1. Introduction
Patchly VOF ("Patchly", "we", "us") develops software and AI automation for business clients. This privacy policy explains which personal data we process, why we process it, how long we retain it and what rights you have. We process personal data in accordance with the General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act (Uitvoeringswet AVG).
This policy applies to:
- visitors to our website www.patchly.nl;
- people who contact us or request a quote;
- contact persons at our clients, suppliers and partners;
- people who apply for a job with us.
This policy does not apply to personal data that we process on behalf of our clients in the systems we build and manage for them. See section 3.
2. Contact details
Patchly VOF Schoorsteen 10, 1431LV Aalsmeer Dutch Chamber of Commerce number: 42054845 Email: info@patchly.nl Telephone: +31 85 115 0845
Patchly has not appointed a data protection officer (DPO). This is not a legal requirement for an organisation of our size and nature. You can send privacy questions to info@patchly.nl.
3. Two roles: controller and processor
It is important to distinguish between two situations.
3.1 Patchly as controller
For our own business operations, we determine the purposes and means of processing. This includes maintaining client records, responding to contact requests, invoicing and recruitment. We are the controller for these processing activities, and this privacy policy applies to them.
3.2 Patchly as processor
When we build, host or manage software, platforms or AI automation for a client, we process personal data solely on that client’s behalf and in accordance with their instructions. The client is then the controller and determines which data is processed and for what purposes. We record these arrangements in a data processing agreement.
For example, are you a guest, tenant or customer of an organisation using a system supplied by Patchly? That organisation is your point of contact, and its privacy policy applies. In that situation, we will forward your request to the relevant client or refer you to them.
4. Which data we process, for what purposes and on which legal basis
4.1 Visits to our website
Data: IP address (shortened where possible), date and time of the visit, requested pages, HTTP status codes, referrer, browser type and operating system, in the form of server logs. Purpose: the technical operation, security and availability of the website, and the detection of misuse and faults. Legal basis: legitimate interests (Article 6(1)(f) GDPR), namely our interest in keeping our website secure and operational. Retention period: no more than 7 days, unless a log entry is needed to investigate an incident.
Our website only uses functional and strictly necessary cookies. We do not use analytics, tracking or marketing cookies and do not track you across other websites. See section 5.
4.2 Contact and quote requests
Data: name, company name, email address, telephone number, job title and the content of your message, including subsequent correspondence. Purpose: answering your question, providing a quote and taking steps towards a possible working relationship. Legal basis: performance of a contract or steps prior to entering into a contract (Article 6(1)(b) GDPR), and for other contact, our legitimate interest in effective business communication (Article 6(1)(f) GDPR). Retention period: up to 24 months after the last contact if no contract is concluded. If a contract is concluded, section 4.3 applies.
4.3 Client relationships and project delivery
Data: names, job titles and business contact details of contact persons, project correspondence, agreements, minutes, tickets, time records and invoicing details. Purpose: performing the contract, project management, support, invoicing and relationship management. Legal basis: performance of the contract (Article 6(1)(b) GDPR) and, for contact persons who are not themselves parties to the contract, legitimate interests (Article 6(1)(f) GDPR). Retention period: for the duration of the working relationship and for 7 years afterwards insofar as the data is subject to statutory tax retention requirements (Article 52 of the Dutch General Taxes Act). We delete other project data no later than 2 years after completion, unless retention is necessary for maintenance or to substantiate a legal claim.
4.4 System access for support and management
When resolving faults or performing management tasks, a Patchly employee may need access to a system containing personal data belonging to or processed on behalf of a client. We only do this when necessary, using as little data as possible, and under the data processing agreement with the relevant client. This access is logged.
4.5 Suppliers and partners
Data: names, job titles and business contact details of contact persons, contract and payment details. Purpose: purchasing, cooperation and administration. Legal basis: performance of the contract and legitimate interests. Retention period: 7 years after the end of the relationship, insofar as relevant for tax purposes.
4.6 Job applications
Data: name, contact details, CV, motivation, education and work experience, and interview notes. Purpose: assessing your suitability and conducting the recruitment process. Legal basis: steps prior to entering into an employment contract at your request and legitimate interests. Retention period: up to 4 weeks after the process ends. With your explicit consent, we retain your data for up to 1 year so we can contact you about a suitable vacancy. You may withdraw that consent at any time.
4.7 Business emails about our services
If you are a client, Article 11.7 of the Dutch Telecommunications Act permits us to inform you by email about our own similar services. Each message explains how to unsubscribe. For other commercial messages, we request your consent in advance (Article 6(1)(a) GDPR).
5. Cookies
Our website only uses cookies and similar technologies that are necessary for the website to function or to ensure its security. Under Article 11.7a(3) of the Dutch Telecommunications Act, these do not require consent, and we do not display a cookie banner.
To select the website language, we use the country provided by our hosting provider when you visit. If you choose Dutch or English yourself, we remember that preference for one year in the functional patchly_language cookie. You can change your choice at any time using the language button.
