Privacy statement

1Who we are

Netslim provides hosting, domain names, servers, cybersecurity and related services. We are responsible for processing the personal data described in this statement.

• Netslim, Terveurdtweg 119, 6431VT Hoensbroek
• Chamber of Commerce number: 73638463
• Email: info@netslim.nl
• Phone: 0853695993

Do you have a question about your privacy? Email us, or send a message from your account.

2Which data we process and why

We only process what is needed. Per purpose:

Your account and orders

Name, company name, address, email address, phone number, VAT and KvK number, password (stored encrypted), your orders, services, domains and invoices. Why: to carry out the agreement with you and to be able to invoice you. Legal basis: performance of the agreement and the legal obligation to keep records.

Domain names

The details of the domain holder. Why: registries require us to pass on these details. Legal basis: performance of the agreement and the rules of the registry.

Payments

Payment status, payment method and, for direct debit, a mandate. We do not receive your full bank account or card details. Mollie processes those. Legal basis: performance of the agreement.

Contact, messages and support

Messages via the contact form, your account, email, chat or WhatsApp, including attachments you send. If we help you with remote support (TeamViewer QuickSupport), we only look along after you give us the ID and password. Legal basis: performance of the agreement or our legitimate interest in answering your question.

Last active in your account

When you are logged in, we remember when you were last active and which part of your account you were viewing (for example Invoices). We only keep that last moment, no history and no IP address. Why: so we can see that you are there and can help you faster. Legal basis: our legitimate interest in good customer service.

Security of your account

IP address, browser details and login times, and, for two-step verification, an encrypted key or temporary codes. Why: to prevent abuse and to show you which devices you are logged in on. Legal basis: legitimate interest (security).

Preventing fraud

If someone orders with a stolen payment card, or with false or someone else's details, we block that person and create a file. It contains the account details, the IP address and device used for the order and the login, the order itself, and the payment attempts, with what our payment provider passes on about them (country and last four digits of the card, reason for refusal). New attempts with the same details are refused. We inform the person by email. We share the file only with the police (to report the crime) and with our payment provider, not with other companies. Legal basis: legitimate interest (preventing fraud, limiting damage, supporting a police report). Retention: file 5 years, IP address block 90 days. You can object via info@netslim.nl. A staff member will then review the file. See also our fraud policy.

Website check

The address of the website you want checked and, if you want the full report, your email address. We only check publicly visible information on that website. Legal basis: your request and our legitimate interest.

Invoice tool

Your company details and the details of your customers that you enter in the invoice tool. You are responsible for your customers' details and we are the processor (see the data processing agreement). Legal basis: performance of the agreement.

Newsletter and tips

Your email address, only if you sign up yourself and confirm it via the link in your email. You can unsubscribe at any time via the link at the bottom of every email. Legal basis: consent.

Cart

If you are logged in and do not complete an order, we temporarily keep the contents of your cart so you can continue later. We only send a reminder if you have given consent for it. Legal basis: legitimate interest and, for the reminder, consent.

Cookies

We always use necessary cookies. We only use statistics and marketing cookies with your consent. More about this in the cookie statement.

3 integration

If you use our plugin Netslim Exact Online integration, the connection between your webshop and your Exact Online administration runs via the Netslim server. This way, no Exact keys are stored on your own website. This is what happens:

• What we store: your license (code, plan, validity), the domain name and type (live or staging) of the websites where you activate the license, the plugin version, when that site last made contact, the selected Exact administration and the name of the Exact user who created the connection. We store the access to Exact (tokens) and your website's secret encrypted.
• What we pass on but do not store: orders, customer data (such as the name, address and email address of your customers), products, prices and stock go from your web shop through our server directly to Exact Online, or the other way around. We do not store this data in transit. Only the regular server logs (time, IP address of your website and which address was called) are kept for a maximum of 90 days, as with the rest of our website.
• What the connection can do: only the functions that belong to a web shop, such as creating sales orders and relations and reading products, prices and stock. Deleting in Exact is not possible. A staging site never sends data to Exact.
• Roles: you are responsible for your customers' data and Netslim is the processor (see the data processing agreement). Exact Online is your own supplier. Your agreements with Exact apply to that.
• Stopping: if you disconnect a website (in your account or in the plugin) or break the connection with Exact in the plugin, we delete that site's Exact access straight away. You can also always revoke the access in Exact Online itself. License data is part of your administration and we keep it for 7 years.

Legal basis: performance of the contract (the connection only works this way), and for your customers' data, the data processing agreement.

4Netslim Edge and Edge SEO

Our website, and the websites of customers who use Edge SEO with us, run through Netslim Edge: our own servers in Germany that sit in front of the web server, like a CDN. These servers deliver the pages, briefly keep static files such as images in their memory and apply agreed SEO improvements.

