Privacy statement for test environments

Who is responsible

AiPOX (Chamber of Commerce no. 96879734, 's-Gravenzande, the Netherlands) is the controller of personal data processed in the test environments we operate. This statement applies to people we invite to use a test environment, such as calctool-staging.aipox.nl.

What data we process

• Name and email address of invited users, taken from their Microsoft account.
• Sign-in times.
• The IP address you connect from, in technical logs.
• A session cookie that is only needed to keep you signed in and is valid for at most 30 days. We use no tracking or advertising cookies.
• The data you enter in the test environment yourself.

What we use it for

Testing and demonstrating the application, and security and troubleshooting. The legal basis is our legitimate interest in testing and improving the application safely, at your invitation and with your cooperation.

Email from the test environment

The test environment does not send email to real mailboxes. Messages stay in an internal mailbox that only the administrator can read.

Where the data is stored

On servers that AiPOX operates itself in the Netherlands. Databases and file storage are local. Traffic to the test environment passes through Cloudflare (DNS and proxying), which technically sees your IP address. When you sign in with Microsoft, Microsoft processes your sign-in data under its own terms and privacy statement.

How long we keep it

• Technical logs, including IP addresses: at most 30 days.
• Accounts and test data you entered: until the end of the test, and deleted at the latest 30 days after.
• Messages in the internal mailbox: the same period as the test data.

Sharing with others

We do not sell or share your data with third parties. The exceptions are Microsoft for signing in and Cloudflare for DNS and proxying traffic. We use no external hosting providers for the test environment.

Data breaches

If a security incident involves personal data, we immediately assess what happened and which data is affected. If the incident poses risks to you, we report it to the Dutch Data Protection Authority within 72 hours, and we inform you without undue delay if the risks are high. You can report a suspected breach at [email protected].

Your rights

You can ask us for access to, correction of, or deletion of your data, and object to the processing. Email [email protected]; we respond within one month. If you wish to complain, you can contact the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

Contact

Privacy contact: AiPOX, [email protected].