Privacy Policy

1. Who we are

Meulenbase (the website meulenbase.com and the Meulenbase platform) is operated by Rafael Meulenbelt, an individual based in the Netherlands (“we”, “us”). For the personal data described in this policy we are the controller under the EU General Data Protection Regulation (GDPR), and the organisation responsible under Singapore's Personal Data Protection Act (PDPA).

You can reach us at [email protected] about anything in this policy. Rafael Meulenbelt is also the contact for data protection matters (the data protection officer for the purposes of the PDPA) at that address.

2. Your data and your organisation's data

This policy covers personal data about the people who visit our website or use the platform: your account, your sign-ins, our logs and your messages to us. We decide how that data is used.

Organisations that use Meulenbase (our customers) also put their own data into the platform: financial records, maintenance, purchasing and sales records, and data from their own systems such as HR, ERP or maintenance software. That data can include personal data, for example employees' names, working hours or payroll details, or contact people at customers and suppliers. For that data the customer is the controller and we act only as its processor (a data intermediary under the PDPA). We process it on the customer's instructions under the data processing terms in our Terms of Service, and the customer's own privacy notice explains how it is used. To exercise your rights over such data, please contact that organisation (for example your employer); we will help it answer you.

3. What we collect

• Account details: your name, email address, the organisations and roles you have been given, your account status, and who invited you and when. An administrator of your organisation gives us your email address and roles when inviting you; you give us your name and password when you create your account.
• Sign-in and security data: your password, which we store only as a salted hash (scrypt) and cannot read; records of your sessions with the IP address and browser (user agent) they started from; when you last signed in and were last active; API keys you create, stored only as a hash; and a record of administrative actions on accounts, such as invitations, role changes and suspensions, with who made them.
• Activity in your organisation's workspace: the platform records who created, changed, published or removed items (for example an upload or a report) as part of your organisation's records.
• Technical data: when you load a page, our servers and our network provider record your IP address, the time, the address requested, the response, your browser's user agent and the referring page.
• Messages: when you use the contact form or email us, your name, email address, subject and message, and our replies.

We do not ask users for sensitive data (such as health data), and we use no analytics, advertising or tracking tools. The platform is for business users and not meant for anyone under 16; we do not knowingly collect personal data of children.

4. Why we use it

• To provide the platform: create and manage your account, sign you in, apply the access rights your organisation sets, and send the emails the platform needs (address verification, password reset, invitations). Legal basis: the performance of a contract (GDPR article 6(1)(b)) where you deal with us yourself, and otherwise our legitimate interest, and your organisation's, in providing the service your organisation asked for (article 6(1)(f)).
• To keep the platform and its data secure: logs, rate limits, bot protection, audit records, and investigating incidents and misuse. Legal basis: legitimate interests in security (article 6(1)(f)).
• To answer your messages and give support. Legal basis: legitimate interests (article 6(1)(f)), or steps you asked for before entering into a contract (article 6(1)(b)).
• To meet legal obligations and to establish, exercise or defend legal claims. Legal basis: legal obligation (article 6(1)(c)) and legitimate interests (article 6(1)(f)).

Where we rely on legitimate interests, we have weighed them against your interests and rights, and you can object (see Your rights). Under the PDPA, we collect, use and disclose personal data for the purposes above, which this policy notifies to you, with your consent (given when you accept an invitation and use the platform) or where the PDPA allows it without consent.

We do not use personal data for marketing, we do not sell it, we make no automated decisions about you that have legal or similarly significant effects, and we do not use personal data or customer data to train artificial intelligence models.

5. Cookies and browser storage

A cookie is a small file a website stores in your browser. We only use cookies that are strictly necessary to sign you in, to remember the role you chose in the platform, or to protect the service against attacks. Such cookies need no consent under the Dutch Telecommunications Act (article 11.7a) and the EU ePrivacy rules, which is why there is no cookie banner. We use no analytics, advertising or tracking cookies, and no other party places cookies through our site for its own purposes.

Cloudflare may also set other strictly necessary security cookies, listed in Cloudflare's cookie overview. The session cookies are needed to sign in: if you block them, you can still read the public website but cannot use the platform.

The platform also keeps a few settings in your browser's local storage, which stays on your device: your theme (light, dark or automatic), which maintenance notices you dismissed, and how you grouped the rows of a table. It keeps one timestamp in session storage, to reload the page once after we release a new version. You can clear all of this in your browser's settings.

6. Who receives personal data

We do not sell, rent or trade personal data. We share it only with the service providers that run the platform for us, which process it on our instructions under data processing terms, and in the other cases listed below.

• Your organisation: administrators of the organisation that invited you can see your account details, roles, status, last sign-in and your activity in its workspace.
• Systems your organisation connects: when your organisation connects the platform to its other systems (for example its HR, ERP or maintenance software, or a carrier's tracking service), we exchange data with those systems on its instructions, using the access it provides.
• Authorities: where the law requires it, on a valid order of a court or authority, or where needed to establish or defend legal claims or to protect the security of the platform and its users.
• A successor: if we transfer the platform to a company we set up or to a new operator, personal data passes to that company, which remains bound by this policy. We will tell you before that happens.

7. Where data is stored

We store the platform's data in the European Union, in AWS's Frankfurt region in Germany. An organisation can choose to keep its data in its own database or storage instead; that data is then where the organisation chooses.

Some of the providers above can process personal data in the United States or other countries outside the European Economic Area. Where such a country has no adequacy decision of the European Commission, we rely on the EU-US Data Privacy Framework where the provider is certified under it, or on the European Commission's Standard Contractual Clauses in the provider's data processing terms.

If you are in Singapore, your personal data is transferred to Germany and to the providers above. We make sure it receives protection comparable to the PDPA, through the GDPR and those data processing terms.

8. How long we keep it

• Account details: as long as your account exists. When your organisation ends your access, your account is suspended or deactivated rather than deleted, so that its records keep showing who did what. You can ask us to erase it (see Your rights).
• Sessions: deleted when you sign out, when your password is reset or when an administrator ends them. Sessions that simply expired stay in our database until your account is erased.
• Records of who changed what, including administrative actions on accounts: as long as your organisation uses the platform, as part of its records.
• Logs: web server logs 14 days; error and security logs 30 days. Cloudflare keeps its own logs for a limited time under its own policy.
• Backups: database backups are kept for 7 days, and earlier versions of stored files for 7 days, so deleted data can remain in a backup for up to 7 more days.
• Messages to us: as long as needed to answer and follow up, and no longer than two years after our last contact.
• Your organisation's data: as your organisation decides while it uses the platform, and deleted after it stops, as set out in the Terms of Service.

We keep data longer only where the law requires it, or where we need it to establish, exercise or defend a legal claim, and then only for that purpose.

9. How we protect it

We protect personal data with technical and organisational measures that fit the risk, including:

• encryption (HTTPS) of all traffic between your browser and the platform;
• encryption at rest of the database and file storage;
• passwords stored only as salted hashes, and API keys and invitation links stored only as hashes;
• separation of every organisation's data, with each request checked against the user's organisation and permissions;
• sign-up by invitation only, with email verification;
• multi-factor authentication and logging for administrative access to our hosting account.

No system is completely secure. If a personal data breach is likely to put people's rights at risk, we will notify the Dutch Data Protection Authority within 72 hours where the GDPR requires it, the Personal Data Protection Commission of Singapore where the PDPA requires it, and the customers and people affected without undue delay. Please keep your password and API keys secret, and tell us at once if you think someone else has used your account.

10. Your rights

Depending on where you are, you have the right to:

• access the personal data we hold about you and get a copy;
• have inaccurate data corrected;
• have your data erased where we have no lawful reason to keep it;
• restrict our use of your data, for example while a correction is checked;
• object to our use of your data based on legitimate interests;
• receive the data you gave us in a common machine-readable format (portability);
• withdraw consent where we rely on it. Under the PDPA we will tell you what that means, for example that we can no longer give you access to the platform.

To use these rights, email [email protected] from the address linked to your account. We may ask you to confirm your identity. We answer within one month; if a request is complex we may take up to two more months and will tell you why. Requests are free unless they are clearly unfounded or excessive. If your request concerns data that an organisation put into the platform, we pass it to that organisation and help it respond.

You may also complain to a data protection authority: in the Netherlands the Autoriteit Persoonsgegevens, elsewhere in the EU the authority where you live or work, and in Singapore the Personal Data Protection Commission. We would appreciate the chance to address your concern first.

11. Changes to this policy

We may update this policy when the platform or the law changes. The date at the top shows the current version. We will tell users about material changes by email or in the platform before they take effect.

12. Contact and complaints

Rafael Meulenbelt, Meulenbase, the Netherlands. Email: [email protected].