Privacy statement
Route AI Advisory VOF handles personal data with care. This statement explains which data we process, why, how long we keep it and what rights you have. The Dutch version is leading.
Version 1.0, 12 September 2026
1. Who we are
| Name | Route AI Advisory VOF |
|---|---|
| Address | Klapwijkse Zoom 279, 2652 BP Berkel en Rodenrijs, the Netherlands |
| Chamber of Commerce no. | 42159113 |
| VAT number | NL869974026B01 |
| info@route-ai.nl | |
| Privacy contact | rick@route-ai.nl |
We have not appointed a data protection officer, as we are not required to.
2. Whose data we process
- contacts and employees of (prospective) clients;
- participants in our training and workshops;
- visitors to route-ai.nl;
- suppliers, subcontractors and business contacts;
- job applicants.
3. Which data, for what purpose and on what legal basis
| Who | Data | Purpose | Legal basis |
|---|---|---|---|
| Client contacts | name, position, email, phone, correspondence, data from engagement files | performing the engagement, contact, invoicing | contract, legitimate interest |
| Training participants | name, position, email, attendance, questions and feedback | organising and improving training, certificate | contract, legitimate interest |
| Prospects | name, position, email, phone, company details, contact moments | quotes, business development, relationship management | legitimate interest |
| Website visitors | data you enter in the contact form; technical data such as IP address and browser type | answering your question, security and operation of the site | consent, legitimate interest |
| Suppliers and contacts | name, contact details, bank details | purchasing, payment, administration | contract, legal obligation |
| Applicants | data from letter, CV and interviews | assessing the application | legitimate interest, consent |
| Everyone | invoice and accounting data | tax retention obligation | legal obligation |
We do not process special categories of personal data and do not use automated decision-making with legal effects for you. The AI check on this site runs entirely in your browser; your answers are not sent to us unless you choose to include the result in the contact form.
4. Data we process on behalf of clients
In advisory, analysis and implementation engagements we often have access to our clients’ documents and systems. Where these contain personal data, the client is the controller and we are the processor. We process such data only on the client’s instructions and under a data processing agreement. This statement does not apply to that processing.
5. Use of AI systems
- we do not enter personal or confidential client data into AI services that use such data to train models;
- we use business services in which training on customer data is disabled and processing takes place within the European Economic Area, unless agreed otherwise with the client;
- demonstrations and exercises in training sessions use fictitious data;
- we review the output of AI systems before using it and do not make automated decisions about individuals based on it.
6. Sharing with third parties
We do not sell your data. We do use service providers who process data as part of their work, and we conclude data processing agreements with them.
| Category | Provider | Data |
|---|---|---|
| Office and email environment | Microsoft 365 (Microsoft Ireland Operations Ltd.) | email, documents, calendar, contacts |
| AI services | Microsoft Copilot, Anthropic Claude, OpenAI ChatGPT and local open-source models | content we submit to the system |
| Website, hosting and forms | Netlify | technical data, form submissions |
| Domain and DNS | TransIP B.V. | domain data |
| Accounting | in-house | invoice and accounting data |
We also share data where we are legally required to, or where this is necessary to exercise our rights.
7. Transfers outside the EEA
We prefer processing within the European Economic Area. Where data is transferred outside it, for example because a provider offers support from another country or uses servers outside the EEA, this is based on an adequacy decision of the European Commission or standard contractual clauses, with appropriate supplementary measures.
8. Retention periods
| Data | Retention |
|---|---|
| Accounts, invoices and contracts | 7 years (tax retention obligation) |
| Engagement files | 5 years after completion |
| Contact details of business contacts | for the duration of the relationship plus 2 years |
| Quotes that do not lead to an engagement | 2 years |
| Website form submissions | 12 months |
| Application data | 4 weeks after completion; with consent 1 year |
9. Security
We take appropriate technical and organisational measures, including two-factor authentication, device encryption, restricted access rights, up-to-date software and storing client data only in our business environment. If you suspect a vulnerability or data breach, please report it to contact@route-ai.nl.
10. Cookies
Our website does not place analytical or tracking cookies. Fonts are loaded from our own server, not from external services. Should we add analytical or tracking cookies later, we will ask for your consent in advance and update this statement.
11. Your rights
You have the right to access, correct or delete your data, to restrict processing, to object to processing based on legitimate interest, to data portability and to withdraw consent. You can submit a request to rick@route-ai.nl. We respond within one month and may ask you to verify your identity.
If you are not satisfied, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), autoriteitpersoonsgegevens.nl.
12. Changes
We may update this statement. The current version is always available at route-ai.nl.