1. Who we are
Wellcom Technologies B.V. (trading as Wellcom Health) is the controller for the processing described in this statement.
- Address
- Asterweg 16, 1031 HN Amsterdam, the Netherlands
- Dutch Chamber of Commerce (KvK) number
- 94197717
- Website
- https://wellcom.nl
- info@wellcom-health.nl, also for privacy questions
2. Who this statement is for
This statement applies to:
- visitors to wellcom.nl;
- people who request or schedule a demo;
- people who request the implementation guide;
- people who email us or contact us in another way;
- job applicants.
Do you use the Wellcom portal (portaal.wellcom.nl), for example after creating an account? Then the portal privacy statement (PDF, in Dutch) applies to your account. Data about patients or clients that you process in the portal as a healthcare professional is covered by the data processing agreement with your organisation. Under that agreement, Wellcom is the processor.
3. What data we process and why
We only process the data that is necessary for the purpose. For each activity, you can see below which data this is, on which legal basis under Article 6 GDPR we process it and how long we keep it.
Visiting the website
- Data
- IP address, browser and device data, page visited and time
- Purpose
- Making the website work technically and keeping it secure
- Legal basis
- Legitimate interests (Article 6(1)(f) GDPR)
- Retention period
- No longer than necessary for security and for resolving faults
Requesting a demo via the form
- Data
- Name, email address, organisation (optional) and your question (optional)
- Purpose
- Contacting you and scheduling the demo
- Legal basis
- Taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR)
- Retention period
- 12 months after the last contact, unless you become a customer
Your email address in the demo form, even if you do not submit the form
- Data
- Your email address. We receive it as soon as you enter it and move to another field, even if you do not submit the form afterwards
- Purpose
- Contacting you if you do not complete your request
- Legal basis
- Legitimate interests (Article 6(1)(f) GDPR)
- Retention period
- 12 months after the last contact
Scheduling a demo directly in the calendar
- Data
- Name, email address, chosen time and any additional notes
- Purpose
- Making and confirming an appointment
- Legal basis
- Taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR)
- Retention period
- 12 months after the appointment
Requesting the implementation guide
- Data
- Name, email address, organisation, job title (optional) and whether you would like help with the implementation now
- Purpose
- Giving you the guide and contacting you about introducing AI-assisted documentation
- Legal basis
- Taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR) for the guide; legitimate interests (Article 6(1)(f) GDPR) for the contact afterwards
- Retention period
- 12 months after the last contact, unless you become a customer
Contact by email
- Data
- Name, email address, content of your message and any attachments
- Purpose
- Answering your question
- Legal basis
- Legitimate interests (Article 6(1)(f) GDPR)
- Retention period
- 12 months after it has been dealt with
Applying for a job
- Data
- Name, contact details, CV, cover letter and anything else you choose to send
- Purpose
- Assessing your application
- Legal basis
- Taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR)
- Retention period
- 4 weeks after the end of the procedure; with your consent, up to 1 year
Website statistics (Google Analytics)
- Data
- Online identifiers (cookie ID), device and browser data, approximate location, pages visited and source (ad, search engine or direct link)
- Purpose
- Measuring how the website is used and through which channel requests come in
- Legal basis
- Consent (Article 6(1)(a) GDPR)
- Retention period
- Events 2 months, user-level data 14 months
Measuring ads (Google Ads)
- Data
- Online identifiers (cookie ID, click ID), the ad you clicked and conversions, such as a demo request or a click through to the free trial
- Purpose
- Measuring whether our ads work
- Legal basis
- Consent (Article 6(1)(a) GDPR)
- Retention period
- See the cookie table in Article 4
Measuring ads in ChatGPT (OpenAI)
- Data
- Online identifiers (browser ID, click ID), page visited, conversions (a demo or guide request, a click through to the free trial) and your email address, phone number and name from forms, converted into a code (hashed)
- Purpose
- Measuring whether our ads in ChatGPT work
- Legal basis
- Consent (Article 6(1)(a) GDPR), for marketing
- Retention period
- Cookies: see Article 4. How long OpenAI keeps the measurement data is determined by OpenAI
Legal obligations
- Data
- Data in our accounting records, such as invoices
- Purpose
- Complying with the statutory retention obligation for tax purposes
- Legal basis
- Legal obligation (Article 6(1)(c) GDPR)
- Retention period
- 7 years
We do not process special categories of personal data, such as health data, through the website. So do not include such data in the demo form or in an email.
