Version 2.0 (supersedes the policy dated 16 July 2025)
Controller: Altruon B.V., KvK 97816418
1. Who is responsible
1.1 Altruon B.V., registered with the Dutch Chamber of Commerce under number 97816418, with its registered office at Molenpad 2, 1016 GM Amsterdam, the Netherlands (Altruon, we, us), is the controller for the personal data described in this Privacy Policy, except where section 3 says otherwise.
1.2 Privacy contact: operations@altruon.io, or by post to Molenpad 2, 1016 GM Amsterdam, the Netherlands, attention Privacy. Altruon is established in the European Union and has not appointed an EU representative. Altruon has not appointed a data protection officer because it is not required to; the privacy contact above performs that function.
1.3 This policy is written for the EU General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act (Uitvoeringswet AVG). It applies to altruon.io and all sub-domains, the Altruon dashboard, the sandbox, the documentation, and to our business dealings with merchants, prospects, partners, suppliers and job applicants.
2. Two roles: controller and processor
2.1 Altruon as controller. For the personal data of website visitors, prospects, merchant staff and administrators, partner and supplier contacts, and job applicants, Altruon decides why and how the data is processed. Sections 4 to 11 apply.
2.2 Altruon as processor. Personal data of a merchant’s end-customers flows through the Altruon platform only on the merchant’s instructions, in order to route payment events between the merchant’s billing platform and its payment gateways. For that data the merchant is the controller and Altruon is a processor under Article 28 GDPR. Processing is governed by the Data Processing Agreement forming part of the Merchant Agreement, not by this policy. Section 3 explains what that means for end-customers.
3. If you are an end-customer of a merchant
3.1 If you bought a subscription or made a payment to a business that uses Altruon, that business is responsible for your personal data. Altruon does not have a direct relationship with you, does not decide what happens to your data, and does not use it for its own purposes.
3.2 What passes through Altruon is limited to what routing requires: subscription identifiers, invoice and transaction metadata (amount, currency, status, timestamps), device and technical data such as IP address and user agent, and payment tokens or reference identifiers issued by the payment gateway. Altruon does not receive, store or process full payment card numbers, card verification codes, PINs, or bank account credentials; those are handled by the payment gateway.
3.3 To exercise any right in relation to that data, contact the merchant. If you contact Altruon instead, we will forward your request to the merchant without undue delay and support them in responding, as the Data Processing Agreement requires. We will not respond directly unless the merchant instructs us to or the law requires it.
3.4 Altruon processes end-customer data in the European Economic Area on Amazon Web Services EU regions and retains it only as long as the merchant’s instructions and the Data Processing Agreement permit.
4. Personal data we collect as controller
| Who | Data | Source |
|---|---|---|
| Website visitors | IP address, browser and device type, pages visited, referrer, approximate country, timestamps, cookie consent choice | Collected automatically; see Cookie Policy |
| Contact form and email enquiries | Name, business email address, company, team selected, message content, and anything else you choose to include | You |
| Sandbox and dashboard users | Name, business email, role, company, login credentials (hashed), authentication events, IP address, user agent, actions taken in the interface, support tickets | You and your employer; generated by use |
| Merchant and prospect contacts | Name, job title, business contact details, company details, meeting notes, correspondence, contract and billing records | You, your employer, public professional sources, business-data providers |
| Partner and supplier contacts | Name, job title, business contact details, correspondence, contract records | You and your employer |
| Job applicants | CV, cover letter, contact details, right-to-work information, interview notes, references | You, recruiters, references |
4.1 We do not intentionally collect special categories of personal data (Article 9 GDPR) or data relating to criminal convictions. Do not send us such data. If we receive it unsolicited we will delete it unless a legal obligation requires retention.
4.2 Our services are for businesses. We do not knowingly collect personal data from anyone under 16. If you believe we have, contact us and we will delete it.
5. Why we use it and on what legal basis
| Purpose | Legal basis (Article 6 GDPR) |
|---|---|
| Operating, securing and improving the website and documentation | Legitimate interest (6(1)(f)) in running a secure, functional site; consent (6(1)(a)) for non-essential cookies |
| Responding to enquiries and requests for sandbox access | Pre-contractual steps at your request (6(1)(b)); legitimate interest in following up business enquiries |
| Providing sandbox and dashboard access, authentication and support | Contract (6(1)(b)) with the merchant; legitimate interest where you are the merchant’s employee |
| Contract management, invoicing, collections and accounting | Contract (6(1)(b)); legal obligation (6(1)(c)) under Dutch tax and accounting law |
| Business-to-business marketing to prospects and customers | Legitimate interest (6(1)(f)) in promoting our services to businesses, subject to your right to object; consent where required by the Dutch Telecommunications Act |
| Security monitoring, fraud and abuse prevention, incident response | Legitimate interest (6(1)(f)) in protecting our platform, merchants and their customers; legal obligation (6(1)(c)) for breach notification |
| Due diligence on counterparties, sanctions screening | Legal obligation (6(1)(c)) where applicable; legitimate interest in not dealing with sanctioned or fraudulent parties |
| Establishing, exercising or defending legal claims | Legitimate interest (6(1)(f)) |
| Recruitment | Pre-contractual steps (6(1)(b)); legitimate interest in assessing candidates; consent to retain a CV beyond the process |
| Corporate transactions, financing, audit | Legitimate interest (6(1)(f)) in operating and financing the business |
5.1 Where we rely on legitimate interest we have carried out a balancing test and concluded that our interest is not overridden by your rights. You may request a summary of the test and you may object under section 9.
