Privacy Policy
Version: October 2026
Last updated: 2 October 2026
1. Who we are and what this policy covers
Shareloc B.V. ("Shareloc", "we", "us") builds location intelligence for businesses in the Netherlands. We are the controller of the personal data described in this policy, as defined in the EU General Data Protection Regulation (GDPR).
Gerard Doustraat 144-2, 1073 VX Amsterdam, the Netherlands
Chamber of Commerce (KvK): 42154816 · VAT: NL869955858B01
Privacy contact: support@shareloc.io
This policy applies when you:
- visit our website shareloc.io;
- contact us, request a demo, a location report or a meeting (including at events such as World Summit AI);
- create or use an account on our platform platform.shareloc.io;
- are a business contact we reach out to, or a representative of one of our customers or partners.
Our services are built for businesses and professionals. We have not appointed a Data Protection Officer because our processing does not require one; privacy questions go to support@shareloc.io.
2. The personal data we process and where it comes from
| Situation | Personal data | Source |
|---|---|---|
| Visiting our website | Pages viewed, referring page, device and browser type, approximate location derived from your IP address, and your cookie choice. Analytics data is collected only if you accept analytics cookies. | Your browser |
| Contact, demo, report and meeting forms | Name, work email, company, your message, preferred demo date and time, and for a location report the address and business type you ask about. | You |
| Platform account | First and last name, email address, company name, how you heard about us, your main intended use, the date you accepted our terms, and your plan and trial status. Your password is stored only in hashed form by our authentication provider. If you sign in with Google, we receive your name, email address and Google account identifier. | You, or Google if you choose Google sign-in |
| Using the platform | Addresses and streets you search and score, listings you open or add, saved reports and comparisons, monthly usage counts, sign-in times and technical logs (such as IP address and browser). | Generated as you use the platform |
| Upgrades, sales and contracts | Your upgrade request and message, a phone number if you give one, our correspondence, and order and invoicing details such as billing contact and company details. | You |
| Emails from us | Whether an email was sent or delivered, and unsubscribe and suppression status. | Our email systems |
| Business contacts we reach out to | Name, job title, employer, business email, business phone number where available, a public professional profile URL, and information about the employer. See section 6. | Business-contact databases, public professional profiles and introductions |
Location data is about places, not people. The listings, points of interest, demographics and other data shown on the platform come from public and licensed sources, such as public property listings, OpenStreetMap, Statistics Netherlands (CBS) and PDOK. Demographic data is aggregated at neighbourhood level and does not identify individuals. Occasionally a public listing names a contact person. We do not use such details to profile anyone, and we will remove them on request.
We do not ask for special categories of personal data, such as health or religious data. Please do not include them in messages to us.
3. Why we use personal data and our legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the platform: creating and managing your account, delivering Free, trial and paid features, applying plan limits and keeping your saved work. | Performance of a contract (Art. 6(1)(b)) |
| Service emails: account confirmation, password resets, trial start and end notices, and important notices about your account, security or our terms. | Performance of a contract (Art. 6(1)(b)) |
| Answering contact, demo, report and meeting requests, preparing the report you asked for, and following up on it. | Steps taken at your request before a contract (Art. 6(1)(b)) and our legitimate interest in following up (Art. 6(1)(f)) |
| Product news and relevant offers by email to account holders and customers. | Legitimate interests (Art. 6(1)(f)), within the limits of the Dutch Telecommunications Act (Telecommunicatiewet). Where that Act requires your consent, we ask for it first. Every such email contains an unsubscribe link. |
| Reaching out to business contacts (see section 6). | Legitimate interests (Art. 6(1)(f)) |
| Sales, contracts, invoicing and bookkeeping. | Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)), including Dutch tax record-keeping rules |
| Website and platform analytics with Google Analytics. | Your consent (Art. 6(1)(a)), given through our cookie banner |
| Keeping our services secure, preventing fraud and abuse (for example, multiple accounts used to bypass plan limits), and fixing technical problems. | Legitimate interests (Art. 6(1)(f)) |
| Improving our platform and models using aggregated, de-identified usage statistics. | Legitimate interests (Art. 6(1)(f)) |
| Complying with the law and establishing or defending legal claims. | Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have weighed our interests against your rights. You can ask us for that assessment and you can object at any time (see section 10). Where we rely on consent, you can withdraw it at any time; this does not affect processing that took place before you withdrew it.
