Privacy Policy
Smartest AI Sales | AI Netherlands
Version 3.24 | 25 October 2026
This policy explains personal-data processing for our websites, enquiries, requested demonstrations, business accounts and AI communication and appointment service. Customer leads are used for the agreed service, not our own marketing. Only truly anonymous, non-confidential examples may be used for AI training under section 6.
1 Who we are
We are Oktay Akgül, trading as the sole proprietorship AI Netherlands, also under the trading name Smartest AI Sales, Chamber of Commerce 96434392, S.L. Louwesstraat 96, 7545 EX Enschede, Netherlands. Privacy and service contact: he***@***************es.com; +31 6 40865882. This policy applies where our services refer to it, including smartest-ai-sales.com, app.smartest-ai-sales.com and app.ai-sales.nl. A contact is called a data protection officer only if one has actually been appointed and announced.
2 Roles
We are the controller for our own business relationships, requested demos, account administration, invoicing, security and legally permitted own marketing because we determine those purposes and means.
For a customer campaign, the commissioning business is the controller and we act as processor under the DPA and documented order: communicating on its behalf, qualifying interest, booking the appointment types selected in its Project Order (Google Meet, telephone callback or both) and recording outcomes. The customer retains its rights in its list. If the customer itself is a processor, the underlying controller must authorise the assignment. Actual activities determine legal roles.
The business identified in a campaign message is normally the contact for its purpose, lead source and authority to contact recipients. Contact us if you cannot identify it or need assistance; we forward relevant requests and provide appropriate help. Our processor role does not remove our own statutory duties. Business terms and indemnities do not make message recipients parties to the customer contract.
3 Information processed
Account and relationship data includes name, business contact details, role, company, account/user information, language and protected authentication details, service choices, support correspondence, orders, versions and acceptance records. We receive it from the representative, their organisation or an authorised contact. Contract administration may include a payment reference, date, electronic acceptance and approved configuration; these are not evidence of a lead's consent.
Campaign data may include name, telephone or messaging identifier, email, relevant customer or enquiry context, messages and necessary attachments (text, images, voice and video), necessary transcripts and summaries, knowledge-base and configuration data, qualification answers, appointments, status, tags, tasks and sales stages. It comes from the customer, recipient and campaign-authorised systems, limited to what is needed. Only conversations with leads from your supplied list contacted through the broadcast appear on the platform; your sales team can take them over. Other WhatsApp chats and existing chat history are not imported.
Evidence records include necessary source references, consent text, date and affirmative action, sender and channel, withdrawals, opt-outs and actions taken. The customer retains the underlying evidence; a separate CRM-evidence-reference field or routine upload for every lead is not required. For complaints, we request only proportionate evidence needed to assess the issue.
Technical data includes IP address, browser/device information, page/function use, times, errors, access/security events and necessary integration logs. The dashboard records service settings such as selected appointment types, sending windows, AI-response times and human takeover. Billing records ordered numbers, service periods, outcome categories, booking/registration times and references preventing duplicate charges; this alone does not justify retaining entire conversations.
Payment providers process payment instruments under their applicable arrangements. We do not ask for full card details or payment codes in AI chats. Login and integration secrets do not belong in ordinary messages or public logs. Approved connection tokens are access-restricted and encrypted; passwords are hashed rather than stored as readable text.
A requested demo may use business information you supply and relevant permitted public website information. Public availability does not permit every personal-data use. When collecting indirectly for our own purpose, we provide required information within the applicable period, normally at first communication, first disclosure or within one month, whichever applies first, subject to a legal exception.
4 Purposes and lawful bases
For our controller processing, we use the lawful basis appropriate to each purpose. Contract necessity applies where the individual is a party or requests necessary pre-contractual steps. For an employee representing a business, our legitimate interest in a normal business relationship may apply following a balancing assessment.
| Activity | Purpose and basis for our own processing |
|---|---|
| Enquiry and requested demo | Responding and providing the requested demonstration; necessary pre-contractual steps or legitimate business interest. |
| Account and support | Delivering/administering the service; contract where applicable, otherwise legitimate interest in business administration. |
| Invoicing and bookkeeping | Charging and retaining mandatory records; contract, legal obligation and appropriate administrative interest. |
| Security and abuse prevention | Protecting users and the service; legitimate interests and applicable legal duties, with separate device-storage consent where required. |
| Own marketing | Only our own lawfully obtained business contacts; consent where required or another assessed lawful basis where privacy and channel rules permit it. |
| Legal obligations and claims | Limited information for mandatory disclosure or legal rights; legal obligation and appropriate legitimate interests, with additional conditions for sensitive data. |
For legitimate interests, we assess necessity, reasonable expectations and effects on individuals. You may request information and object. The customer separately determines the campaign basis and contact permissions. A DPA, invoice payment, Terms acceptance or cookie choice is not general privacy consent or permission for WhatsApp marketing.