5.2 We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Automated security controls may block a request or flag an account; any decision affecting your access is reviewed by a person.
6. Who receives your data
6.1 Processors acting for Altruon. Hosting and infrastructure, email and productivity tools, customer-relationship and sales-data tools, support and incident-management tools, analytics, e-signature and accounting providers. Each acts under a written data processing agreement. The current list of processors that touch merchant or platform data is published as the Altruon Sub-processor List; other suppliers are available on request.
6.2 Payment gateways and billing platforms. Where you are a merchant user, the gateways and billing platforms you connect receive data as you direct through the platform. They act as independent controllers or as your processors under your own agreements with them, not as Altruon’s sub-processors.
6.3 Professional advisers and insurers. Lawyers, accountants, auditors, insurers and brokers, under confidentiality obligations.
6.4 Authorities. Regulators, courts, law-enforcement and tax authorities where required by law or to protect Altruon’s rights.
6.5 Corporate transactions. A prospective or actual acquirer, investor, financer or successor, under confidentiality, in connection with a financing, merger, acquisition or reorganisation.
6.6 We do not sell personal data and we do not share it with third parties for their own marketing.
7. International transfers
7.1 Altruon stores and processes personal data in the European Economic Area. Our infrastructure runs in Amazon Web Services EU regions.
7.2 Some of our business tools are operated by providers headquartered outside the EEA. Where this involves a transfer of personal data to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914) supplemented by a transfer impact assessment, or on the EU-US Data Privacy Framework where the recipient is certified. Copies of the relevant safeguards are available on request from operations@altruon.io.
8. How long we keep it
| Data | Retention |
|---|---|
| Website analytics | Aggregated; identifiable data no longer than 14 months, or as set out in the Cookie Policy |
| Contact-form enquiries | 24 months from last contact, unless a business relationship follows |
| Sandbox accounts | Deleted 12 months after last login, or on request |
| Dashboard accounts and audit logs | Duration of the Merchant Agreement plus 12 months; security and audit logs 12 months |
| Contracts, invoices, correspondence supporting them | 7 years after the end of the financial year, as required by Dutch tax and company law |
| Marketing contacts | Until you object or unsubscribe, and reviewed every 24 months |
| Job applications | 4 weeks after the process ends, or 12 months with your consent |
| Data relating to a dispute or claim | Until the matter is finally resolved plus applicable limitation periods |
8.1 At the end of the retention period we delete or irreversibly anonymise the data. Backups are overwritten on a rolling schedule and data in backups is not restored except to recover from a failure.
9. Your rights
9.1 Under the GDPR you may ask us to: give you access to your personal data and a copy of it; correct inaccurate data; erase data; restrict processing; provide data you gave us in a portable format; and stop processing based on legitimate interest, including any direct marketing, which we will stop on request without exception.
9.2 Where processing is based on consent you may withdraw consent at any time; withdrawal does not affect processing that took place before it.
9.3 Send requests to operations@altruon.io. We may ask you to verify your identity. We respond within one month, extendable by two further months for complex requests, in which case we will tell you. Requests are free unless manifestly unfounded or excessive.
9.4 You have the right to lodge a complaint with a supervisory authority. Our lead authority is the Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, autoriteitpersoonsgegevens.nl. You may also complain to the authority in the EEA country where you live or work. We would appreciate the chance to resolve your concern first.
10. How we protect it
10.1 We apply technical and organisational measures appropriate to the risk, including encryption in transit (TLS 1.2 or higher) and at rest, credential vaulting, least-privilege access with multi-factor authentication for administrative access, environment separation with no production data in test, logging and monitoring, vulnerability management, code review, documented incident response, tested backups, confidentiality undertakings and training for everyone with access, and due diligence on sub-processors. A fuller description is in the Altruon Security Statement.
10.2 If a personal data breach occurs that is likely to result in a risk to individuals, we notify the Autoriteit Persoonsgegevens within 72 hours of becoming aware of it and, where the risk is high, the affected individuals without undue delay. Where we act as processor we notify the merchant without undue delay.
11. Cookies
11.1 Our use of cookies and similar technologies is described in the Altruon Cookie Policy. Non-essential cookies are set only with your consent, which you can change at any time through the cookie settings link in the footer of every page.
12. Changes
12.1 We may update this policy. The current version is always at altruon.io/privacy-policy with its effective date. Material changes are notified to registered users by email or in-app notice before they take effect. Previous versions are available on request.
13. Contact
Altruon B.V. · Molenpad 2, 1016 GM Amsterdam, the Netherlands · KvK 97816418 · VAT NL868244697B01 · operations@altruon.ioAltruon B.V. · Privacy Policy · Version 2.0 · Effective 1 September 2026