Privacy Policy | GDPR by Construction

Autoriteit Persoonsgegevens. Web: autoriteitpersoonsgegevens.nl. Privacy line: +31 88 1805 250 (Mon to Thu, 10:00 to 12:00). General: +31 70 888 8500 (weekdays, 09:00 to 13:00). Postal: Postbus 93374, 2509 AJ Den Haag.

Contact us first at privacy@dweve.com. Dweve will acknowledge within 48 hours. Investigation completed within 30 days. Written response with resolution. Appeal process is available if you are unsatisfied.

Privacy rights: privacy@dweve.com. Data breaches: security@dweve.com (24/7). GDPR compliance: compliance@dweve.com. Legal matters: legal@dweve.com. General support: support@dweve.com.

Dweve B.V., DPO. Email: dpo@dweve.com. Phone: +31 (0)85 0041 022. Postal: Dweve B.V., The Stack, Jacob Bontiusplaats 9, 1018 LL Amsterdam. KVK: 98215043.

Write to the Dweve Data Protection Officer. You also have the unconditional right to lodge a complaint with the Dutch supervisory authority, without contacting us first.

Questions, rights requests, and complaints.

Review changes before the effective date. Object to specific changes by contacting privacy@dweve.com. Export your data. Close your account without penalty before the change takes effect. Existing agreements may be grandfathered for their current term.

Minor changes: dashboard notification. Material changes: email 30 days before the effective date. Critical changes (those that materially reduce your rights or protections): explicit re-consent required before the change takes effect.

This policy is updated when legal or regulatory requirements change, when new features or services are added, when security enhancements require revised disclosures, and on an annual review at minimum. Version history is always available online.

Dweve does not knowingly collect data from, or direct marketing to, anyone under 18.

Where an approved educational institution manages student accounts: the institution carries GDPR controller responsibilities for student data, data collection is limited to what the institution authorises, no behavioural profiling applies, and enhanced privacy controls are active.

The account will be suspended immediately. A parent or guardian will be notified. Data will be deleted within 48 hours. No data will be retained or used for any processing purpose.

If Dweve discovers a minor’s data.

Dweve services are designed for professional use by adults. The minimum age is 18 years. Business accounts require legal capacity to contract. Educational-institution accounts are managed by the institution under a separate addendum, with parental consent handled at institution level.

Dedicated support during the period following notification. Regular updates on the investigation and remediation. Transparent reporting on improvements made. Compensation per applicable law.

The nature of the breach and the categories of data affected. The likely consequences and risks to your rights. The measures taken or proposed to address the breach. Recommendations for protective actions you can take. Contact information for questions.

Supervisory authority (AP): within 72 hours of detection where risk threshold is met (GDPR Art. 33). Affected data subjects: without undue delay where high risk to rights and freedoms is established (GDPR Art. 34). Partners: per contractual obligations.

24/7 automated security monitoring. Immediate incident response team activation on detection. Containment targeted within 4 hours. Forensic analysis and scope determination. Law enforcement cooperation where required.

In the event of a personal data breach, Dweve follows documented procedures to contain the incident, notify the relevant authority, and, where required, inform affected data subjects. GDPR Article 33 requires notification to the Autoriteit Persoonsgegevens within 72 hours of becoming aware of a breach likely to result in a risk to the rights and freedoms of individuals.

Transparency in AI decision-making processes. Human oversight requirements for high-risk AI applications are documented and passed to deploying customers. Bias monitoring, fairness assessments, and regular AI impact assessments are part of the release process. Documentation of AI system capabilities and limitations is published with each Loom release.

Data is stored and processed in Europe. Dweve's subprocessors are Cloudflare, Mollie, Brevo and Finovion.

Customer data is processed only for the contracted service and the instructions you provide. Retention and deletion depend on the service path, stated purpose, user actions and legal obligations; this notice does not promise automatic deletion.

The platform learns mathematical patterns (binary constraints), not personal information. These constraints contain zero personal data; they are pure mathematical discoveries that improve AI efficiency.

Dweve never uses your data to train its AI models. Your data is processed only when you explicitly instruct the system.

Dweve’s AI architecture is designed so that privacy is structural, not procedural. The platform learns from mathematical constraints discovered during processing, not from your personal data.

24/7 security monitoring and incident response. Regular penetration testing and vulnerability assessments. Employee security training. EU compliance frameworks (GDPR, NIS2, DORA, CRA). Secure development lifecycle.

Access controls and reviews, multi-factor authentication, constraint separation, and an operational process for data-subject requests. This notice does not promise automated deletion.

Post-quantum cryptographic algorithms for future-proof security. TLS 1.3 with quantum-resistant ciphers for data in transit. Hardware security modules (HSM) with PQC support. All stored data uses post-quantum cryptographic protection.

Encryption in transit with TLS 1.3 and forward secrecy. Encryption at rest with AES-256 and post-quantum-ready key hierarchies. Role-based access control, least-privilege service accounts, hardware-backed secret storage, and continuous audit logging. Quarterly penetration testing, continuous dependency scanning, and automated vulnerability management. For the full controls matrix, SSDLC, incident-response posture, and vulnerability-disclosure policy, see the dedicated security page.

Manage preferences in Account Settings. Browser controls are always respected. Detailed cookie list available on request.

Persona, language, and view-mode selection so the site does not re-ask on every visit. Cleared when you sign out or reset preferences.

Dweve runs no separate analytics tool. Cloudflare may still provide aggregate traffic and security statistics through its edge service.

No separate analytics tool; aggregate traffic and security statistics from Cloudflare's edge service.

Session authentication, CSRF tokens, load balancing, language and accessibility preferences. Not subject to consent under ePrivacy Art. 5(3).

Dweve uses only the storage needed to keep sessions secure and remember choices made on the site. Dweve runs no separate analytics tool. No third-party advertising trackers, cross-site fingerprinting, Google Analytics, Plausible, social-media pixels or supercookies are used.

Necessary storage plus optional categories.

Email: privacy@dweve.com. Response SLA: 30 days, extendable by 60 if complex. Identity verification: proportionate, minimum data. Cost: free for reasonable requests. Withdraw consent: Account → Privacy → Consent. Appeal: AP (Autoriteit Persoonsgegevens).

Object to processing based on legitimate interest. Unconditional opt-out from direct marketing, honoured on first request.

Export of your personal data in a structured, commonly used, machine-readable format. Direct controller-to-controller transfer where technically feasible.

Where you contest accuracy, processing is restricted pending verification, without terminating account access.

“Right to be forgotten.” Dweve assesses erasure requests against the purpose for which data was collected and any legal obligations. Some records may need to remain for a statutory or legal period; this notice does not promise cryptographic deletion or a fixed backup window.

Correction of inaccurate data and completion of incomplete data. In most cases, self-service through the account dashboard.

A copy of the personal data Dweve holds about you, plus the purposes, categories, recipients, retention, and the source where it was not collected from you.

As a data subject in the EU/EEA you have the rights set out in GDPR Articles 15 to 22. Dweve responds within one calendar month from the moment identity is verified. The request itself is free; manifestly unfounded or excessive repeat requests may be refused or charged.

Cloudflare: Content delivery network, edge security and parts of the website and form infrastructure. Mollie: Payments. Brevo: Transactional email and form notifications. Finovion: Accounting, payroll administration and legal and administrative support. Dweve issues its own invoices and sends them to Finovion for bookkeeping.

Data is stored and processed in Europe. Cloudflare: Content delivery network, edge security and parts of the website and form infrastructure.

Operational process; no automatic deletion promise

Purpose/legal-obligation based; exact window not stated here

Personal data is kept only as long as needed for the purpose for which it was collected or as required by law. Exact operational windows differ by record and are not all published here. You can ask privacy@dweve.com about the applicable period and request access, correction or deletion, subject to legal exceptions.

Detecting and preventing fraudulent activity, monitoring for security threats, ensuring compliance with terms of service, responding to legal requests and obligations, and protecting intellectual property rights.

Binary constraints (mathematical rules and patterns) discovered during AI processing contain no personal data; they are pure mathematical discoveries that make AI more efficient. Platform performance patterns are analysed in aggregated, anonymised form to enhance reliability. No personal data is retained after processing for this purpose.

Dweve never uses your personal data to train its AI models. Your data is processed only when you explicitly put it into the system for your own purposes. What our systems learn from is mathematical constraints discovered during processing, not your personal information.