5 AI communications and your choices
A campaign may follow an earlier relationship only where that specific communication is permitted. An old lead, purchased number or previous email consent does not automatically permit WhatsApp contact. The actual commissioning business, AI nature where required, relevant privacy information and simple opt-out must be recognisable.
Opt out through the offered method, an answer such as STOP where replies are possible, a clear ordinary-language objection or contact with the identified sender. Following an effective objection, the relevant marketing and related profiling stop. Necessary suppression is recorded in agreed systems, with a minimal reference where needed to prevent recontact. Separately lawful necessary administrative messages may continue; an opt-out is not used for a new campaign.
Within the assignment, AI generates replies and summaries, assesses interest against customer criteria and performs approved booking and CRM actions. Necessary information may go to approved AI and messaging providers. Answers and scores can be incorrect. You may request explanation, correction or a person. An authorised customer employee can take over through Chats, pausing AI for that contact under the configured operation; AI is resumed manually.
The dashboard may display pipeline, tasks, appointments and activity reports. Daily AI summaries and 7/30/90-day reviews can contain personal data; a summary is not automatically anonymous. The standard service does not make solely automated decisions producing legal or similarly significant effects. Different use requires a separate lawful design, assessment and information.
6 Truly anonymous examples for model training
Personal or merely pseudonymised leads, conversations, embeddings and contact-linked outcomes are not used for model training. AI providers receiving them to deliver the service may not use them for their own training. Provider-specific security and retention terms are assessed in the Provider Register.
Lawfully prepared, truly anonymous, non-confidential examples may be used to train, fine-tune and evaluate our AI sales and appointment service, including improvements benefiting other customers. They must not be used to contact people, reconstruct lead lists, target advertising or sell data.
Preparation through anonymisation remains regulated while the source is personal data. Before preparation, purpose, instruction, role, lawful basis, information and any further consent or condition are recorded. If we determine an independent purpose, we meet the corresponding controller duties before processing. Customer acceptance is not individuals' consent; preparation does not begin unless the conditions are met.
Anonymisation must sufficiently address direct/indirect identification, free text, linking and extraction from outputs. Removing names, hashing or reversible coding alone is insufficient. Reidentification is prohibited. Only the truly anonymous result may remain after the assignment for this purpose; personal sources remain subject to normal return/deletion. If anonymity is lost, further training use stops and appropriate remedies follow.
7 Recipients and international processing
Access is limited to authorised people and providers needing data for permitted tasks and bound by appropriate arrangements. They may include the platform/hosting chain, authentication/infrastructure, AI and messaging providers, approved CRM/calendar services, payment/administration providers and professional advisers. Their actual role differs by service and activity.
For the customer platform, the provider states primary hosting on dedicated servers in Germany and file/backup storage within the EU. This does not automatically cover AI processing, messaging or external support, which may involve other countries. The Project Register identifies actual legal entities, tasks, locations and safeguards. App components can include Google/Firebase and Cloudflare according to enabled functions.
The public website includes Consently for privacy choices, Google Analytics through Site Kit for permitted usage measurement, MultiLipi for translation and CleanTalk and Google reCAPTCHA for form/abuse protection. Depending on activation, they may receive IP, browser/device, page/interaction information, preferences and necessary form data. Local and session storage may be used. The 14 previously unclassified items specifically listed in Cookie Policy 4 are treated as optional: they require prior consent for their category, must remain disabled when refused and must stop further optional collection/use after withdrawal. Script presence does not itself prove advertising tracking or lawful activation.
For campaigns, the designated customer team and authorised booking/CRM destinations receive necessary outcomes. A directly customer-chosen provider may have its own contract and role. Agency integrations remain customer-separated. We do not sell, rent or exchange customer leads or use them for our own advertising, other customers or unrelated analysis. Statutory disclosure and business transfers are limited to lawful necessity, with appropriate protection and purpose limits.
Our business is based in the Netherlands. Actual hosting, storage and access locations are recorded per service. Support, AI or messaging outside the EEA may involve an international transfer, permitted only with a valid basis and necessary safeguards, such as applicable standard contractual clauses or an adequacy decision covering the recipient. DPF certification is verified for the legal entity and processing; an EU address/server option does not prove exclusively European processing. Applicable UK and Swiss rules are addressed separately. You may request information and an appropriate safeguards copy, protecting security and others' rights where needed.
