Privacy Policy

1. Who we are

Monsera Systems ("we", "us") is a digital agency and part of Monséra Group, based in the Netherlands. We build websites, planner systems, CRM and automation, cash counting and control systems, fulfilment systems and custom business software. We are the controller of the personal data described in this policy, which we collect through https://monserasystems.com, our business email and our own admin systems.

When we build or run a system for a client, we process the personal data in that system on the client's behalf as a processor. That is covered by a data processing agreement (see our Terms of Service). Questions about this policy or your data: infomonsera@gmail.com.

2. What personal data we process

• Enquiries: name, email address, phone number (optional), company, website, country, industry, a description of your needs and the solutions you selected. When you visit, we also keep where you came from (campaign tags, referrer, first page) for the duration of your browsing session so that we can see which channel brought you.
• Free website check: the web address you enter, the result of the check, and a pseudonymised (hashed) version of your IP address that we use only to limit abuse and automated use. If you ask us for the report or a call, also the name, company and contact details you give us.
• Business contacts: business name, business email address, phone number, website and public profile of companies we may offer our services to, and notes about our communication. We obtain these from public business sources or from you.
• Email correspondence: the messages you exchange with our business mailbox, including sender, recipient, subject, content and time.
• Technical data: IP address, browser type, requested pages and timestamps in the server logs of our hosting provider, used for security and operation of the website.
• Clients: contract, contact and invoicing data of our clients and their representatives; the answers and materials you give in onboarding forms (please never send passwords); and, when you sign a contract with us online, your name, role, place, email, your signature, the time, your IP address and browser details, and the signed document with a digital fingerprint (SHA-256) as proof.
• Payments: if you pay by direct debit (SEPA) or iDEAL, you enter your payment details with our payment provider Stripe, which processes them. We receive and store the payment status and references, not your full bank account or card number.

3. Google user data and Gmail

We use one dedicated company Gmail mailbox for business email. It is connected to our systems through Google OAuth (Gmail API, with the permissions to send email and to read email) and, for our team's AI assistants, through authorised connectors. We only access this company mailbox. We never access the mailboxes of visitors, prospects or clients.

How we use this data: (a) to send emails to business contacts on our behalf; (b) to read replies and related messages so that our team can see who replied, link the message to the right contact and continue the conversation. We store the messages that belong to these business conversations (sender, recipient, subject, text and time) in our own database to show the conversation history. OAuth tokens are stored encrypted.

Limited Use: Monsera Systems' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

• We use Google user data only to provide and improve the user-facing email features described above.
• We do not transfer Google user data to others, except as needed to provide those features, to comply with applicable law, for security or abuse investigation, or as part of a merger or acquisition with your prior consent.
• We do not use Google user data for advertising, including retargeting or personalised or interest-based advertising, and we do not sell it.
• We do not allow humans to read Google user data unless we have your affirmative agreement for specific messages, it is necessary for security purposes, it is needed to comply with law, or the data is aggregated and used for internal operations. Authorised members of our own team use the mailbox as its account holders.
• We do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models. Our AI assistants process mail content only to help our team read replies and draft responses.
• You can revoke our access at any time at https://myaccount.google.com/permissions, or by asking us. When access is revoked or the mailbox is disconnected, we stop accessing it and delete the stored tokens.

4. Why we process data, and our legal bases

We follow local rules for electronic marketing, including the Dutch Telecommunications Act and the Spanish LSSI. Where unsolicited commercial email is not allowed, such as to businesses in Spain, we do not send it; we use other channels or wait for you to contact us first.

• To answer your enquiry and prepare an offer (steps before a contract, Art. 6(1)(b) GDPR) and to perform a contract with you (Art. 6(1)(b)).
• To offer our services to businesses and to follow up on conversations (our legitimate interest, Art. 6(1)(f)). You can object at any time and we will then stop and add you to a suppression list.
• To run the free website check and protect our website against abuse (legitimate interest, Art. 6(1)(f)).
• Where we ask for it, with your consent (Art. 6(1)(a)), which you can withdraw at any time.
• To meet legal obligations such as tax and bookkeeping rules (Art. 6(1)(c)).

5. Who we share data with

We do not sell personal data. We share it only with carefully selected service providers (processors) that help us run our business, under agreements that protect your data:

• Hosting and delivery of this website (Vercel) and our database (Neon, EU region).
• Email: Google (Gmail) for our business mailbox and an email delivery service for system notifications.
• AI assistants that help our team draft and prioritise messages, as described above.
• Stripe for payments and direct debit; accounting and administration providers, and professional advisers where needed.
• Authorities, when we are legally required to.

6. Transfers outside the EEA

Some of our providers are located in or can access data from the United States. Where personal data leaves the European Economic Area we rely on an adequacy decision (for example the EU-US Data Privacy Framework) or on the European Commission's Standard Contractual Clauses, with additional safeguards where needed.

7. How long we keep data

• Enquiries, business contacts and the related email conversations: up to 24 months after our last contact, unless you become a client or ask us to delete them sooner.
• Website check results: up to 12 months.
• Suppression list (people and companies that asked us not to contact them): for as long as needed to respect that request.
• Client and invoicing records: for the duration of the contract and the legal retention period (7 years for tax records in the Netherlands).
• Server logs: a short period, typically up to 30 days.

8. Your rights under the GDPR (EU, EEA and UK)

You have the right to access your data, to have it corrected or erased, to restrict or object to its processing (including at any time to direct marketing), to data portability and to withdraw consent. Email us at infomonsera@gmail.com; we respond within one month. You can also lodge a complaint with a supervisory authority, such as the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), the Spanish Agencia Española de Protección de Datos (aepd.es) or the authority in your country.

9. Your privacy rights in the United States

This section applies to residents of California and of other US states with comprehensive privacy laws (for example Virginia, Colorado, Connecticut, Texas and Utah).

In the past 12 months we collected these categories: identifiers and contact details; commercial and professional information (company, industry, needs); internet and device activity (pages requested, hashed IP address); and the content of communications with us. We collect them from you, from public business sources and from our own systems, for the purposes in section 4. We disclose them for business purposes only to the service providers in section 5.

We do not sell personal information and we do not share it for cross-context behavioural advertising. We do not knowingly collect personal information of people under 16, and we do not intentionally collect sensitive personal information. We do not respond to or track browser "Do Not Track" signals because we do not track you across other websites.

You have the right to know what we collect and use, to access a copy, to correct and to delete your personal information, and to not be discriminated against for using these rights. Email infomonsera@gmail.com. We verify your identity before acting, respond within 45 days, and you may use an authorised agent. If we decline a request, you can appeal by replying to our answer.

10. Security

We protect personal data with technical and organisational measures: encrypted connections (HTTPS with HSTS), encrypted storage of access tokens, hashed passwords, role-based access for our team, limited access to the database, rate limiting, logging and monitoring of our systems, and the use of reputable processors. No system is completely secure. If a personal data breach affects you, we notify the supervisory authority within 72 hours where required and inform you where the law requires it.

11. Cookies

We do not use advertising or tracking cookies. See our Cookie Policy for the few functional items we use.

12. Automated decisions

We do not make decisions with legal or similarly significant effects by automated means. We use a simple internal score to prioritise enquiries, and AI assistants to support our team; people make the decisions.

13. Children

Our services are meant for businesses and are not directed at children. We do not knowingly collect data from children under 16 (and under 13 in the United States). If you think a child gave us data, contact us and we will delete it.

14. Changes to this policy

We may update this policy. The date at the top shows the latest version. For significant changes we will inform you in an appropriate way.

15. Contact

Monsera Systems, infomonsera@gmail.com.