under 16 without parental consent.
4. Purposes and legal basis
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Answer contact requests and provide product support | Pre-contractual / contract performance — Art. 6(1)(b) |
| Manage purchases, licenses, and invoicing | Contract performance — Art. 6(1)(b); legal obligation — Art. 6(1)(c) |
| Security, fraud prevention, and service integrity | Legitimate interest — Art. 6(1)(f) |
| Analytics and improvement of the website (non-essential cookies) | Consent — Art. 6(1)(a) |
| Commercial communications about similar products | Consent / legitimate interest for existing customers — Art. 6(1)(a)/(f) |
5. Retention periods
| Data | Retention period |
|---|---|
| Contact and support messages | Up to 24 months after the last interaction |
| Orders, licenses, and accounting records | 7 years (Dutch Civil Code art. 2:10 / Spanish Commercial Code art. 30) |
| Marketing consent | Until withdrawal of consent |
| Server logs and security data | Up to 12 months |
6. Recipients and processors
We share data only with processors that act on our instructions under a data processing agreement (Article 28 GDPR). Typical categories include:
- Cloud hosting and infrastructure within the EU/EEA (e.g., Hetzner, Frankfurt).
- Email and productivity services.
- Payment processing (PCI-DSS compliant providers).
- Web analytics, only after consent.
We may also disclose data where required by law or to competent public authorities.
7. International transfers
Our infrastructure is located within the European Economic Area. Where a transfer to a third country occurs, it is protected by an adequacy decision of the European Commission or by appropriate safeguards under Article 46 GDPR, such as the Standard Contractual Clauses, together with supplementary measures where necessary.
8. Your rights
Under Articles 15 to 22 GDPR you have the right to access, rectification, erasure, restriction, objection, portability, and not to be subject to solely automated decisions. You may also withdraw consent at any time without affecting the lawfulness of prior processing. To exercise your rights, write to info@ahaborg.com, indicating the right you wish to exercise. We will respond within one month (Article 12 GDPR).
9. Right to lodge a complaint
If you consider that your rights have not been respected, you may lodge a complaint with the competent supervisory authority:
10. Cookies
We use the following cookies. Non-essential cookies are only set after you give consent through the cookie banner, which you can change or withdraw at any time.
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
| ahb_session | Essential | Maintain the session and security of the site | Session |
| ahb_consent | Essential | Store your cookie preferences | 12 months |
| _pk_id / _pk_ses | Analytics (consent) | Aggregated, privacy-friendly usage statistics | 13 months / 30 min |
Last updated: