Privacy Policy

Last updated: 2026-10-11 · v5.2

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:
suPlay BV
Enschede, The Netherlands
KvK 70176264 · BTW NL858175691B01
Email: info@suplay.nl

For survey content that a buying firm (our customer) processes about its suppliers and respondents, suPlay acts as a processor under Art. 28 GDPR; the buying firm is the controller. See the Data Processing Agreement for terms.

2. Categories of personal data

Account data — email, name, password hash, role, membership in firms and consultancies.
Authentication and session data — session cookie (SSA_SESSID), last login time, IP address of the login request.
Survey response data — answers to supplier-satisfaction questionnaires. Depending on the survey's anonymity setting, responses may be fully anonymous, tracked anonymously by invitation token, or linked to a named supplier contact. Where a survey opens with a start page that asks respondents to agree to take part, the time of that agreement is stored with the response.
Invitation data — recipient email, name, and invitation token for personalized survey links.
Billing data (only when billing is enabled) — payer identifier, transaction history, company name and VAT ID captured at checkout.
Technical log data — IP address, user-agent, requested URL, response code, timestamp; kept in web server logs for at most 90 days.
Audit trail: a record of administrative actions in the platform (for example a user, firm or role being created, changed or removed, an administrator acting as another user, an export or report being made), with the email address of the user who acted, the affected object, the time and the IP address of the request. It never contains passwords, access tokens or survey answers.

3. Purposes and legal bases (Art. 6 GDPR)

Purpose	Legal basis
Operating the platform (authentication, survey distribution, analysis, reporting)	Contract, Art. 6(1)(b)
Billing and accounting	Contract (Art. 6(1)(b)); legal obligation for tax records (Art. 6(1)(c); Dutch tax law)
Security logging, abuse prevention, audit trail	Legitimate interest, Art. 6(1)(f)
Transactional email (invitations, password reset, account notifications)	Contract, Art. 6(1)(b)
AI-assisted drafting of report narratives and questionnaire translations	Contract, Art. 6(1)(b) — only aggregated survey data is sent to a model; see §4a
Anonymized/aggregated academic research on buyer-supplier relationships	Legitimate interest, Art. 6(1)(f) — only on data that can no longer identify individuals

We do not use your data for profiling, advertising, or automated decision-making with legal effect. The AI-generated report text is a draft shown to your own users for review and editing before use; it produces no decision about any individual (Art. 22 GDPR).

Research opt-out. You may object to the research use of anonymized data at any time by emailing info@suplay.nl. Because research data is anonymized at extraction, opt-out applies to future extractions; already anonymized datasets cannot be tied back to an individual.

4. Recipients and subprocessors

We share personal data only with the subprocessors listed at /subprocessors, all of which process data on our behalf under GDPR-compliant contracts. We do not sell or rent personal data.

Categories of recipients:

Hosting and backups — TransIP (NL), Scaleway (NL).
Transactional email — Resend, Inc. (US-incorporated; messages are processed in its EU region, eu-west-1 Ireland, and the engagement is covered by the Standard Contractual Clauses).
Billing — PayPal (Europe) S.à r.l. (LU); only when subscription billing is enabled on your account.
Error monitoring — Sentry (EU region, Frankfurt) for application error traces.
AI report generation — a language model that suPlay runs on its own hardware in the Netherlands, so no third party is involved. A cloud fallback for when that model cannot answer is off unless the platform administrator switches it on, and it is currently switched off. While it is off, no survey data leaves suPlay’s own systems and report generation fails rather than falling back. The provider it would use is named in advance, with its region and transfer basis, on the subprocessors page. Questionnaire translation likewise uses the self-hosted model only.

4a. AI processing

Report narratives and questionnaire translations are drafted with the help of a large language model. Only aggregates are sent to a model: the buying firm’s name, the number of completed responses, per-dimension mean scores with respondent counts and standard deviations, questionnaire item texts (truncated) with their mean scores, and — for a Preferred Customer Assessment only — the names of the rated supplier organisations grouped by matrix quadrant.

Individual responses are never sent. Scores are aggregated across respondents before a prompt is built, so no answer is attributable to an identified individual. Free-text and open-ended answers are never sent in any form, and neither are respondent names, contact names, email addresses, invitation tokens, access codes, IP addresses or credentials.