• What we record: visits from search engines and AI crawlers (such as Googlebot, Bingbot and GPTBot), and error messages (such as a page that does not exist) from regular visitors. Per line: time, page address, status code, the name of the crawler or the browser version, and a shortened IP address (the last part is set to 0). We also count how many requests there were per hour, without IP addresses.
• What we do not record: no full IP addresses, no values from the address bar (from ?email=… we only store the name email), no form content and no data from logged-in visitors. No access logs with full IP addresses are running.
• Security (Edge Shield): to stop attacks and abuse, the edge briefly keeps track per IP address of how many requests come in. This is only in working memory and is gone after two minutes at most. During an attack, a visitor may get a short browser check. We then place the functional cookies __nsl_ok and __nsl_pow (24 hours, only to remember that the check succeeded). No consent is needed for this.
• SEO overview per page: for public pages we record the title, description, headings and word count. This is not personal data. We skip pages of logged-in visitors.
• AI assistant (optional): if a customer turns on the SEO assistant, we send the public text and the address of a page to the AI service the customer chooses themselves (Anthropic, OpenAI or Google), using the customer's own API key. No personal data of visitors is sent along. The customer is responsible for that choice. We store the key encrypted.
• Google Search Console (optional): if a customer connects their Search Console via Connect with Google, we only get read access (scope webmasters.readonly). We read the list of websites in that account and, per website, the clicks, impressions, click-through rate and positions per page and search term. We only use this to show the customer their results and reports in their own account. We do not sell it, do not use it for advertising and do not share it with anyone. We store the access encrypted. With Disconnect we revoke it at Google straight away. The customer can also revoke the access themselves at myaccount.google.com/permissions. Netslim's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Why: to see how search engines visit a website, to find errors and to keep the website safe, fast and available.
• How long: individual visits 60 days, SEO overview per page 60 days after the last visit, AI suggestions 1 years, hourly totals (without IP addresses) 2 years.
• Roles: we are responsible for our own website. For the websites of customers using Edge SEO, the customer is responsible and Netslim is the processor (see the data processing agreement).

Legal basis: our legitimate interest in a secure, fast and findable website. For customers, the performance of the contract.

Netslim Speed (our plugin for making websites faster) runs entirely on the customer's server. We only receive what we need for the license and updates: the license code, the domain name, the plugin version and when the site last made contact.

5Who we share data with

We never sell your data. We only share it with parties we need to deliver our services, and with whom we have made agreements about its security and use:

We may also share data if the law requires it, for example with the Dutch Tax Authority or after a court order.

6Transfers outside the EU

Most data stays within the European Economic Area. Where a party is based outside the EEA (such as Anthropic for the chat assistant), this happens on the basis of an adequacy decision by the European Commission (such as the EU-US Data Privacy Framework) or with the European Commission's standard contractual clauses.

7How long we keep data

• Invoices and accounting records: 7 years, because the law requires it.
• Your account: for as long as you are a customer. After that, we delete or anonymise your account, except for what we have to keep for our accounting records.
• Hosting data (websites, databases, email): until the end of the service. After that, we delete it.
• Messages and support conversations: for as long as you are a customer, or up to 2 years after the last contact.
• Log files and login sessions: up to 90 days.
• Fraud files: 5 years; the block on an IP address 90 days.
• Exact Online integration: the encrypted access to Exact until you disconnect the site or break the connection. We do not store order or customer data.
• Netslim Edge: crawler visits and error messages (with shortened IP address) 60 days, hourly totals without IP addresses 2 years.
• Abandoned carts: up to 30 days.
• Newsletter: until you unsubscribe.
• Cookie consent: we keep the record of your choice for up to 1 years.

8Security

Security is our trade. We take appropriate technical and organisational measures, such as encrypted connections (HTTPS), encrypted storage of passwords and 2FA keys, two-step verification for accounts, regular updates and backups, access only for those who need it, and monitoring for abuse. If you notice anything suspicious, let us know right away at info@netslim.nl.

9Your rights

You have the right to access, correct or delete your data, to object to or restrict processing, and to receive your data in a common format (data portability). If you gave consent, you can withdraw it at any time.

You can change a lot of data yourself in your account. For anything else, send a request to info@netslim.nl. We reply within one month. To prevent abuse, we may ask you to identify yourself.

If you are not happy with how we handle your data, we would like to hear it. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

10Automated decisions

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you. Our system does automatically send invoices, reminders and notifications, and it can suspend a service if an invoice stays unpaid for a long time, as stated in the terms and conditions. Contact us if you disagree. A person will then look at it.

11Changes

We update this privacy statement when our services or the law change. The date at the top shows when the latest version was published. For major changes, we let you know through your account or by email.