Privacy & GDPR Policy

Last updated: 27 September 2026
Version: 3.0
Effective: 27 September 2026
Jurisdiction: Netherlands & EU/EEA
GDPR Compliant by Design

How to Read This Policy

The universal sections (1–5, 8–18) apply to everyone — visitors, registered users, and customers across all AdMun platforms.
Section 6 (Product-Specific Data) and Section 7 (Connected Platforms) apply only to the specific products or integrations you actually use. If you never use a given service, its data handling never applies to you.

Table of Contents

1. Who We Are
2. Our Products & Scope
3. Information We Collect
4. How & Why We Use It
5. Marketing & Communications
6. Product-Specific Data Handling
7. Connected Platforms & Social Integrations
8. Third-Party Data Sharing
9. Sensitive & Special Category Data
10. AI & Automated Processing
11. Data Retention
12. International Data Transfers
13. Cookies & Tracking Technologies
14. Your Rights & Data Requests
15. Children's Privacy
16. Security & Data Breaches
17. Changes to This Policy
18. Governing Law, Jurisdiction & Contact

1. Who We Are

AdMun (also operating as NetherlandsIT, AdMun EU, NLIT, NLEBIKE, Rational HRM) is a technology company registered in the Netherlands. We build a family of digital products across several industries, all governed by this single, unified privacy policy.

Related Entities:
- Rational HRM B.V. (KVK 87654321) — Operator of Rational HRM platform (nlit.io)
- NLEBIKE — Trading name for e-commerce webshop (nlebike.com)

Controller vs Processor Roles

2. Our Products & Scope

This website is the central hub for the AdMun product family. One policy covers them all, but each product only collects what it needs.

Current Product Portfolio

Product Stages

3. Information We Collect

We collect only what is relevant to the service you use. The categories below are the maximum range across all products; any single product uses a subset.

3.1 Information You Provide

3.2 Information Collected Automatically

3.3 Information from Third Parties

Data Minimisation

We do not store sensitive identifiers (BSN, IBAN, ID document numbers) in plain text in general databases. Where a regulated product genuinely requires them (Rational HRM payroll), they are:
- Encrypted with AES-256 at rest
- Handled only by certified specialist processors
- Never used for marketing or AI training
- Subject to strict access controls (Section 9)

4. How & Why We Use Your Information

We process personal data on these legal bases under GDPR Art. 6:

Purpose Mapping by Product

5. Marketing & Communications

With an appropriate legal basis (your explicit consent, or our legitimate interest where you are an existing customer — "soft opt-in" under Telecommunicatiewet Art. 11.7), we may use your name, email, phone, and general usage profile to send:

• Service announcements & product updates
• Newsletters & industry insights
• Relevant offers & promotional content
• Event invitations (webinars, demos)
• Retargeted advertising (via marketing cookies — see Cookie Policy)

Your Control

Opting out never affects your access to services.

6. Product-Specific Data Handling

The following applies only if and when you use the relevant product.

6.1 IT Services & Consulting (NetherlandsIT / AdMun Core)

6.2 Rational HRM (nlit.io) — HR & Administration

Critical: Rational HRM customers (staffing agencies/employers) are Controllers for worker data. AdMun/Rational HRM B.V. acts as Processor under a signed Data Processing Agreement (DPA). Workers' rights requests must be directed to the Controller (the agency/employer), who will instruct us as Processor.

6.3 NLEBIKE (nlebike.com) — E-Commerce

Payments: We never store full card numbers. All payments processed by PCI-DSS Level 1 certified providers (Mollie, Stripe, PayPal, etc.). Crypto/USDC payments via Coinbase Commerce — no sensitive financial data stored.

7. Connected Platforms & Social Integrations

Some products let you connect a third-party account so we can perform actions you request (e.g., publish a job posting, sync contacts, import product catalog). Only platforms you connect apply.

Common to Every Integration

• We request only the minimum scopes a feature needs
• We act strictly on your instructions
• We never sell connected-platform data
• We keep it only as long as needed and within each platform's limits
• You can disconnect at any time — we delete tokens and cached data within 30 days
• Each platform's own privacy terms also apply to your account with them

8. Third-Party Data Sharing

We share data only where necessary, with providers bound by DPAs under Art. 28:

We Never

• Sell your personal data
• Share data with advertisers without your consent (marketing cookies)
• Use sensitive data (health, BSN, IBAN) for analytics or AI training

Required Disclosures

We may disclose data to competent authorities where required by law or court order (KVK, Belastingdienst, Arbeidsinspectie, AP, ACM, police). Personal data may transfer to a successor entity in a merger/acquisition, subject to equivalent protection.

