Skip to content
ALETTA

Legal

Privacy Policy

How personal data is processed on the ALETTA website, and the rights you have under the General Data Protection Regulation (GDPR).

Last updated: 30 September 2026

This Privacy Policy applies to the website at aletta.ai and its subdomains (the “Website”). The ALETTA App will be accompanied by its own privacy notice when it is released.

1. Controller

The controller responsible for the processing of personal data through the Website is Ernexo Holding B.V., Amsterdam, Netherlands (“we”, “us”). Questions about this policy or requests to exercise your rights can be submitted via the contact page.

2. Principles we follow

We process personal data lawfully, fairly and transparently; only for specified purposes; limited to what is necessary; kept accurate; stored no longer than needed; and protected with appropriate security (Article 5 GDPR). We apply privacy by design and by default (Article 25 GDPR).

3. Personal data we process

  • Technical data: IP address, browser type, device information, requested pages, date and time of access, and error logs generated when you visit the Website.
  • Contact data: when you send a message via the contact form — your name, organisation (optional), email address, subject and message content.
  • Preference data: strictly necessary settings stored in your browser, as described in the Cookie Policy.

The Website does not collect personal wellbeing or health records, does not use advertising trackers and does not sell personal data. Please do not send health or other special category data through the contact form.

4. Purposes and legal bases

  • Operating and securing the Website (hosting, preventing abuse, diagnosing errors) — legitimate interest, Article 6(1)(f) GDPR.
  • Responding to your enquiries — steps prior to a contract or legitimate interest, Article 6(1)(b) and (f) GDPR.
  • Optional analytics or cookies, if ever introduced — only with your consent, Article 6(1)(a) GDPR, which you may withdraw at any time.
  • Complying with legal obligations (for example tax or record-keeping duties, or requests from authorities) — Article 6(1)(c) GDPR.

We do not use automated decision-making or profiling with legal or similar effects.

5. Retention

  • Server and security logs: normally up to 90 days, unless needed to investigate an incident.
  • Contact messages: up to 24 months after the enquiry is closed, unless a longer period is required by law or for an ongoing relationship.
  • Records subject to statutory retention (e.g. Dutch tax law): for the legally required period, typically 7 years.

6. Recipients and processors

We share personal data only where necessary with carefully selected service providers acting as processors, such as hosting, content delivery and email delivery providers. They process data only on our documented instructions under a data processing agreement (Article 28 GDPR). We may also disclose data where required by law or to protect our rights.

7. International transfers

We aim to process data within the European Economic Area. Where a provider processes data outside the EEA, we ensure an adequate level of protection, for example through an adequacy decision (including the EU-US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses with supplementary measures where needed.

8. Information security

Our security approach is aligned with the ISO/IEC 27001 information security framework. Measures include:

  • Encryption of data in transit (TLS/HTTPS) and, where applicable, at rest.
  • Role-based access control and the principle of least privilege.
  • Multi-factor authentication for administrative access.
  • Supplier assessment and data processing agreements with processors.
  • Logging, monitoring and vulnerability management.
  • Backup and business continuity arrangements.
  • Confidentiality obligations and security awareness for staff.
  • A documented incident response process.

9. Personal data breaches

If a personal data breach occurs, we assess and contain it promptly, notify the Autoriteit Persoonsgegevens within 72 hours where required (Article 33 GDPR), and inform affected individuals without undue delay where the breach is likely to result in a high risk to them (Article 34 GDPR).

10. Your rights

Under the GDPR you have the right to:

  • access your personal data (Article 15);
  • rectification of inaccurate data (Article 16);
  • erasure (Article 17);
  • restriction of processing (Article 18);
  • data portability (Article 20);
  • object to processing based on legitimate interest (Article 21);
  • withdraw consent at any time, without affecting prior processing.

We respond within one month, extendable by two months for complex requests. We may ask you to verify your identity. You also have the right to lodge a complaint with a supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

11. Children

The Website is not directed at children under 16, and we do not knowingly collect their personal data.

12. External links

The Website may link to third-party websites. We are not responsible for their privacy practices; please review their policies.

13. Changes to this policy

We may update this policy to reflect legal, technical or organisational changes. The “Last updated” date shows the current version.