Privacy Policy

1. Data Controller

Legal entity	Trade8 B.V.
Trading as	Import8
Address	Euvelgunnerweg 25a, 9723 CV Groningen, the Netherlands
Chamber of Commerce	99745720
VAT number	NL869115583B01
Email	info@trade8.nl

Trade8 B.V. ("we", "us", "our") is the data controller for the personal data processed through the Import8 platform (the "Service"). This Privacy Policy explains what data we collect, why, and how we protect it.

2. What Data We Collect

We collect the following categories of personal data:

2.1 Account Data

When you register, we collect: name, email address, company name, and password (stored hashed). This data is necessary for account creation and Service delivery (Article 6(1)(b) GDPR — performance of a contract).

2.2 Product Data (Classification Input)

When you submit a classification request, we process: product descriptions, product images, and any additional product details you provide. Product data is processed for the purpose of delivering the classification service (Article 6(1)(b) GDPR). Product data may contain personal data only incidentally (e.g., a sender name in a product description); we do not intentionally collect personal data through classification inputs.

2.3 Usage and Technical Data

We automatically collect: IP address, browser type, pages visited, API usage metrics, classification volumes, and error logs. This processing is based on our legitimate interest (Article 6(1)(f) GDPR) in maintaining and improving the Service.

2.4 Payment Data

Payment details (credit card numbers, billing address) are processed by our payment provider Stripe and are not stored on our servers. See Stripe's Privacy Policy.

3. How We Use Your Data

Purpose	Legal Basis
Providing the classification service	Contract (Art. 6(1)(b))
Account management and billing	Contract (Art. 6(1)(b))
System improvement using anonymized data	Legitimate interest (Art. 6(1)(f))
Security monitoring and fraud prevention	Legitimate interest (Art. 6(1)(f))
Service notifications and updates	Legitimate interest (Art. 6(1)(f))
Legal compliance (e.g., tax records)	Legal obligation (Art. 6(1)(c))

4. Third-Party Processors

We share personal data with the following categories of processors, all bound by data processing agreements:

Processor	Purpose	Location	Safeguards
Anthropic	AI classification processing	United States	SCCs + DPA
Stripe	Payment processing	United States	SCCs + DPA
TransIP (team.blue)	Hosting and infrastructure	Netherlands	DPA

Anthropic processes product descriptions and images solely for classification on our behalf. Anthropic does not use this data for its own model training. Data sent to Anthropic is not retained by them beyond the processing window.

5. International Data Transfers

Some of our processors are based outside the European Economic Area (EEA), specifically in the United States. These transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring an adequate level of data protection in accordance with GDPR Chapter V.

6. Data Retention

Data Category	Retention Period
Account data	Duration of account + 12 months
Classification results and product data	Duration of account + 12 months
API and usage logs	12 months (rolling)
Billing records	7 years (Dutch tax law)
Security and error logs	6 months

7. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Access (Art. 15) — request a copy of the personal data we hold about you
• Rectification (Art. 16) — correct inaccurate or incomplete data
• Erasure (Art. 17) — request deletion of your personal data
• Restriction (Art. 18) — request restricted processing in certain circumstances
• Data portability (Art. 20) — receive your data in a structured, machine-readable format
• Objection (Art. 21) — object to processing based on legitimate interest

To exercise any of these rights, contact us at info@trade8.nl. We will respond within 30 days.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

8. Cookies

The Service uses only essential cookies required for authentication and session management. We do not use tracking cookies, analytics cookies, or third-party advertising cookies. No cookie consent banner is required as these cookies are strictly necessary for the Service to function (Article 5(3) ePrivacy Directive).

9. Security

We implement appropriate technical and organizational measures to protect your personal data, including: encrypted data transmission (TLS), hashed passwords, API key hashing (SHA-256), access controls, and regular security reviews. Despite these measures, no system is completely secure. If we become aware of a data breach that affects your rights, we will notify you and the supervisory authority in accordance with GDPR Articles 33 and 34.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through the Service at least thirty (30) days before they take effect.

11. Contact

For privacy-related questions or to exercise your rights, contact us at info@trade8.nl.