Providing access to the Dweve platform and APIs; processing your AI workloads only when you explicitly instruct us (via prompts, training requests, or fine-tuning); temporarily storing data in encrypted form during active service usage; delivering technical support; managing your account and billing; sending service-related notifications.

Dweve does not sell, rent, or trade your personal data. Data is used for the purposes stated at collection and no others. Three purpose groups apply across the platform.

Dweve operates models; the customer operates decisions. Human oversight requirements under EU AI Act Annex III rest with the deploying party, with Dweve providing the technical substrate and constraint trace.

Dweve does not knowingly accept GDPR Article 9 special-category data in the Dweve managed service (via Fabric) unless the applicable agreement and data-processing terms expressly permit it. Customers requiring direct control for such data use an appropriately scoped licensed deployment under their own controllership.

Tax and invoicing records, EU AI Act transparency documentation, security-incident and breach reporting under GDPR Art. 33/34, court and law-enforcement orders valid under EU law.

Marketing emails, newsletter subscriptions, non-essential cookies, beta-programme participation. Explicit, granular, logged, and withdrawable without detriment.

Security monitoring, fraud prevention, platform reliability, capacity planning, and product improvement on pseudonymised or aggregated data. Balancing test on file.

Account provisioning, service delivery, technical support, billing, service-related notifications. Without these, the contract cannot be performed.

The grounds below describe common platform contexts; the applicable ground for a specific form may be stated at collection or in the applicable agreement. Where processing rests on consent, that consent is granular, freely given and withdrawable.

Platform usage analytics, performance monitoring, security logging, and error tracking and diagnostics. Automatic collection is bounded to the categories described in § 01 and the technical details needed to secure and operate the site; new purposes are disclosed through a policy update where required.

Account registration, contact and commercial-intake forms, support requests, pre-order and launch-pricing forms, job applications, voluntary surveys and feedback, and platform configuration settings. You choose what you share; the minimum required for each purpose is described in the data inventory above.

Data reaches Dweve through what you provide directly in accounts and forms, and what the platform records automatically during operation. Nothing is purchased from data brokers or inferred from third-party sources.

Collection methods, direct and automatic.

IP address for security and localisation, browser and device metadata, network performance data, and security event logs. Rolling retention; older entries hashed or deleted on schedule.

Session cookies for authentication and CSRF, plus local language, audience and accessibility preferences. Dweve sets no advertising cookies.

Invoices, VAT identifiers, bank details, payment-processor transaction IDs, credit notes. Required by Dutch and EU tax law; retained on a statutory seven-year schedule under encryption.

Tickets, call recordings (opt-in, announced), chat transcripts, feedback, and voluntary survey responses. Retained for the lifetime of the ticket plus a short post-closure window.

Feature usage, API call volumes and latency, model performance metrics, session duration and frequency. Pseudonymised by account ID, aggregated for operations and capacity planning.

Name, professional title, business email, company, industry, country, optional phone and account identifiers. Collected directly from you to provision and support an account, communicate about the service and handle billing where applicable.

Category 07, Contact and commercial requests.

Name, email, phone, organisation, role, country, message and scoped request details. Used to route and answer questions, assess commercial or technical briefs, handle trust cases and communicate about the request. Records are stored in Dweve-managed form systems; notification messages may be sent through Brevo.

Category 08, Pre-orders and launch-pricing orders.

Name, email, company or organisation type, use-case selections, team size, current AI use and specific needs. Used to manage pre-order or launch-pricing interest and send requested service or newsletter communications. Pre-order records use Dweve-managed form systems; launch-pricing order payment processing uses Mollie.

Name, contact details, location, profile links, CV or resume, cover letter, experience, salary expectation, availability, relocation preference and free-text answers. Used to assess and communicate about recruitment. Application records use Dweve-managed form systems, CV files use configured object storage and notifications may be sent through Brevo.

Dweve collects the data needed for the stated service, contact, pre-order, launch-pricing order, recruitment, legal and security purposes. The categories below describe the main personal-data surface Dweve B.V. processes as controller on this site and through these forms; other categories may apply under a separate account, contract or deployment. No biometrics, location tracking or social-media monitoring is intended by these forms, and customer content is not used for secondary model training.

GDPR by construction. Auditable by design.

Purpose or legal obligation; exact operational window not stated here

Managing pre-order or requested launch-pricing order/newsletter communication

Assessing and communicating about an application