1. Who is responsible for your data
Scanluma is a service of Venturi Works, a sole proprietorship registered in the Netherlands. Venturi Works is the controller for the personal data described in this policy.
| Legal entity | Venturi Works |
| Address | Rijksstraatweg 35, 9254DA, Hurdegaryp, Netherlands |
| Chamber of Commerce (KvK) | 42144844 |
| VAT identification number | NL005533042B70 |
| Contact | privacy@scanluma.com |
We are not required to appoint a data protection officer. You can reach us directly at the address above with any privacy question.
2. What this policy covers
This policy explains what personal data we collect when you visit our website, create an account or use Scanluma, why we use it, how long we keep it and what rights you have.
It does not cover the websites you scan, or third-party sites we link to. Those have their own policies.
3. What data we collect
Account data. Your email address, your password (stored only as a hash) and your company or trade name. We do not ask for your name, address or phone number to create an account.
Billing data. Payments are handled by Paddle. We do not receive or store your card details. From Paddle we receive your name, email address, country, VAT number where applicable, the plan you bought and the status of your subscription.
Usage data. The Target Websites you submit, scan settings, scan results and reports, timestamps, and records of actions you take in the application.
Technical data. IP address, browser type and version, device and operating system, language, referring page, and the pages you view. This comes from server logs and, where applicable, from analytics.
Support data. The content of emails and messages you send us, and our replies.
Marketing data. Your email address and consent status if you subscribe to our newsletter or product updates.
Scanning itself is aimed at public web pages and their accessibility, not at personal data. If a page you scan happens to contain personal data, that content may appear in a report. Do not submit pages behind a login that contain personal data unless you are entitled to do so.
4. Why we use your data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and managing your account, running scans, producing reports | Performance of a contract |
| Processing payments, renewals, refunds and invoices | Performance of a contract and legal obligation |
| Providing support and responding to your messages | Performance of a contract and legitimate interest |
| Service emails, such as scan results, failed payments and important changes | Performance of a contract |
| Keeping the Service secure, preventing abuse and debugging errors | Legitimate interest |
| Improving the Service through aggregated, non-identifying usage statistics | Legitimate interest |
| Newsletter and product marketing | Consent |
| Keeping financial records | Legal obligation |
Where we rely on legitimate interest, we have weighed our interest against your privacy and limited the data to what is needed. You may object at any time, see section 8.
5. Who we share your data with
We use a small number of service providers (processors) who handle data on our behalf under a data processing agreement. They may not use your data for their own purposes.
| Provider | Purpose | Location |
|---|---|---|
| Paddle | Payments, invoicing, tax, as Merchant of Record | United Kingdom |
| TransIP | Hosting of the application, databases and backups | Netherlands |
| Brevo | Transactional and marketing email | France |
| Sentry | Error logging and diagnostics | United States |
| Google Analytics | Visitor statistics on our public website | United States |
| CookieYes | Cookie consent banner and consent records | United Kingdom (company); consent data stored in the EU (Malta) |
Google Analytics and CookieYes run on our public website only. They are not used inside the application, where we set no analytics or marketing cookies at all.
Note that Paddle acts as the seller of record for your purchase and is an independent controller for that transaction. Paddle’s own privacy policy applies to the payment.
We also share data where we must, for example with the tax authorities, an accountant, or a competent authority on a valid legal request. If the business is ever sold or transferred, data may pass to the acquiring party under the same protections.
We do not sell your personal data and do not share it with advertisers.
6. Transfers outside the EEA
We prefer providers in the European Economic Area. Where a provider processes data outside the EEA, the transfer is covered by an adequacy decision of the European Commission or by the European Commission’s Standard Contractual Clauses with additional safeguards where needed. You can ask us for details at privacy@scanluma.com.
7. How long we keep your data
| Data | Retention |
|---|---|
| Account data | For as long as your account exists; deleted immediately when you close your account |
| Scan results and reports | For as long as your account exists; deleted immediately when you close your account |
| Invoices and financial records | 7 years, as required by Dutch tax law |
| Server and security logs | 90 days |
| Support correspondence | 24 months after the last contact |
| Newsletter subscription | Until you unsubscribe |
You can delete your account at any time from your account settings or by emailing us. Deletion is immediate and cannot be undone, so export anything you want to keep first. Residual copies may remain in our backups until those are overwritten in the normal rotation, which takes at most 35 days.
We keep invoices and financial records even after you delete your account, because Dutch tax law requires it. Those records contain your name, company details and what you paid, not your scan data.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- rectify data that is inaccurate or incomplete;
- erase your data, where no legal obligation requires us to keep it;
- restrict processing in certain circumstances;
- object to processing based on legitimate interest, and to direct marketing at any time;
- data portability, so you can receive your data in a structured, machine-readable format;
- withdraw consent at any time, without affecting processing that took place before;
- lodge a complaint with a supervisory authority.
Send requests to privacy@scanluma.com. We reply within one month. We may ask you to confirm your identity before we act on a request.
If you are in the Netherlands, the supervisory authority is the Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl. If you are elsewhere in the EU, you can contact your own national authority.
9. Cookies
We use cookies and similar techniques:
- Necessary cookies, for logging in, security and remembering your session. These are placed without consent because the Service cannot work without them. We use these in the application.
- Analytics cookies, on our public website only. We use Google Analytics to understand how visitors find and use the site, with IP anonymisation enabled. These cookies are placed only after you consent.
- Consent record, kept by CookieYes so that we can demonstrate what you agreed to and when.
- Marketing cookies: we do not use any.
Inside the application we set no analytics or marketing cookies, only the cookies needed to keep you logged in and the Service secure.
On our website we ask for your consent before placing analytics cookies, and you can change or withdraw it at any time through the cookie settings link in our footer. You can also block or delete cookies in your browser, though this may break parts of the Service.
Google Analytics processes data in the United States. That transfer is covered by the EU-US Data Privacy Framework and, where needed, by the European Commission’s Standard Contractual Clauses. More information is in Google’s own privacy policy.
10. Security
We take appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), hashed passwords, access control on a need-to-know basis, regular updates of our systems and logging of administrative access.
No system is completely secure. If a data breach occurs that is likely to present a risk to you, we will inform you and the Autoriteit Persoonsgegevens as required by law.
11. Children
The Service is intended for business use and is not aimed at people under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
12. Automated decision-making
We do not use your personal data for automated decision-making or profiling that has legal or similarly significant effects on you. Scan results are generated automatically, but they concern websites, not people.
13. Changes to this policy
We may update this policy when the Service or the law changes. We publish the current version on our website with the date of the last update. For material changes that affect you, we will notify you by email.
14. Contact
Questions, requests or complaints about privacy can be sent to privacy@scanluma.com, or by post to Venturi Works, [address].