Privacy Policy

01Who is responsible

The controller for the personal data described in this policy is Valck Engine, a sole proprietorship (eenmanszaak) trading as Nexfield, based in Roermond, the Netherlands. Chamber of Commerce (KvK): 42136717. VAT ID: NL005525568B18.

For any privacy question or request, email info@nexfield.io. We reply within one business day.

02What data we process and why

Valck accounts. When you or your company create a Valck account, we process your name, email address, company and role, plus your login details. We use this to create and secure your account, provide Valck and contact you about the service. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Account data is stored with Supabase in the EU (Frankfurt, Germany).

Orders and order forms. To process an order, we collect your name, company name, email address and order specifications, partly through order forms hosted by Tally. We use this exclusively to produce and deliver the order, send the invoice and, unless you object, for occasional service-related communication. Legal basis: performance of a contract and our legal (tax) obligations (Art. 6(1)(b) and (c) GDPR).

Questions and emails. If you email us, we process your message and contact details to answer you. Legal basis: our legitimate interest in responding (Art. 6(1)(f) GDPR).

Prospect lists. For our prospect lists, we research companies and, where relevant, business contact details of people in their professional role (for example name, job title, company and business contact details) from publicly available sources such as company websites, public registers and news. We use this to compile B2B prospect lists for our customers. Legal basis: our and our customers' legitimate interest in business-to-business prospecting (Art. 6(1)(f) GDPR). We do not use sensitive data. If you appear in our data, you can object at any time and ask us to remove you: email info@nexfield.io and we will stop processing your data and exclude you from future lists.

03Cookies and analytics

Nexfield uses Google Analytics to measure visits to this website. It only sets analytics cookies after you click Accept in the cookie banner; if you click Decline, no analytics cookies are set. Advertising cookies are not used. Your choice is stored in your browser and can be reset by clearing this site's data. Legal basis for analytics: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. Logging in to Valck uses storage that is strictly necessary to keep you signed in.

04Valck and your CRM data

When Valck works in your company's CRM, your company is the controller of that CRM data and Nexfield processes it only as a processor, on your company's behalf and instructions, and only on the records assigned to the employee Valck works for. A data processing agreement (DPA) is available on request via info@nexfield.io.

Chats between an employee and Valck are private: managers never see those chats.

05Service providers we use

We never sell or share your data with third parties for their own purposes. We use the following providers to run our services; they process personal data only on our instructions:

• Supabase: Valck account database and login (EU, Frankfurt)
• Netlify: website hosting
• Render: hosting of Valck application services
• Tally: order and contact forms
• Make: workflow automation for orders and onboarding
• xAI: AI processing that powers Valck and our research
• HubSpot: customer relationship management for our own customers and contacts
• Google Analytics: website statistics, only after your consent

06International transfers

Some of these providers are based outside the European Economic Area or may access data from outside it, for example in the United States. Where that happens, we rely on an adequacy decision (such as the EU-U.S. Data Privacy Framework, where the provider is certified) or on the European Commission's Standard Contractual Clauses (SCCs), together with additional safeguards where needed.

07How long we keep data

• Valck account data: as long as your account is active; we delete it after the account is closed or on request, unless we must keep it by law.
• Order and invoice data: no longer than necessary, and for the period required by Dutch tax law (currently seven years for invoicing records).
• Emails and questions: as long as needed to handle your question and any follow-up.
• Prospect data: as long as it is relevant for prospect lists; removed promptly if you object.
• Cookie choice: stored in your browser until you clear this site's data.

08Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you
• have inaccurate data rectified
• have your data erased
• object to processing based on legitimate interest, including prospecting
• restrict processing
• receive your data in a portable format (data portability)
• withdraw consent at any time, without affecting earlier processing

Send your request to info@nexfield.io. We respond within one month. You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens.

09Security

We protect personal data with appropriate technical and organisational measures, including encrypted connections, access controls and storing Valck account data in the EU.

10Changes to this policy

We may update this policy. The date at the top shows the latest version. Material changes will be announced on this page.

11Contact