Data Protection and Security Policy
Smartest AI Sales | AI Netherlands
Version 3.24 | 25 October 2026
This policy describes the security baseline for our website, managed WhatsApp and AI appointment service and customer portal. Together with the DPA and completed Project Register, it forms the agreed baseline for project personal data; commercial arrangements and legally valid liability limits follow the accepted order and Terms.
1 Responsibility and management
Smartest AI Sales is a trading name of Oktay Akgül, trading as AI Netherlands, Chamber of Commerce 96434392, S.L. Louwesstraat 96, 7545 EX Enschede, Netherlands. Security/privacy contact: he***@***************es.com; +31 6 40865882.
We manage the agreed platform and platform services we order. The customer manages its staff, devices, WhatsApp account and directly used CRM systems, access and licences unless a specific management task is assigned to us; our own statutory security duties remain.
2 Hosting and data locations
The platform provider states primary hosting on dedicated servers in Germany and storage of files/backups in the EU. Necessary AI processing, messaging or external support may occur elsewhere; the Project and Provider Registers identify actual parties, countries and lawful transfer safeguards.
An EU server or establishment does not mean all processing remains in the EEA. International transfers require the applicable basis and safeguards, such as valid standard contractual clauses or an adequacy decision covering the recipient.
3 Technical and organisational baseline
| Area | Baseline |
|---|---|
| Connections | TLS 1.2 or higher on supported browser, platform and API connections; external-channel protection also depends on the relevant service. |
| Passwords and secrets | Passwords are hashed; stored integration tokens, login secrets and backups are encrypted. This is not a blanket statement that every database field or chat is end-to-end encrypted. |
| Access and separation | Task-based roles, limited administration, separated customer environments and confidentiality for authorised people/providers. Access is changed or revoked when no longer needed. |
| Integrations | Authorised accounts/destinations and necessary fields only; appropriate authentication, limited permissions and agreed integration tests. Tokens are kept out of ordinary chats and public logs. |
| Maintenance and monitoring | Risk-based maintenance/updates, vulnerability assessment and relevant error/access/abuse signals. Not every incident is promised to be detected immediately. |
| Continuity | Automated encrypted platform backups and appropriate recovery procedures; the applicable cycle is recorded in the Project Register. A fixed recovery time or maximum data loss applies only if separately agreed. |
Supported authentication and role controls are used as appropriate to risk. Formal certification, a penetration-test frequency or special availability guarantee is promised only if demonstrably in place and agreed in writing.
4 AI and campaign conversations
Only conversations with leads from your supplied list contacted through the broadcast appear on the platform; your sales team can take them over. Other WhatsApp chats and existing chat history are not imported. This restriction is part of the configured assignment and is checked before go-live.
A staff member may take over a chat, pausing AI for that conversation; AI is resumed manually. Appointment automation follows the customer’s recorded selection of Google Meet, telephone callback or both. AI receives only information/actions needed for the approved assignment; website content, a message or an AI output does not independently expand access rights. Connection tokens remain separate from AI knowledge and ordinary chats.
Identifiable or merely pseudonymised customer data is not used for general model training, and AI providers may not use it for their own training. Only truly anonymous, non-confidential examples may be used for improvement under DPA 8 and Privacy Policy 6.
5 Retention backups and end of service
Project data is kept only as needed under the instruction and Privacy Policy; conversations by default no later than twelve months after the last relevant interaction, earlier if purpose ends or valid deletion instructions apply. Our own website/account logs are normally retained up to 90 days, technical platform/security logs where necessary up to twelve months; incident evidence is assessed separately.
The customer may request data for handover during service and for 30 calendar days after termination. After that retrieval period, active processor copies are deleted within 30 days and remaining backups within 90 days; a shorter valid instruction or necessary statutory retention may prevail.
Backups are not ordinary working databases or material for new campaigns. Deletion and suppression instructions are reapplied after restoration. Integration or synchronisation is not a separate backup of the customer's own CRM.
6 Incidents and notification
We investigate reported/detected incidents, limit effects and retain proportionate investigation material. Project personal-data breaches are reported to the customer without undue delay after awareness, initially within 24 hours where reasonably possible; available information is supplemented progressively.
The customer makes notifications for which it is responsible; we provide required assistance and meet our own duties. Incident notice is not itself admission of liability and is not conditional on invoice payment.
7 Cooperation review and privacy controls
Necessary providers have appropriate data-protection arrangements and their actual chain is recorded under the DPA. The customer safeguards its own access, removes departing team members and promptly reports abuse, lost devices or suspected unauthorised access.
Security questions and reviews follow the contact and DPA audit procedure, protecting other customers and security secrets. Equivalent or better measures may be introduced without approval for each routine change; material reductions, purpose changes or changed recipients follow the DPA and law.
On the public website, the 14 formerly unclassified storage items identified in Cookie Policy 4 are optional and require prior consent for their category. They must not be stored or read before that choice, after refusal or for further optional collection/use after withdrawal; if selective control is unavailable, the responsible script is withheld and an appropriate alternative for an affected requested function is provided.
This policy gives no absolute security guarantee and does not change prices, invoice dates or legally valid liability limits. Mandatory security, privacy and assistance duties remain effective.