9. Sensitive & Special Category Data

Strict Handling Protocols

Technical Measures (Art. 32)

• Encryption: AES-256 at rest, TLS 1.3 in transit
• Access Control: Role-based (RBAC), principle of least privilege, MFA for admin
• Audit Logging: Immutable logs for all sensitive data access
• Data Minimisation: Automated purging per retention schedules
• Penetration Testing: Annual third-party pen tests, quarterly vulnerability scans

10. AI & Automated Processing

AI Features Across Products

Your Rights Regarding Automated Decisions

Where an automated decision would have a significant legal effect (e.g., VBAR classification affecting employment status), you have the right not to be subject to it on a solely automated basis (Art. 22) and may request human review.

• Rational HRM: Workers can request human review of AI classification → routed to two-key approval (audit-logged)
• NLEBIKE: No automated decisions with legal effect
• AdMun Core: AI output is advisory only (see Terms §10)

AI Training Principles

1. Anonymisation first: We use anonymised or aggregated data wherever possible
2. Special category exclusion: Health, BSN, IBAN, biometrics excluded from model training
3. Purpose limitation: Training only for improving our own services
4. No third-party training: We do not provide data to external model providers (OpenAI, Anthropic, etc.) for their training

11. Data Retention

We keep personal data only as long as needed, then delete or anonymise it.

Legal holds override: If data is subject to litigation, regulatory investigation, or audit, retention extends until the hold is lifted.

12. International Data Transfers

Primary Principle

We primarily process and host data within the EU/EEA (Google Cloud EU-West, AWS EU-Central, Azure NL).

Transfers Outside EEA

Where a service or connected platform involves transfer outside the EEA (e.g., US-based social providers, Shopify CDN, certain AI APIs), we rely on appropriate safeguards under GDPR Chapter V:

US Transfers Post-Schrems II

For US providers, we:
- Use SCCs (2021 version) + Supplementary Measures (encryption in transit/at rest, access controls, transparency reports)
- Monitor US surveillance law developments (EO 14086, EU-US Data Privacy Framework)
- Prefer EU-hosted alternatives where functionally equivalent

13. Cookies & Tracking Technologies

We use cookies governed by Telecommunicatiewet Art. 11.7a and GDPR Art. 5.

Summary by Category

Manage preferences: Cookie Preference Centre in footer. Withdrawing consent doesn't affect prior lawful processing.

Full details: See our dedicated Cookie Policy.

14. Your Rights & Data Requests

Under GDPR Chapter III you have the rights to:

Required Information for Requests

Include in your email:
- Full name
- Email on your account
- Phone (optional)
- Product(s) your request relates to (Rational HRM / NLEBIKE / AdMun Core)
- Details of the request

Response Timeline

• Acknowledgement: Within 1 business day
• Substantive response: Within 30 calendar days (extendable by 2 months for complex requests — we'll notify you)

Identity Verification

To protect your privacy, we may verify your identity before fulfilling requests (e.g., request copy of ID, confirm recent activity).

Supervisory Authority

You may also lodge a complaint with the Autoriteit Persoonsgegevens (Dutch DPA): autoriteitpersoonsgegevens.nl/klacht-indienen or your local EU DPA.

15. Children's Privacy

Our products are intended for business users and adults (18+). We do not knowingly collect personal data from children under 16 without appropriate parental/guardian consent as required by GDPR Art. 8.

• NLEBIKE: Age-gated at checkout (18+ for e-bike purchases)
• Rational HRM: Workers must be of legal working age per Dutch law
• AdMun Core: B2B services only

If you believe a child has provided us data, contact us and we will delete it.

16. Security & Data Breaches

Our Measures (Art. 32)

Breach Notification (Art. 33, 34)

No system is perfectly secure. While we work hard to protect your data, we cannot guarantee absolute security against every threat.

17. Changes to This Policy

We may update this policy as our products and legal obligations evolve.

Version history available on request. The "Effective Date" at the top shows the latest revision.

18. Governing Law, Jurisdiction & Contact

Legal Framework

This policy is governed by Dutch and EU law, including:
- GDPR 2016/679
- Telecommunicatiewet (ePrivacy implementation)
- Burgerlijk Wetboek Boek 6 (consumer rights)
- EU Directive 2011/83/EU (consumer rights)

Disputes

Disputes fall under the courts of 's-Gravenhage (The Hague), The Netherlands.
EU ODR Platform: ec.europa.eu/consumers/odr

Contact Us

Related Legal Documents

Terms & Conditions | Cookie Policy | Terms of Service | Disclaimer | Legal Imprint

© 2026 AdMun / NetherlandsIT — KVK 84121998 — VAT NL003915624B42 — registered in The Netherlands.
Privacy & GDPR Policy v3.0 — Effective 27 September 2026