Clear about what we do and do not process.

Governancy, established in the Netherlands, is the controller for personal data processed through this website, email and its own business operations. For privacy questions, email privacy@governancy.com.

Depending on your contact with us, we may process the following categories:

• name, organisation, role and business contact details;
• the content of your question, correspondence and meeting notes;
• data for proposals, agreements, project delivery and invoicing;
• technical and security data needed to protect the website and systems;
• data made available by a client for an advisory, audit, awareness or security engagement.

We process personal data only where there is a defined purpose and a valid legal basis.

We do not use personal data for solely automated decision-making that produces legal effects or similarly significant effects for you.

Contact form

Through the contact form you may submit your name, business email address, organisation, optional telephone number, subject and a short explanation. We use this data to assess your request, contact you and prepare an introductory discussion or possible next step.

The form is technically processed by Formcarry (Teijal, Inc.). Formcarry processes submissions on behalf of Governancy for form handling, storage, spam detection and email notifications. Technical data such as IP address, browser/device data, time and referring page may also be processed.

• the connection to Formcarry is encrypted;
• according to Formcarry's processor arrangements, form data is stored on servers in the European Union, in Frankfurt;
• limited access from the United States may take place for support and administration under appropriate safeguards, including the European Commission's Standard Contractual Clauses;
• after submission, the request is available in the secured Formcarry dashboard and we receive a notification at privacy@governancy.com;
• more information is available in Formcarry's privacy policy.

Direct email contact

When you send an email to privacy@governancy.com, we process the data you include in the message. This may include your name, business contact details, organisation, the content of your question and technical email data such as the sending date and sender address.

Plausible Analytics

Governancy uses Plausible Analytics to understand, at an aggregated level, which pages are visited and how the website is used. Plausible does not use cookies, does not create advertising profiles and does not track visitors across websites.

Cookies

Governancy currently does not place marketing or tracking cookies. For technically necessary functions, the website or hosting environment may process limited functional data. If we later introduce non-essential cookies or similar technologies, we will update this statement and request prior consent where required.

• no advertising pixels;
• no cross-site tracking;
• no sale of visitor data;
• no newsletter tracking while no newsletter service is used.

We do not sell personal data. Data is shared only where necessary for the purposes described above, on your instruction, for delivery of an engagement or because the law requires it.

Recipients may include:

• hosting and email service providers;
• Formcarry as processor for contact-form submissions, spam detection, storage and notifications;
• accounting, administration and professional advisers;
• specialist partners contributing to an engagement under responsibility and appropriate arrangements, for example for penetration testing;
• competent public authorities where a legal obligation requires disclosure.

Where Governancy processes personal data solely on behalf of a client, the parties record roles and instructions in a data processing agreement where necessary.

We do not retain data longer than necessary for the purpose for which it was collected. As a general starting point:

• contact requests through the form or by email without an engagement: up to 24 months after the last substantive contact; submissions are also removed from the Formcarry dashboard within that period;
• proposal and project correspondence: as long as needed for the engagement, aftercare and possible claims, generally up to 5 years after completion;
• invoices and data forming part of tax administration: 7 years;
• security data and technical logs: as short as possible, depending on purpose and hosting settings;
• data processed on behalf of a client: according to the engagement, contractual arrangements and the client's instructions.

Data may be retained longer where necessary for a legal dispute, statutory obligation or the establishment, exercise or defence of legal rights.

We take appropriate technical and organisational measures suited to the nature of the data and the risks. These may include:

• encrypted connections and secured accounts;
• access restrictions based on need;
• strong authentication and careful device management;
• updates, backups and security monitoring where appropriate;
• careful supplier selection and contractual arrangements;
• procedures for incidents, deletion and recovery.

No digital processing is entirely risk-free. If you suspect a security issue affecting Governancy, report it via privacy@governancy.com.

Depending on the circumstances, under the GDPR you may have rights including:

• information and access to your personal data;
• rectification of inaccurate or incomplete data;
• erasure of data;
• restriction of processing;
• objection to processing based on legitimate interests;
• data portability where legally applicable;
• withdrawal of consent, without affecting prior lawful processing.

Send your request to privacy@governancy.com. We normally respond within one month. If necessary, we may request additional information to verify your identity. A right may be limited in a specific situation, for example by a statutory retention obligation or the rights of others.

If you have a question or disagree with how we handle personal data, please contact us first at privacy@governancy.com so that we can investigate your concern.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

We may update this privacy statement when our services, suppliers, website or applicable rules change. The current version is published on this page and the date above shows when it was last updated.