8 Retention and deletion
We retain information only as needed for its recorded purpose, a legal duty or proportionate legal claim. A shorter lawful instruction, project arrangement or mandatory period can prevail. Separate necessary evidence retention does not extend the entire campaign history.
| Data | Default period and limit |
|---|---|
| Enquiry/demo not proceeding | Up to 90 days after the last substantive contact, unless an active discussion or another recorded need continues. |
| Business relationship and ordinary support | During the relationship and up to two years afterwards; necessary legal/claim records can remain longer on a limited basis. |
| Campaign data and conversations | Only for the assignment/instruction; by default no later than twelve months after the last relevant interaction, earlier when purpose ends or a valid instruction requires; end-of-service rules also apply. |
| Account and security logs | Our own website/account logs normally up to 90 days; technical platform/security logs where necessary up to twelve months. Specific incident evidence is separately retained as demonstrably needed; shorter suitable settings may apply. |
| Invoices and Dutch bookkeeping | Normally seven years from the end of their current administrative relevance, subject to actual statutory exceptions. |
| Contact and consent evidence | Only necessary accountability evidence; for Dutch electronic marketing normally up to five years after the relevant sending. |
| Suppression reference | Minimal identifier/context while a real risk of unwanted recontact remains, periodically reviewed. |
| Processor copies after service | Request return/deletion during service and up to 30 days after termination. After that retrieval period, active copies are deleted within 30 days and remaining backups within 90 days, subject to mandatory rights, earlier valid instructions and necessary limited retention. |
Residual backup copies awaiting expiry are unavailable for ordinary use. Valid deletions and opt-outs are reapplied after necessary recovery. Disconnection does not delete data already in the customer's CRM. An unpaid invoice does not justify indefinite conversation storage or continued marketing.
9 Rights and complaints
Where applicable, you may request access, a copy, correction, erasure, restriction, portability, source/recipient information and objection. You may withdraw consent for future consent-based processing. Direct-marketing objection includes associated profiling. We seek only proportionate identity verification, not routinely a complete identity document.
Send requests to he***@***************es.com. For customer-controlled campaigns, we help identify the business and provide assistance; for our own processing, we assess the request ourselves. Under GDPR, we respond without undue delay, normally within one month. A permitted extension, refusal or fee is explained in time with reasons. You need not be a customer or accept our Terms to exercise rights.
You may complain directly to the Dutch Data Protection Authority at www.autoriteitpersoonsgegevens.nl or another competent authority, without first complaining to us. This policy does not limit statutory remedies.
10 Additional information outside the EEA
US federal and state laws apply according to their own scope, roles and thresholds; business data is not exempt everywhere. Where required, the categories, sources, purposes, recipients and retention above provide the relevant processing information. Customer campaigns follow the DPA's limited service-provider/processor arrangements: no sale, cross-context behavioural advertising sharing or unrelated combination of personal customer data.
Applicable rights may include access, correction, deletion, portability and opting out of sale, sharing, targeted advertising or certain profiling. Covered requests are normally handled within 45 days, with only permitted extensions and shorter applicable opt-out periods. Where required, valid universal opt-out signals such as Global Privacy Control are recognised for the covered activity; a signal never grants consent for other tracking.
Where appeal rights apply, request reconsideration at he***@***************es.com with subject privacy appeal. We respond within the applicable period and explain further complaint routes. Any legally required extra web or telephone route must exist before the activity requiring it. Exercising rights does not result in unlawful discrimination.
Before extending to other countries, we assess additional requirements, including local information, representation, language and request channels where needed. Accounts are for adult business users. Standard campaigns do not knowingly target children or sensitive groups without separately lawful arrangements.
11 Security cookies and changes
Risk-appropriate measures include role-based access, customer separation, TLS 1.2 or higher on supported platform connections, hashed passwords, encrypted connection tokens/backups and appropriate incident response. Data Protection and Security Policy 3.24 and the Project Register describe the baseline and management allocation. We do not present unverified certification or exclusively European processing as established fact.
Cookie Policy 3.24 covers website cookies, local storage and similar technologies; portal storage is separately explained where functions differ. Required consent precedes optional tracking/storage and can be withdrawn easily; the 14 specified formerly unclassified items remain subject to that choice regardless of any vendor's security label. A server API or webhook is not itself a cookie, but transferred personal data remains protected. Terms, CRM integration or cookie acceptance does not authorise WhatsApp marketing.
We update this policy for relevant changes and identify the version; material changes are appropriately announced. A text change does not legalise earlier unlawful processing or replace a required new choice. Questions: he***@***************es.com or the address in section 1.