Who we are
WinSphere Dynamics, the sole proprietorship of Rafael Matabadal, trading under the name WinSphere, registered with the Dutch Chamber of Commerce under number 93325614, VAT number NL005014102B77, established in The Hague, is responsible for processing your personal data as described in this privacy policy. You can reach us at info@winsphere.ai. Our full address is on winsphere.ai/en/bedrijfsgegevens.
What data we process
We process the data you provide yourself, such as your name, business email address, company name, website, sector and team size, plus the data needed to perform our service.
Data that does not come from you directly
For our business services and for approaching potential business contacts, we sometimes process data that we did not receive directly from you. This data comes from public or business sources, such as LinkedIn and Sales Navigator and business data sources like Apollo and Apify, and is used for cold email via Instantly and LinkedIn outreach via HeyReach. This concerns business contact details, such as name, job title, company name, sector and business email address. We process this data on the basis of our legitimate interest in business acquisition (Article 6(1)(f) GDPR) and inform you of this no later than at the moment of first contact, in accordance with Article 14 GDPR. You have the same rights as for data you provide yourself, including the right to object. No longer want to be approached by us, or want your data deleted? Send a message to info@winsphere.ai and we will process that request.
Purposes
We use your data to get in touch, draw up quotes and agreements, carry out the assignment and improve our services.
Legal grounds
We process data on the basis of the legal grounds in Article 6 GDPR: the performance of an agreement, compliance with a legal obligation, a legitimate interest such as our business operations, security and business acquisition, or your consent. In doing so, we adhere to the principles of Article 5 GDPR, including data minimisation and storage limitation.
Retention periods
We do not keep data longer than necessary. Specifically: invoices and tax records 7 years (statutory retention obligation), client and assignment data 5 years after the end of the assignment, contact form leads without an assignment 2 years, job application data 4 weeks after rejection (or 1 year with your consent). An example you provide for the free step (the Introduction, article 17 of our terms and conditions) is deleted, together with anything derived from it, within 30 days after that step ends if no project follows. Copies in backups, including those held by our service providers, expire on their regular schedule; we do not use them. We retain aggregated, cookieless website statistics in accordance with the settings of our hosting platform Framer. Google Tag Manager (container GTM-5MHPWHFV) loads on every visit, because the Cookiebot banner is also loaded through Tag Manager; Google receives your IP address in the process. Google Analytics 4 and Microsoft Clarity only start after you have consented to statistics in the Cookiebot banner. Session recordings from Microsoft Clarity are available for 30 days; recordings we mark as favourites and a random sample are kept by Clarity for up to 9 months.
Sharing with third parties
We only share data with parties that help us deliver our services and only insofar as necessary. These parties process data as processors within the meaning of Article 28 GDPR and offer data processing terms as part of their services. For the website and our business operations we work with, among others: Framer (hosting and cookieless website statistics), n8n and HighLevel (processing and follow-up of form submissions), Notion (internal documentation and project administration), and Apollo, Apify, Instantly and HeyReach (enrichment and approaching of business contacts, see ‘Data that does not come from you directly’ above). Added to that are Google Tag Manager (container GTM-5MHPWHFV), Google Analytics 4 and Cookiebot (consent management); Google Tag Manager loads on every visit, because the Cookiebot banner is also loaded through Tag Manager; Google receives your IP address in the process. Google Analytics 4 only starts after you have consented to statistics in the Cookiebot banner. Microsoft Clarity is not one of them: for Clarity, Microsoft is an independent controller (see ‘Cookies and analytics’).
Transfer of data outside the EEA
Some of our suppliers are located in the United States or process data outside the European Economic Area. This applies, among others, to Framer (hosting), HighLevel (CRM and follow-up), Notion (internal documentation), Apollo and Apify (business data sources for acquisition), Instantly (cold email) and HeyReach (LinkedIn outreach), and Google (Tag Manager, Analytics and fonts). Our automation environment n8n runs on a server in Germany and therefore falls within the EEA. For transfers outside the EEA we ensure an adequate level of protection: an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for US parties certified under it, or, where that does not apply, the European Commission's standard contractual clauses with additional measures. You can request a copy or summary of these safeguards via info@winsphere.ai.
Cookies and analytics
Our website runs on Framer and uses Framer's built-in, cookieless website statistics (via events.framer.com); no tracking cookies are placed and data is processed in aggregated form. Google Tag Manager (container GTM-5MHPWHFV) loads on every visit, because the Cookiebot banner is also loaded through Tag Manager; Google receives your IP address in the process. Google Analytics 4 and Microsoft Clarity only start after you have consented to statistics in the Cookiebot banner. The fonts on this website come from Google Fonts; Google receives your IP address in the process. The banner uses consent mode v2: statistics and marketing are off by default until you make a choice. If you consent to statistics in the cookie banner, we also use Microsoft Clarity. Clarity shows us how visitors use the website, for example where people click and scroll and where they drop off, through session recordings and heatmaps. Clarity masks sensitive text, such as email addresses and what you type into form fields. To do this, Clarity places cookies (including _clck and _clsk). Microsoft collects or receives personal data in the process and, as an independent controller, also uses it for its own purposes, including Microsoft Advertising. You can read more in the Microsoft Privacy Statement: https://privacy.microsoft.com/en-us/privacystatement. You can withdraw your consent at any time via the cookie settings.
Your rights
Under Articles 15 to 22 GDPR you have the right of access, rectification, erasure, restriction, objection and data portability. You also have the right to withdraw consent at any time, without affecting the lawfulness of the processing prior to withdrawal (Article 7(3) GDPR). To do so, send a message to info@winsphere.ai; we will respond within the statutory period of Article 12(3) GDPR.
Automated decision-making
We do not make decisions with legal effects or similarly significant effects that are based solely on automated processing or profiling of website visitors (Article 22 GDPR).
Wwft-related data
If we automate processes for your firm that involve Wwft-related data, such as identification or UBO data, we process it solely on your behalf as a processor within the meaning of Article 28 GDPR, only for that assignment and with the same safeguards described above. Your firm remains the Wwft-obligated institution and the data controller; we do not take over any Wwft obligations from you. The arrangements for this are laid down in writing in the agreement for the assignment.
Security
We take appropriate technical and organisational measures to protect your data, in accordance with Article 32 GDPR. We report a data breach that poses a risk to you without undue delay and where possible within 72 hours to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, Article 33 GDPR) and, in the event of a high risk, also directly to you (Article 34 GDPR).
Contact and complaints
For questions you can contact info@winsphere.ai. Given the nature and scale of its processing, WinSphere is not required to appoint a data protection officer (Article 37 GDPR). You always have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
WinSphereWe make firms easy to find and take the manual work out. Website, automation and custom software for firms and agencies with 10 to 200 people.