Privacy notice

1. Who processes your data?

Pith Media provides the Pith Media website assistent. For its own account, contact, security and subscription administration, Pith Media is the data controller.

Name and address

Pith Media
Philipsstraat 5A, 3833 LC Leusden

Chamber of Commerce registration number

57713723

Privacy contact

info@pithmedia.nl

For personal data in website content or requests that we process solely on behalf of a business customer, that customer is usually the controller and we are the processor. Separate data processing arrangements are required for this; this notice does not replace a data processing agreement.

2. What data do we receive?

• Account and contact: name, company name, email address, hashed password, email verification, preferred language, plan selection and information provided in a support request.
• Trial: prepared trial application, selected follow-on subscription, consent and verification timestamps, applicable document version, start and end dates, payment mandate reference and cancellation status. This data is needed to manage the trial and the agreed automatic transition, and to provide evidence of the agreement.
• Administration: billing address, subscription arrangements, amounts, payment statuses and Mollie references. You enter bank and card details at Mollie; this application does not store them.
• Connection: website address, connection status and expressly authorised WhatsApp numbers, labels and authorisation times. A billing phone number does not grant access.
• Technical data: IP address, browser and session data, timestamps and necessary error and security information. Data comes from you, your employer or client, or is generated during use.

Once the content connection is activated, we also process WhatsApp messages, photos, selected page and product information, writing style preferences, proposals, confirmations and publication data. That connection is not yet active here. Use only test data during development.

Only share necessary data. Do not send a WordPress password, identity document, special categories of personal data or unnecessary data about other people.

3. Purposes and legal bases

• Account, order and service provision: performing the agreement or taking steps before entering into it, to the extent that you are a party to the agreement yourself.
• Business contacts and support requests: our legitimate interest in maintaining contact, handling requests and serving the business customer, balanced against your privacy interests.
• Payment and administration: performing the agreement and meeting our statutory tax record-keeping obligations, to the extent that the data is necessary for those purposes.
• Access control, security and disputes: our legitimate interest in preventing misuse, protecting the service and providing evidence of agreements. Data and access remain limited to what is necessary for those purposes.
• Website content on behalf of customers: processing in accordance with the instructions and data processing arrangements. The customer must have a valid legal basis for the personal data they ask us to process.

Authorising a WhatsApp number is an access setting, not general consent under the GDPR. If processing does rely on GDPR consent, you can withdraw it; earlier lawful processing remains lawful. Necessary account and billing data is required to handle your account or order.

4. Recipients and processing outside Europe

We do not sell personal data. Only authorised people and necessary service providers may receive data. Appropriate data processing arrangements are required for processing on our behalf.

• Hosting and email provide storage and account messages. The production providers and locations still need to be confirmed. Local account emails are currently recorded in the application log.
• Mollie processes payments and may itself act as a data controller for its own statutory obligations. The specific allocation of roles and privacy information will be confirmed before paid services begin.
• After activation, WhatsApp/Meta and the content service process messages and photos for communication. OpenAI receives relevant request, conversation and website text, and drafts, to prepare proposals. Publication always requires customer confirmation.
• A secure read-only export to Pith Media’s local CRM has been prepared for customer, website, authorisation, subscription and payment status data. Passwords, sessions and secret keys are not exported. The CRM import is not yet connected.

Suppliers may process data outside the European Economic Area. Before activation, the countries, contracting parties and valid transfer safeguards must be established, such as an adequacy decision or standard contractual clauses with the required assessment and additional measures. Processing exclusively in Europe, or no storage by AI providers, has not yet been verified and is not promised.

5. Cookies and AI

This application uses necessary session and security cookies for signing in and protecting forms. Your language choice is remembered in the session and, when signed in, in your account as well. The current session expires after 120 minutes of inactivity. No analytics or marketing trackers have been added.

AI prepares responses and content proposals. The model does not determine access rights and may not publish independently. The customer reviews the current proposal. Provider settings and retention restrictions must be checked before using real personal data.

The AI feature is not used for solely automated decisions about individuals that have legal or similarly significant effects, or for such profiling. Technical security, access and payment checks may be partly automated.

You can ask our privacy contact for information about the actual recipients and applicable transfer safeguards and, where applicable, receive a copy of those safeguards.

6. Retention periods

We may not retain data for longer than necessary. Basic tax records are generally kept for seven years from the statutory starting point; special regimes may require a different period. This does not automatically apply to all account or message data. Information from the Dutch Tax Administration.

The existing content service includes partial cleanup of message content and certain inactive conversation and proposal data after 30 days. Ongoing tasks and metadata are not fully covered by this. Under that routine, AI usage records are deleted after 13 months. Its operation in production has not yet been checked.

Published content and media remain in the customer’s WordPress installation. Archiving a plugin draft does not delete the content. Definitive retention periods implemented in the software are not yet in place for accounts, contact details, activities, logs, CRM export events and backups. There is therefore no promise that all data will disappear after 30 days or immediately after cancellation.

7. Security and incidents

The security measures developed include hashed passwords, email verification, access restrictions, explicit phone number authorisation and encryption of certain content fields in the content service. Production also requires secure hosting, HTTPS, key management, backups and checks on implementation. Complete security or availability cannot be guaranteed.

Report suspected misuse or a personal data breach to our privacy contact immediately. Incidents must be investigated and contained. Where legally required, the supervisory authority, affected individuals or the customer acting as controller will be informed. This notice does not exclude any statutory GDPR responsibility or rights to compensation.

8. Rights and complaints

To the extent that the GDPR grants these rights, you can request access, rectification, erasure, restriction or portability of data. You can object to processing based on legitimate interests and withdraw any consent. Statutory retention obligations and the rights of others may limit a request.

Email your request to our privacy contact. We may ask for necessary information to verify your identity carefully; do not send a complete copy of an identity document unless requested. In principle, you will receive a response within one month. If a permitted extension of up to two months is needed, we will inform you of the reason within the first month.

If we process data solely on behalf of a business customer, we involve that customer in handling the request. You may always lodge a complaint with the Dutch Data Protection Authority or the competent supervisory authority. Contacting us first is not a requirement. Dutch Data Protection Authority.