The default engine is self-hosted in the Netherlands. Where a cloud AI provider is configured as a fallback, we require it to act only as our processor, not to use the submitted content to train or improve its models, and to retain that content only as long as needed to return a response plus a limited abuse-review period. We prefer a provider that processes entirely within the EEA; where the configured provider is outside the EEA, that is stated for that provider, with its transfer basis, on the subprocessors page.

5. International transfers

Where subprocessors are located outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses (SCCs) and supplementary safeguards. See the subprocessors page for the per-vendor list.

6. Retention

Active account data: kept while your account is active.
Server logs: 90 days.
Audit trail: 2 years per entry. The IP address is removed from each entry after 90 days.
Backups: encrypted; daily backups are kept 30 days and monthly backups 12 months, so a deleted record leaves the daily backups within 30 days and the monthly ones within 12 months.
Billing records: 7 years (Dutch tax law).
Survey responses: retained by the buying firm as controller. On customer request or account closure of the buying firm, data is deleted or anonymized within 30 days.
Deleting your own account: when you delete your account on your account page, it is first marked for deletion and you are logged out. For 7 days you can log in only to cancel the deletion; you cannot otherwise use the account. After the 7 days a daily scheduled job erases the account (and the organisation, if you chose to delete it with your account), so the erasure happens within 8 days of your request. Fully anonymized data may be retained for research. The deletion itself is recorded in the audit trail with the account's internal id and role only, without your email or IP address. Audit-trail entries written earlier that name you are kept until they reach the 2-year limit above, for the accountability purpose in §3.
Inactive accounts: an account is deleted after 24 months without use (signing in or using the API), counted from its creation if it was never used, with a warning email at 23 months. Only the personal account is deleted; the survey data of the organisations it belonged to stays with those organisations while they are in use (see organisations no longer in use, below).
Only administrator of an organisation with surveys: for this account the period is 36 months without use (signing in or using the API), with warning emails at 35 months and 7 days before deletion. When the account is deleted, the organisation is closed and deleted with it, including its surveys, responses and supplier data, unless it is still in use. The organisation and its data stay if another user of it remains, if a consultancy that manages it on the platform still has users, or if one of its surveys received a response in the last 12 months.
Organisations no longer in use: an organisation with no users left is closed and deleted, including its surveys, responses and supplier data, within 30 days once no consultancy that manages it on the platform has users and, in the last 12 months, the organisation was not created, none of its surveys was created and none received a response. This includes an organisation kept when its last administrator’s account was deleted. An organisation that has a user is never closed this way. The closure is recorded in the audit trail as a count, without the organisation’s name.
Notice before an inactivity deletion: an account is never deleted sooner than 30 days after its first warning email, nor sooner than 7 days after the final one, so a delayed run postpones a deletion rather than shortening the notice. Signing in or using the API at any time before the deletion keeps the account. Platform super administrator accounts are not deleted automatically.

7. Cookies

This application uses only essential cookies required for the platform to function:

SSA_SESSID — session cookie, expires on logout or inactivity.
ssa_sidebar_collapsed — UI preference, one year.
cookie_notice_dismissed — records dismissal of the cookie notice, one year.

We do not use tracking, analytics, or marketing cookies. When subscription billing is enabled, the PayPal checkout popup may set cookies under the paypal.com domain during a transaction only; these are loaded only after you click Subscribe (consent by action).

8. Your rights (GDPR Art. 15–22)

You have the right to:

access, rectify, or erase your personal data;
restrict or object to processing;
receive your data in a portable format;
withdraw any consent you have given, without affecting the lawfulness of processing before withdrawal;
lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

Self-service access, export, and deletion are available on your account page at /admin/profile once you are logged in. For requests you cannot complete in-platform, email info@suplay.nl. We respond within one month per Art. 12(3).

9. Security

We protect personal data with HTTPS, bcrypt password hashing, hardened server configuration (SELinux, fail2ban), encrypted off-site backups, role-based access control, and least-privilege access for staff. Survey responses can be configured as fully anonymous. See /security for a summary of technical and organizational measures.

10. Data breach notification

In the event of a personal-data breach likely to result in a risk to the rights and freedoms of data subjects, we will notify the Dutch supervisory authority within 72 hours and affected data subjects without undue delay, as required by Art. 33–34 GDPR.

11. Changes to this policy

We may update this privacy policy. The version and date at the top of the page indicate the current revision. Material changes are announced by email or in-platform notice before taking effect.

← Back