1. Who We Are
NDAvia B.V. ("NDAvia", "we", "us", "our") is a private limited company registered in the Netherlands under Chamber of Commerce (KvK) number 71392149, with its registered office at Herengracht 449-A, 1017 BR Amsterdam, the Netherlands.
We operate the NDAvia platform. We are the data controller for personal data collected through our website (ndavia.com) and our platform. When processing data on behalf of our business clients (e.g., document recipients' information), we act as a data processor under a Data Processing Agreement (DPA).
2. What Data We Collect
2.1 Data you provide directly
- Account registration: Full name, business email address, company name, job title, phone number.
- Contact & demo requests: Name, email, company, message content.
- NDA signing (recipients): Full name, email address, digital signature, checkbox confirmations, timestamp.
- Billing information: Company name, billing address, VAT number. Payment card details are processed by our payment provider (Stripe) and never stored on our servers.
2.2 Data collected automatically
- Device & browser information: IP address, browser type and version, operating system, device type, screen resolution.
- Usage data: Pages visited, time spent on pages, click patterns, referral source, document access timestamps.
- Audit trail data: NDA acknowledgement time, document view duration, IP address at time of signing, device fingerprint.
2.3 Data from third parties
We may receive basic business contact information from CRM integrations configured by our clients, or from publicly available business directories, solely for the purpose of facilitating document delivery.
3. How We Use Your Data
| Purpose | Data Used |
|---|
| Providing the NDAvia platform | Account data, NDA signing data, audit trail data |
| Processing demo requests & enquiries | Contact form data |
| Generating audit trails & compliance records | Signing data, device data, IP address, timestamps |
| Billing & invoicing | Billing information, usage data |
| Improving our platform | Aggregated & anonymised usage data |
| Security & fraud prevention | IP address, device data, access logs |
| Legal compliance | All data as required by applicable law |
4. Legal Bases for Processing
Under Article 6 of the GDPR, we process personal data based on the following legal grounds:
- Contract performance (Art. 6(1)(b)) — Processing necessary to provide our services, manage accounts, and deliver documents.
- Legitimate interest (Art. 6(1)(f)) — Platform security, fraud prevention, analytics for service improvement, and audit trail generation for our clients' legal protection.
- Legal obligation (Art. 6(1)(c)) — Tax and accounting requirements, responding to lawful requests from authorities.
- Consent (Art. 6(1)(a)) — Marketing communications (where applicable). You can withdraw consent at any time.
5. Data Sharing & Third Parties
We do not sell your personal data. We share data only with the following categories of recipients, under appropriate contractual safeguards:
- Cloud infrastructure: EU-based hosting providers (data centres in the Netherlands and Germany).
- Payment processing: Stripe, Inc. (PCI DSS Level 1 certified) for payment transactions.
- Email delivery: Transactional email providers for notifications and document delivery links.
- Analytics: Privacy-focused analytics (no personally identifiable data shared).
- Our clients: When you sign an NDA as a document recipient, the sending party receives your signing data and audit trail as part of their compliance record.
- Legal & regulatory: When required by Dutch or EU law, court order, or regulatory authority.
6. International Transfers
All primary data processing occurs within the European Economic Area (EEA). In the event that any sub-processor is located outside the EEA, we ensure appropriate safeguards are in place, including:
- EU Standard Contractual Clauses (SCCs) approved by the European Commission.
- Adequacy decisions where applicable.
- Supplementary technical measures (encryption, pseudonymisation).
7. Data Retention
- Account data: Retained for the duration of the account plus 12 months after deletion.
- NDA signing records & audit trails: Retained for a minimum of 7 years (or as configured by the sending client), to support legal enforceability.
- Contact form submissions: Retained for 24 months from submission.
- Billing records: Retained for 7 years as required by Dutch tax law (AWR).
- Server logs: Automatically purged after 90 days.
Clients may configure custom retention periods for their documents. Upon expiry, data is securely deleted using cryptographic erasure.
8. Your Rights Under GDPR
As a data subject in the EU/EEA, you have the following rights:
- Right of access (Art. 15) — Request a copy of your personal data.
- Right to rectification (Art. 16) — Correct inaccurate or incomplete data.
- Right to erasure (Art. 17) — Request deletion of your data ("right to be forgotten"), subject to legal retention obligations.
- Right to restrict processing (Art. 18) — Limit how we use your data.
- Right to data portability (Art. 20) — Receive your data in a structured, machine-readable format.
- Right to object (Art. 21) — Object to processing based on legitimate interests.
- Right to withdraw consent (Art. 7(3)) — Where processing is based on consent.
- Right to lodge a complaint — With the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.
To exercise any of these rights, email us at privacy@ndavia.com. We will respond within 30 days.
9. Cookies & Tracking
Our website uses the following types of cookies:
- Strictly necessary cookies: Required for the platform to function (session management, security tokens). No consent required.
- Functional cookies: Remember your language and display preferences.
- Analytics cookies: Help us understand how visitors use our website. We use privacy-focused analytics that do not track individuals across sites.
We do not use advertising cookies or share cookie data with ad networks. You can manage cookie preferences through your browser settings.
10. Security Measures
We implement industry-standard technical and organisational measures to protect your data, including:
- AES-256 encryption for data at rest.
- TLS 1.3 encryption for data in transit.
- Role-based access controls with multi-factor authentication.
- Regular penetration testing and vulnerability assessments.
- ISO 27001-aligned information security management practices.
- Employee security training and confidentiality agreements.
- Incident response procedures with 72-hour breach notification (as required by Art. 33 GDPR).
11. Children's Privacy
NDAvia is a business-to-business platform and is not intended for use by individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email to account holders and posted on our website with an updated "Last updated" date. Continued use of NDAvia after changes constitutes acceptance of the revised policy.
13. Contact & Data Protection Officer
For any privacy-related questions, requests, or concerns:
- Email: privacy@ndavia.com
- Post: NDAvia B.V., Attn: Data Protection Officer, Herengracht 449-A, 1017 BR Amsterdam, the Netherlands
- Phone: +31 20 799 7603
Our Data Protection Officer (DPO) can be reached directly at dpo@ndavia.com.