We do not send a newsletter or other marketing emails unless you have given your consent first. If you are a customer, we may inform you about similar services. You can unsubscribe from these at any time.
5. Who we share data with
We never sell your data. We only share it with parties that are necessary for the purposes in Article 3, or if the law requires us to do so.
| Party | Role | Purpose | Location |
|---|---|---|---|
| Vercel Inc. | Role: Processor | Purpose: Hosting wellcom.nl and handling the forms | Location: EU and United States |
| Microsoft Ireland Operations Ltd. | Role: Processor | Purpose: Email (Microsoft 365) and forwarding forms to us (Azure Communication Services) | Location: EU |
| Cal.com, Inc. | Role: Processor | Purpose: The calendar on the demo page, which you use to schedule an appointment yourself | Location: United States |
| Google Ireland Ltd. and Google LLC | Role: Processor for Google Analytics; partly an independent controller for Google Ads and YouTube | Purpose: Website statistics, conversion measurement, advertising and the video on the homepage | Location: EU and United States |
| OpenAI | Role: Advertising platform | Purpose: Measuring our ads in ChatGPT | Location: United States |
We have concluded a data processing agreement with our processors. It states that they only use your data on our instructions and keep it properly secured.
Our website contains links to other websites, such as LinkedIn, Google Maps, the Chrome Web Store and Digizo.nu. If you click on such a link, the privacy statement of that website applies.
6. Transfers outside the European Economic Area
Some of the data is processed in the United States:
- Google: Google LLC is certified under the EU-US Data Privacy Framework. The European Commission has determined that this provides adequate protection for the data. In addition, the European Commission’s standard contractual clauses included in Google’s terms apply.
- Vercel: Vercel Inc. is certified under the EU-US Data Privacy Framework.
- OpenAI: OpenAI processes the measurement data in the United States. This only happens if you consent to marketing in the cookie banner; the banner also states that the processing takes place in the US.
- Cal.com: Cal.com processes the appointments you make via the calendar in the United States. If you do not want this, request the demo via the form instead.
The email and the forms that Microsoft processes for us are located in the EU.
7. Security
We take appropriate technical and organisational measures to protect your data against loss and unauthorised use. For example, the connection to the website is encrypted (HTTPS) and only employees who need access for their work have access to your data. Wellcom is certified for ISO 27001:2022 and NEN 7510:2024. You can read more about this on Privacy and security.
8. Automated decision-making
We do not take decisions based solely on automated processing that have consequences for you, as referred to in Article 22 GDPR.
9. Your rights
You have the following rights:
- Access: you can ask which data we hold about you.
- Rectification: you can have incorrect data corrected.
- Erasure: you can have your data deleted, unless we are legally required to keep it.
- Restriction: you can ask us to temporarily restrict the use of your data.
- Objection: you can object if we process data on the basis of legitimate interests.
- Portability: you can receive your data in a commonly used file format.
- Withdrawing consent: you can withdraw your consent at any time, for example via Cookie settings. This takes effect from that moment on.
Send your request to info@wellcom-health.nl. We respond within one month. For a complex request, this period may be extended by two months; we will let you know if so. If we have doubts as to whether the request really comes from you, we may ask you to prove your identity. In that case, we will not ask for more data than necessary.
10. Complaints
If we cannot resolve the matter together, you can lodge a complaint with the Autoriteit Persoonsgegevens, the Dutch Data Protection Authority, via autoriteitpersoonsgegevens.nl (in Dutch). You may also lodge a complaint with the supervisory authority in the EU country where you live, for example the data protection authority in your own country.
11. Changes
We may amend this statement, for example if we start using new tools on the website. The version on this page is always the version that applies. The top of this page shows when the statement was last updated. This statement is a translation of the Dutch version; if they differ, the Dutch version prevails.