We do not use analytics cookies, advertising or tracking cookies, social media pixels or profiling technologies.
You can always delete or block cookies in your browser settings. Blocking functional cookies may prevent parts of the website from working properly.
If we use analytics or other non-essential technologies in the future, we will update this policy and request your consent in advance.
6. Artificial intelligence
Patchly develops and supplies AI applications. The following applies.
6.1 Transparency
When you communicate with an AI assistant or chatbot through an application supplied by Patchly, we make this clear so you know you are not speaking to a person. We label AI-generated or AI-edited content as such where required. This is in line with the transparency obligations in Article 50 of the EU AI Act (Regulation (EU) 2024/1689), applicable since 2 August 2026.
6.2 Use of external AI models
For certain features, we use third-party AI models, such as Anthropic (Claude). Under a data processing agreement, data processed in this context is used solely to provide the service. Where possible, we choose configurations in which inputs are not used to train or improve the provider’s models, and we record this contractually.
6.3 No automated decision-making with legal effects
Patchly does not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, within the meaning of Article 22 GDPR. If we build an application for a client in which this is relevant, that client is responsible for its lawfulness, and we design the application so human intervention remains possible.
6.4 Limitations of AI output
AI system outputs may be incomplete or incorrect. Where necessary, the systems we supply include review points and human assessment, and we advise clients not to use AI output without checking it when making decisions that affect people.
7. Sharing with third parties
We do not sell your data or provide it to third parties for their own purposes. We do engage service providers that act as processors on our behalf. We enter into data processing agreements with them. They fall into the following categories:
- website hosting and infrastructure: Vercel;
- scheduling consultations: Calendly;
- hosting and infrastructure for the Platform and client environments;
- transactional email from our systems: Resend;
- AI models and related services: Anthropic (Claude);
- telephony and voice services, insofar as part of a Service: Twilio;
- office software, administration, invoicing and support.
We may also provide data to our accountant, advisers or authorities if legally required or if necessary to substantiate or exercise a legal claim.
We make an up-to-date overview of our subprocessors available to clients on request.
8. Transfers outside the european economic area
We prefer to process data within the European Economic Area (EEA). Where a service provider processes data outside the EEA, we ensure there is a valid basis for the transfer, such as an adequacy decision by the European Commission or the Commission’s Standard Contractual Clauses (SCCs), supplemented by additional measures where necessary. On request, we explain which safeguards apply to a particular service.
9. Security
We take appropriate technical and organisational measures to protect personal data against loss and unlawful processing, including:
- encryption of traffic (TLS) and data at rest where appropriate;
- role-based access and the principle of least privilege;
- multi-factor authentication for management environments;
- separation of client environments in our multi-tenant platform;
- logging and monitoring of access and changes;
- separate development, test and production environments, without using production data in test or development environments unless necessary and the data has been pseudonymised;
- regular backups and recovery tests;
- confidentiality obligations for everyone with access on our behalf;
- regular review and updating of these measures.
Do you suspect a vulnerability in our systems? Please report it to info@patchly.nl. We ask you not to disclose the vulnerability before it has been fixed and not to access more data than needed to demonstrate the problem.
10. Personal data breaches
We keep a register of security incidents. Where required, we report a personal data breach to the Dutch Data Protection Authority within 72 hours of discovery and, if the breach poses a high risk, also to the affected individuals. Where Patchly acts as processor, we notify the relevant client without undue delay. The client then assesses whether notification to the supervisory authority is required.
11. Your rights
Under the GDPR, you have the following rights:
- access to the personal data we process about you (Article 15);
- rectification of inaccurate or incomplete data (Article 16);
- erasure of your data where required (Article 17);
- restriction of processing (Article 18);
- portability of data you have provided and that we process by automated means on the basis of consent or a contract (Article 20);
- objection to processing based on legitimate interests (Article 21), and objection to direct marketing at any time;
- withdrawal of previously given consent, without affecting the lawfulness of processing before withdrawal (Article 7(3)).
You can submit a request to info@patchly.nl. We respond within one month. For complex requests, we may extend this period by two months; we will inform you within the first month. To avoid disclosing data to the wrong person, we may ask you to substantiate your identity. We do not request a copy of your identity document showing your citizen service number and photograph.
If we process your data as processor on behalf of a client, we forward your request to that client or refer you to them.
12. Complaints
If you disagree with how we handle your data, please first contact us at info@patchly.nl. If we cannot resolve the matter together, you have the right to lodge a complaint with the Dutch Data Protection Authority:
Dutch Data Protection Authority (Autoriteit Persoonsgegevens) Postbus 93374, 2509 AJ The Hague autoriteitpersoonsgegevens.nl
You may also bring the matter before a court.
13. Changes
We may update this privacy policy, for example when our services or the law change. The current version is always available at www.patchly.nl. We actively inform our clients of material changes. The version and last updated date appear at the top of this policy.