Datenschutzerklärung

This is the Privacy Policy of Bas Software B.V. This policy explains how we deal with personal information that is obtained via our website, through solicitation procedures of Bas Software and when personal data is processed by us on behalf of our clients. We respect the privacy of our users and business relations and ensure that any personal information that we process will be protected and treated confidentially.

Last updated: 25 September 2026.

This Privacy Policy may be modified by us. The most current version of this Privacy Policy can always be found on this website. It is recommended that you consult this Privacy Policy regularly so that you are aware of these changes.

As a software supplier we process personal data. This includes including personal data of:

• (a) applicants or other persons seeking a job or a traineeship at Bas Software (hereinafter: 'Applicants');
• (b) persons who are clients of Bas Software or who are employed by our clients (hereinafter: "Clients");
• (c) visitors to our website (hereinafter: "Website Visitors");
• (d) people who sign up for a free trial through a form on Facebook or Instagram (hereinafter: "Trial Sign-ups").

Applicants

We process the following personal data about applicants:

• (a) Contact details (such as name, telephone numbers and e-mail addresses), date of birth, place of birth, nationality and gender;
• (b) Education, courses and traineeships followed;
• (c) Data relating to the nature and content of the current employment and any termination thereof;
• (d) other information which may be relevant to the performance of the duties for which the application has been made, such as information contained in a CV or letter of application, references or results of a competency test;
• (e) where applicable: bank details (bank account number and name of account holder);
• (f) Other information the processing of which is required by or necessary for the application of laws or regulations.

The overview below shows for which purposes and on what legal basis we process Candidates' personal data:

Purpose

Legal Ground

a)

establishing the identity of the applicant and being able to make contact in connection with the application procedure

• Performance of the contract

b), c) and

d)

The assessment of the applicant's suitability for a vacant post and internal security.

• Performance of the contract
• Legal obligation Legitimate interest

e)

Reimbursement of any travel expenses incurred

• Performance of the contract
• Consent

f)

The implementation or application of laws or regulations

• Legal obligation
• Legitimate interest

Personal data collected for the application procedure will never be shared with our partners or any other third party without prior consent from the data subject.

Clients and their employees

We process the following personal data of Clients and their employees:

• a) Contact details (such as name and address details, telephone numbers and e-mail addresses), date of birth, gender and, where applicable, proof of identity;
• b) Data for the purpose of calculating and recording fees and expenses, making payments and collecting claims, such as bank and salary data;
• d) Other data the processing of which is required pursuant to or necessary for the application of laws or regulations.

The overview below shows for what purposes and on what legal basis we process Clients' personal data:

Purpose

Legal Ground

a)

To establish the identity of the Client and to communicate for the purpose of providing services to the Client

• Performance of the contract

b)

making payments and collecting claims, calculating or recording fees or benefits

• Performance of the contract
• Legal obligation
• Legitimate interest

Website Visitors

When you send us an email through the website or subscribe to our newsletter, we will receive your name, phone number and email address. We use this information in order to provide our services, send you information regarding our services and respond to your requests. We may also use this information to send you emails that directly promote our services.

The data will be retained for a maximum period of 3 months.

Sign-ups through Facebook or Instagram (free trial)

When you sign up for a free trial through a form in one of our advertisements on Facebook or Instagram, we receive the name, email address, telephone number and company name you enter in that form, and which advertisement and platform the sign-up came from.

We use this information to contact you within 24 hours, to set up a trial environment of Bas and switch it on together with you, and to follow up on your sign-up. We also use it to measure which advertisements bring in suitable sign-ups.

You ask for this yourself, so we process the information to respond to your request before any agreement is made (Article 6(1)(b) GDPR). Measuring our advertisements is based on our legitimate interest (Article 6(1)(f) GDPR).

The information passes through these parties and systems:

• Meta Platforms Ireland Limited, because the form is on Facebook or Instagram;
• HubSpot, Inc., our CRM;
• Slack Technologies, LLC, for an internal notification to our sales team;
• n8n, our own automation, which passes the sign-up on.

If you do not become a client, we delete your information within 3 months of your sign-up.

In the future we may tell Meta which sign-ups were a suitable company, so that our advertisements reach the right companies. If we do, this will happen through Meta's Conversions API, with the information in hashed form: converted into a code from which it cannot be read back directly, although Meta can compare it with the hashed details it already holds. We do not do this yet, and we will update this Privacy Policy before we start.

You can ask us to inspect, correct or delete your information, and you can object to its use, at any time via [email protected]. See also "Rights of data subjects" below.

Access to Sensitive Information:

Our services use Google APIs and require certain permissions that may access sensitive user information. These permissions are crucial to provide the functionalities of our services.

Purpose and Use of Data:

The information accessed through Google's permissions is strictly used for the intended functionality of our services and is not used for any unrelated purposes.

Consent:

We only access sensitive information after obtaining explicit user consent, ensuring users have control over their data.

Retention of Information:

The sensitive data accessed through Google's permissions is retained only as long as necessary to provide the requested services to our users.

User Rights:

Users have the right to access, amend, and delete their data, and can withdraw consent at any time by contacting us.

Policy Updates:

We will update our policy and notify users if there are any changes in the way we access or use sensitive information through Google's permissions.

We will only share your personal data with third parties if this is necessary for the provision of the aforementioned services. Furthermore, we may provide personal data if there is a legal obligation to do so.

In order to process the data we use the following third parties:

• Hetzner Online GmbH (hosting)
• Cloudflare, Inc. (hosting and security of this website)
• HubSpot, Inc. (CRM, forms, email and the cookie banner)
• Slack Technologies, LLC (internal notifications to our sales team)
• Google Ireland Limited (Google Analytics and Google Ads)
• PostHog, Inc. (website statistics and session replay)
• Meta Platforms Ireland Limited and LinkedIn Ireland Unlimited Company (advertising)
• Intercom, Inc.
• LeadInfo B.V.

