Our Privacy Statement

What is RegLab?

RegLab is an innovative start-up dedicated to developing software and related services for legal and financial service providers to comply with AML rules and regulations. We develop our software and services based on the conviction that good and efficient client onboarding is the beginning of an optimal client relationship. In doing so, we make a valuable contribution to the integrity of the financial system, and we strengthen its gatekeepers.

Our vision on privacy

RegLab is concerned with supervision and enforcement. The General Data Protection Regulation, which is being enforced from 25 May 2018 and regulates the use of personal data, plays an important role in the field of supervision and enforcement in the growing digital world. RegLab sees privacy and data protection as an essential part of their services and something that needs to be in order. RegLab uses personal data via its website by collecting information via cookies and when visitors use the contact form or demo scheduler. RegLab always does this carefully and in line with the law. 

Contact details

RegLab
Kennemerplein 6-14
2011 MJ Haarlem
The Netherlands
Chamber of Commerce (KvK): 71832521
info@reglab.com

Who processes the personal data?

RegLab is the controller for the processing described in this privacy statement, including processing via our website, our CRM system and the tools we use for our internal work. We are responsible for processing personal data properly and carefully, and in line with applicable laws and regulations.

What is the processing of personal data?

Personal data is any information about a person who is identified or can be identified. Processing covers everything an organisation can do with personal data, from collecting it to destroying it. Even consulting personal data counts as processing. This privacy statement explains which personal data RegLab processes, why, and how we protect it.

Why, how and what does RegLab process?

Contact form and demo scheduler

If you would like advice, more information or a demo, you can contact us via the contact form or the demo scheduler. We use the personal data you submit only to respond to your request. The legal basis is your consent, which you give when you contact us.

The contact form and demo scheduler contain open fields. We therefore check whether the personal data you submit is needed to answer your request, and delete any data that is not.

Cookies

RegLab uses cookies on its website. Cookies are small text files that your computer or mobile device stores when you visit our website. They contain information about how you use the website.

We use functional cookies to make the website work and to help you navigate it. These cookies do not require your consent (Article 11.7a of the Telecommunications Act). We also use analytics cookies, including those of Hotjar and Google Analytics, to analyse and improve the website. We only place these cookies with your consent, which you can give or withdraw at any time via Cookie Settings at the bottom of every page.

Does RegLab work with other parties?

RegLab uses third-party service providers for customer relationship management, advertising, analytics, and other business operations. These providers may process personal data on our behalf in accordance with their respective privacy policies. 

• Customer Relationship Management (CRM): We use HubSpot to manage customer and prospect data, such as contact details and communication preferences. HubSpot acts as our data processor. Legal basis: legitimate interest, performance of a contract and, where applicable, consent. HubSpot Privacy Policy.
  
  
• Advertising: We run targeted campaigns via Google Ads and LinkedIn Ads. For this, we may share encrypted (hashed) personal data, such as names, company names, (work) email addresses, and phone numbers. Legal basis for processing: legitimate interest and consent. These platforms process data under their own privacy policies: Google Ads | LinkedIn Ads. Depending on the situation, Google and LinkedIn may act as processors or as independent data controllers.
  
  
• Analytics & Cookies: We use Hotjar and Google Analytics to analyse how our website is used. This data is linked to a cookie identifier rather than to your name, and we do not use it to identify individual visitors, unless you share personal information with us yourself, for example via the contact form. Legal basis: consent (see Cookies).

• Collaboration and design tools: We use Asana (project management), Notion (internal documentation) and Canva (design) for our internal work. These tools may contain limited personal data, for example contact details of clients or partners we work with, or names and quotes of people who contributed to our case studies. These providers act as data processors. Legal basis: legitimate interest and, for case studies, consent. Asana | Notion | Canva.
  
  

• AI assistant: We use Claude, an AI assistant provided by Anthropic PBC (United States), to support our internal work, such as drafting content and preparing campaigns. Claude is connected to some of our business tools, including HubSpot, Asana, Notion, and Canva. Anthropic acts as our processor under a data processing agreement. It processes the data only on our instructions, does not use it for its own purposes, and is contractually prohibited from using it to train its AI models. Your data is never sold. Claude does not make decisions about you, and all output generated with AI is reviewed by a RegLab employee before it is used. The legal basis is the same as for the original processing of that data; legitimate interest. You have the right to object at any time to processing based on legitimate interest (see “What are my rights as a data subject”). Anthropic Privacy Policy.
  
  

• Publicly available sources: We may also collect personal data from publicly available sources, such as social media platforms, to improve our services and personalise our communications. 

Some of our third-party service providers may process personal data outside the European Economic Area (EEA). Where this is the case, we ensure that appropriate safeguards, such as Standard Contractual Clauses (SCCs), are in place to protect your data. 

We process this data based on our legitimate interest in effectively promoting our services and product. We have carefully assessed the balance between our marketing interests and the privacy rights of our contacts. Where required, we obtain explicit consent for the use of personal data for advertising purposes. We do not retain personal data used for advertising campaigns longer than necessary. When the data is no longer relevant, it is deleted or anonymised. 

Data processed via Claude is retained in line with the retention settings of our Anthropic account and is deleted when no longer needed. Data in Asana, Notion and Canva is kept for as long as needed for the project or purpose concerned.

How long does RegLab use the personal data?

• RegLab uses the personal data from the contact form and demo scheduler as long as necessary to comply with the information request. After this, the data is deleted. 
• The data collected with cookies is used for as long as necessary to achieve the purpose. This means that it will be deleted afterwards.
• We retain customer relationship data in HubSpot for as long as necessary to maintain our business relationship or comply with legal obligations.
• Advertising data is retained only for the duration necessary for campaign effectiveness, after which it is anonymised or deleted. 

What are my rights as a data subject, and how do I invoke them?

If RegLab processes your personal data, you have various rights that you can invoke with regard to RegLab:

• The right to inspect your personal data.
• The right to rectification of the personal data if you think that the personal data is factually incorrect or incomplete.
• The right to erasure if: (1) the personal data is no longer needed for the purposes for which RegLab processed it; (2) the data - subject withdraws his consent; (3) there are no compelling reasons to continue processing after objection by the data subject; (4) there is a legal obligation for RegLab to erase the data.
• The right to restriction of processing.
• The right to object to processing.
• The right to have personal data transferred to another party, provided that the processing is based on permission or the execution of an agreement.
• The right to withdraw your consent at any time.
• The right to file a complaint with the national supervisor about the processing of your personal data by RegLab.

All rights, except the right to lodge a complaint with the supervisory authority, may be exercised through our Data Privacy Request Portal or by contacting us at info@reglab.com. Please indicate which right you wish to exercise and provide sufficient information for us to process your request. We may request additional information to verify your identity where necessary. RegLab will respond within one month of receiving your request. Where permitted by law, this period may be extended by up to two additional months if the request is particularly complex or numerous.

Data security

We take appropriate technical and organisational measures to secure personal data against loss, unauthorised access, and misuse. For additional information about data security, please visit www.reglab.com/informatiebeveiliging.

Do you have any further questions?

Feel free to contact us via info@reglab.com or visit our office.