Version: draft · last updated 14-10-2026
This policy describes what personal data Appfinnity, based in Lisse, the Netherlands, Chamber of Commerce (KVK) number 91513634, VAT number NL865678674B01 ("we") processes through Waffinnity, for what purpose, and what rights you have. We are the controller for the data described below, unless stated otherwise.
1. What data we process
Account and organization data
- Name, email address and (hashed) password of users who create an account.
- Organization name and the role linked to the account (e.g. owner, administrator).
Billing and payment data
- Company name, billing address, postal code, city, country code and VAT number that you enter yourself for invoicing.
- Payment status and a reference to your customer and direct-debit mandate with our payment provider Mollie. Payment method details themselves (such as IBAN or card details) are processed directly by Mollie and never reach our systems.
Data about your use of the service
- Technical usage data such as logged-in sessions, actions taken and timestamps, recorded in an audit log for security and accountability purposes.
- Traffic and security statistics for your protected applications (e.g. request counts and blocked attacks per application).
Data about visitors to your protected application
To deliver the security service, our gateway nodes process technical data of visitors to your protected website or application, including IP addresses and request data, for the purpose of detecting and blocking attacks. For this processing we act as a processor on your behalf as a customer; this falls under a separate data processing agreement, not under this consumer-facing privacy policy. IP addresses of detected malicious visitors may be shared with the external reputation service AbuseIPDB, see below.
2. Cookies & website analytics
We use a single functional cookie (waffinnity_session) to remember your logged-in session. This cookie is necessary to use the service and therefore does not require separate consent. We do not place tracking or advertising cookies on this website. For the public website, Waffinnity also uses first-party, cookieless analytics to understand website usage. This analytics layer records limited technical information such as the requested page, time period, broad device/browser type, referrer host and country code. Raw IP addresses, complete user-agent strings, query strings and persistent visitor identifiers are not stored for this website analytics layer.
3. Purposes and legal basis
- Performance of the agreement: account management, delivering the security service, billing and customer support.
- Legitimate interest: securing our service and infrastructure, including audit logging and fraud/abuse detection.
- Legal obligation: complying with statutory retention obligations for invoices.
4. Sharing with third parties
We only share data with parties that need it to deliver the service:
- Mollie (payment provider) — for processing payments and direct debits.
- AbuseIPDB — an IP reputation database we use to recognize known malicious IP addresses and, for abuse we detect ourselves, report them. AbuseIPDB is based outside the EEA (United States); only technical data about attack traffic is shared, no account data.
- Klikonline B.V. — for hosting the platform and gateway infrastructure.
- Klikonline B.V. — for sending transactional emails (invitations, notifications, invoices).
We do not sell personal data to third parties and do not use your data for advertising purposes.
5. Retention period
We do not retain data longer than necessary for the purposes above. Website analytics detail is retained for a maximum of 90 days. Account data is retained for as long as you have an active subscription, and for 30 days afterwards unless you request deletion sooner. Invoice data is retained in accordance with the statutory tax retention obligation (typically 7 years in the Netherlands).
6. Security
We take appropriate technical and organizational measures to protect your data, including encrypted connections (TLS/HTTPS), hashed passwords, protection against cross-site request forgery, and encrypted storage of sensitive configuration data such as TLS certificate keys.
7. Your rights
You have the right to access, correct and delete your personal data, the right to restrict and object to processing, and the right to data portability. Contact us at hallo@appfinnity.eu. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
8. Changes
We may amend this privacy policy. The date at the top of this page indicates when the text was last changed.
9. Contact
Questions about this privacy policy or about how we handle your data can be sent to hallo@appfinnity.eu.