4. AI, scoring and automated decisions
Shareloc's AI-assisted statistical and machine-learning models score locations, not people. We do not use your personal data to make decisions about you that are based solely on automated processing and that have legal or similarly significant effects for you (Art. 22 GDPR). Plan limits, such as the number of free searches per month, are applied automatically as part of the service you signed up for.
We do not send your personal data to third-party generative AI services to produce location scores.
6. Business contacts we reach out to
This section explains how we handle personal data that we did not receive from you directly (Art. 14 GDPR).
- Who: people whose professional role relates to location, expansion, property or operations decisions.
- What: name, job title, employer, business email, business phone number where available, a public professional profile URL, and information about the employer such as sector, size, website and number of locations.
- Sources: commercial business-contact databases, publicly visible professional profiles (such as LinkedIn), and introductions by colleagues or mutual contacts.
- Why: to contact you individually about Shareloc where your role suggests our service is relevant to your work. We do not use this data for bulk advertising, profiling or automated decisions.
- Legal basis: our legitimate interest in offering a business service to the people whose work it supports (Art. 6(1)(f)). We hold business details only, contact people one to one, and stop as soon as someone asks.
- Access: only Shareloc's team, in an access-controlled system. We do not sell, rent or share this data.
- Retention: until you ask us to stop, or 24 months after our last meaningful contact, whichever comes first. If you ask us to stop, we keep only the minimum details needed to make sure we do not contact you again.
To object or be removed, email support@shareloc.io. One message is enough and you do not need to give a reason.
8. International transfers
We store our core platform data in the European Union. Some providers listed in section 7 process data in the United Kingdom or the United States. For the United Kingdom we rely on the European Commission's adequacy decision. For the United States we rely on the EU-U.S. Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.
9. How long we keep personal data
| Data | Retention |
|---|---|
| Platform account and profile data | For as long as your account exists. When you delete your account, we delete your account and profile data within 30 days. Copies in encrypted backups are overwritten within a further 90 days. |
| Contact, demo, report and meeting requests | Up to 24 months after our last contact, unless you become a customer. Customer correspondence is then kept for the duration of the relationship. |
| Business contacts (section 6) | Until you ask us to stop, or 24 months after our last meaningful contact. |
| Contracts, orders and invoices | 7 years, as required by Dutch tax law. |
| Unsubscribe and suppression records | For as long as needed to honour your choice. |
| Analytics data (Google Analytics) | Up to 14 months, after which it is deleted automatically. |
| Technical and security logs | Up to 90 days, unless needed to investigate a specific incident. |
We keep data longer only where the law requires it or where it is needed to establish or defend legal claims.
10. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict how we use your data;
- receive your data in a portable format;
- object to processing based on legitimate interests. You can always object to direct marketing, and we will then stop;
- withdraw consent at any time.
Self-service options: in the platform's account settings you can download your data and delete your account. Every marketing email has an unsubscribe link, and Cookie settings in the website footer lets you change your cookie choice.
For anything else, email support@shareloc.io. We respond within one month. For complex requests this can be extended by up to two further months, and we will tell you if so. We may ask you to confirm your identity before acting on a request.
You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or with the supervisory authority where you live or work. We would appreciate the chance to resolve your concern first.
11. How we protect personal data
- Encryption in transit (TLS) and encryption at rest by our hosting providers.
- Row-level security and role-based access controls in our database, so users can only access their own account data.
- Least-privilege access for our team, with administrative keys kept server-side.
- Periodic security reviews, including an independent security assessment in 2026, with follow-up of its findings.
- Regular backups and monitoring.
No system is completely secure. If a personal data breach occurs that is likely to put your rights at risk, we will notify the Autoriteit Persoonsgegevens and, where required, you, as the GDPR requires.
12. Children
Our services are intended for business users aged 18 and over. We do not knowingly collect personal data from children.
13. Changes to this policy
We update this policy when our services or the law change. The version and date at the top show which version applies. We will tell account holders about material changes by email or in the platform before they take effect. This version (October 2026) replaces the version dated November 2025.
14. Contact
Gerard Doustraat 144-2, 1073 VX Amsterdam, the Netherlands
KvK 42154816
Privacy questions and requests: support@shareloc.io
Website: https://shareloc.io