Sometimes we have to transfer personal data to a country outside the European Economic Area (EEA). If such a situation arises and your personal data is transferred to a country which provides a lower level of protection for your personal data than countries within the EEA, we will put in place appropriate safeguards to protect your personal data, such as the conclusion of a model contract with the recipient of the personal data approved by the European Commission.

When processing personal data, we maintain at all times a level of security which, given the state of the art and the cost of implementation, is appropriate, among other things, to prevent unauthorised access, modification, disclosure, loss or any other form of unlawful processing of personal data.

You have the right to request us to inspect (including a copy), rectify and/or delete your personal data, restrict the processing in question, as well as the right to object to the processing or to request the transfer of the personal data you have provided to us. You can contact us for this via [email protected]

In order to prevent misuse, we may ask you to identify yourself adequately before we process your request. Circumstances may arise as a result of which we cannot, or cannot fully, comply with your request. Examples are statutory retention periods. If such a circumstance arise, we will report it to you. In principle, we will respond to your request within one month of receipt.

We will retain your personal information no longer than is necessary for the purposes for which they are processed, unless the data should be kept longer to comply with legal obligations.

Our website uses cookies and comparable techniques. On your first visit the cookie banner asks you to make a choice per category. You can withdraw that choice at any time by deleting the cookies in your browser, after which the banner asks again.

• Necessary: the consent banner of HubSpot, Inc., which records the choice you make. These are always active.
• Statistics: PostHog, Inc. (European hosting), which also records the pages you visit on this website as a session replay. It is loaded only after you consent to statistics. Google Analytics 4 and the Google Ads tag (Google Ireland Limited) are loaded in any case, but Google Consent Mode v2 keeps their storage denied until you consent: without that consent they place no cookies and store nothing on your device.
• Marketing: the Meta pixel (Meta Platforms Ireland Limited) and the LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company), which measure our campaigns and build advertising audiences. These load only after you consent to marketing.
• Functional: the forms and visitor tracking of HubSpot, Inc., and the chat of Intercom, Inc., which loads when you start to use it.

In addition we use Umami, which we host on our own servers. Umami counts page views without cookies and without storing anything in your browser. From the web address it keeps only the campaign labels, so nothing personal that a link may carry ends up in the count, and it derives a visit number from your IP address and browser which it does not store. This is why it needs no consent: it tells us how many people read a page, not who they are.

For business visitors we use LeadInfo B.V., which recognises the company behind a visit from the IP address. This is company information; we do not use it to identify you as a person.

This Privacy Policy does not apply to third party websites connected with this website by hyperlinks. For the terms of use and privacy policies of those websites, please refer to the website in question. Bas Software is not responsible or liable for the way in which these third parties handle your personal data.

Application Privacy Statement

This Privacy Policy applies to the Bas medewerker app mobile application provided by Bas Software B.V. It outlines our commitments and practices concerning the collection, use, and sharing of personal and sensitive user data through the Bas medewerker app application.

Information We Collect Through Bas medewerker app

When you use Bas medewerker app, we may collect the following types of information:

– Personal Information: Your name, email address, contact details, and other identifiers when you register for an account or contact us for support.

– Location Data: We collect precise or approximate location data from your device if location services are enabled. This is necessary for automatically tracking of the hours.

– Usage Data: Information on how you interact with the app, including access times, device information, and app features used.

How We Use Your Information

The information collected through Bas medewerker app is used for the following purposes:

– To provide, maintain, and improve the app's functionalities.

– To respond to your inquiries and fulfill your requests.

– To send important information regarding the app, changes to our terms, conditions, and policies, and/or other administrative information.

– For our business purposes, such as data analysis, audits, fraud monitoring, and prevention.

Sharing Your Information

We do not sell, rent, or lease your personal information. We share your information only in the following circumstances:

– With service providers that perform services on our behalf, such as web hosting, data analysis, customer service, and marketing support. These service providers are authorized to use your personal information only as necessary to provide these services to us.

– As required by law, such as to comply with a subpoena or similar legal process.

Our app uses the following Google permissions and APIs that may access sensitive user information:

• Location Permission (ACCESS_FINE_LOCATION): Our app uses this permission to log working hours automatically, by registering the time spent at a work location. This spares our users manual entry and keeps the hour registration accurate.

– Camera Permission (CAMERA): We require access to your device's camera to enable the uploading of receipts for declarations. This functionality allows you to easily capture and submit expense reports directly through the app, facilitating quick reimbursement processes and record-keeping.

We request these permissions only in context and with your explicit consent, and we use the data solely for the purpose for which you have given permission.

Data Retention and Consent

We retain your personal information for as long as your account is active or as needed to provide you services. We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

We obtain your consent before collecting sensitive information, and you may withdraw your consent at any time by contacting us at [email protected].

User Rights

You have the right to access, correct, or delete your personal data managed by Bas medewerker app. You may exercise these rights by contacting us directly. We will respond to your request within a reasonable timeframe.

Security Measures

We take reasonable measures to protect your personal information from unauthorized access, use, alteration, and destruction. We implement security safeguards designed to protect your data, such as HTTPS. We also regularly monitor our systems for possible vulnerabilities and attacks.

Policy Updates

We may update this privacy policy to reflect changes to our information practices. If we make any material changes, we will notify you by email (sent to the e-mail address specified in your account) or by means of a notice in the Bas medewerker app app prior to the change becoming effective.

If you have any questions or remarks, please contact us via: [email protected].

‍