Privacy policy

SUUS IQ B.V. (hereinafter: “SUUS”, “we”, “us”) is established in Amsterdam, the Netherlands, and registered with the Kamer van Koophandel (the Dutch Chamber of Commerce) under number 42050357. SUUS develops and provides software for field sales professionals.

Place of business: Amsterdam, Nederland. VAT identification number: NL869478783B01.

Contact details: info@suusiq.com

For data we collect for ourselves (such as enquiries through our own advertisements and our website) we are the Controller. Where we process data on behalf of a customer, for example enquiries that come in through that customer's advertisements, that customer is the Controller and we are the Processor; in that case the privacy policy of that customer and the data processing agreement we conclude with it apply.

We process the following categories of personal data:

• Account data: name, e-mail address, organisation name, job title. If you sign in with Google or Microsoft, we receive from them only your name and e-mail address; Google and Microsoft are themselves responsible for that
• Usage data: sign-in times, actions within the application, session duration
• CRM data: contacts, company information and notes that you enter yourself
• Voice recordings: spoken messages that you send through the voice feature (stored temporarily for processing)
• Communication data: e-mails and calendar appointments if you activate an e-mail or calendar integration
• Payment data: payment processing through Stripe; we do not store full payment card details
• Enquiries through advertisements: the data you enter in a form attached to an advertisement on Facebook or Instagram: first and last name, company name, job title, telephone number, business e-mail address and your answers to the questions in the form
• Demo requests through our website: name, business e-mail address, telephone number, company name, website, town or city, the number of field sales staff and the product for which you request a demo, even if you do not complete the form in full
• Origin of an enquiry: the campaign or advertisement through which you arrived at our website (campaign codes in the link, and the click IDs of Meta and Google)
• WhatsApp conversations: your telephone number, your WhatsApp profile name and the messages you exchange with us, and the advertisement through which the conversation began

• Performance of the contract (Article 6(1)(b) AVG (GDPR)): for providing our Service
• Legitimate interest (Article 6(1)(f) GDPR): for security, fraud prevention and product development
• Legal obligation (Article 6(1)(c) GDPR): for the statutory retention obligation for tax purposes
• Consent (Article 6(1)(a) GDPR): for optional integrations such as e-mail and calendar connections, and for contacting you through WhatsApp and telephone after you have given consent for this in an advertisement form. You may withdraw your consent at any time
• Legitimate interest (Article 6(1)(f) GDPR): for assessing enquiries, following up a demo request that you did not complete, and measuring and improving our advertisements, as described in sections 4, 5 and 6. You may object to this

We advertise on Facebook and Instagram. If you complete a form there, we receive the data you enter directly from Meta. We use it solely to assess and follow up your enquiry.

• Contact: we contact you through WhatsApp or telephone only if you have given consent for this in the form. Messages through WhatsApp pass through Meta's WhatsApp Business Platform
• Stopping: let us know in the conversation or by e-mail that you no longer wish to be contacted; we will then stop contacting you
• Feedback to Meta: to improve our advertisements we let Meta know, per enquiry, whether it matched our offering. In doing so we send only the enquiry number that Meta itself assigned to your enquiry, the outcome (a match or not a match) and a score. We do not send your name, telephone number, e-mail address, answers or messages back to Meta
• No resale: we do not share your enquiry with other companies for their own marketing

If you request a demo on suusiq.com, we use your data to contact you about that demo and the product you are interested in.

• Saved per step: the form has three steps. As soon as you complete a step, we save the data entered. If you do not complete the form, a member of staff may contact you by e-mail or telephone about your enquiry after approximately 30 minutes
• Origin: we record the campaign through which you arrived at our website, so that we can measure which advertisements work. We do not use that data to track you on other websites
• No further contact: let us know by e-mail or in the conversation; we will then stop contacting you and delete your enquiry on request

We use artificial intelligence to be able to follow up enquiries more quickly. An AI model reads your answers and, if you are in conversation with us through WhatsApp, your messages. On the basis of predefined criteria (such as the type of company and its customers) it assesses whether our offering suits you, assigns a score and may ask a follow-up question.

• This assessment determines only how and how quickly we follow up your enquiry. No decisions are taken on its basis that produce legal effects concerning you or similarly significantly affect you
• A member of staff can view and amend every assessment and take over the conversation. You may at any time ask us to have your enquiry assessed by a member of staff
• Your data is not used to train AI models of third parties

We share personal data with third parties only insofar as necessary for providing our Service. These are our Sub-processors:

• Supabase — Database, sign-in and file storage. Location: EU (Ireland, AWS eu-west-1).
• Vercel — Hosting of the app and the API. Location: Servers in the EU (Frankfurt); Vercel also processes in the US.
• Upstash — Temporary storage: cache, rate limiting and the state of ongoing conversations. Location: EU (Frankfurt, AWS eu-central-1).
• Trigger.dev — Background jobs: enrichment, summaries, synchronisation and daily overviews. Location: Execution in the EU (Frankfurt); job data and logs in the US (AWS us-east-1).
• Sentry — Error reporting and performance monitoring. Location: EU (Germany); account and organisation data in the US.
• Resend — Transactional email: invitations, notifications, daily overviews and contracts. Location: Sent from the EU (Ireland); stored in the US.
• LiveKit Cloud — Audio connection for voice calls and hosting of the voice agent. Location: Voice agent in the EU (Frankfurt); live audio via the nearest LiveKit server (in the EU for users in the Netherlands and Belgium); session data and logs in the US. LiveKit does not store call recordings or transcripts.
• Deepgram — Real-time speech recognition during voice calls. Location: EU (Deepgram's EU endpoint).
• Speechmatics — Speech recognition of company names during voice calls. Location: EU (EU1 endpoint, processing within the EEA).
• OpenAI — AI processing: understanding, summarising and transcribing conversations, and assistant replies. Location: US.
• Cartesia — The voice of the voice agent (text to speech). Location: US.
• Nylas — Calendar integration with Google Workspace and Microsoft 365. Location: United Kingdom (London).
• Meta (WhatsApp Business Platform) — WhatsApp messages with leads and feedback on the outcome of lead requests. Location: EU (Ireland) and US.
• Apify — Collecting signals from public sources, with scrapers the customer selects. Location: US (Amazon Web Services and MongoDB Atlas).
• Higgsfield — Creating ad images for lead gen campaigns. Location: US.
• Twilio — Phone line of the voice assistant (inbound and outbound calls), SMS verification (sign-in codes), SMS to leads and WhatsApp reminders. Location: US.
• Google Workspace — Business email and documents of SUUS IQ: support and contracts. Location: Worldwide (Google's data centres).
• Anthropic — AI assistance (Claude) for support and error analysis. Location: US.

In addition, the following parties receive data for our own administration or as independent Controller:

• Stripe — Payments, SEPA direct debit and subscriptions of SUUS IQ. Location: EU and US.
• Moneybird — Bookkeeping and invoices of SUUS IQ. Location: EU (Germany and the Netherlands).
• Google Maps Platform — Converting addresses to locations, map display, and looking up and enriching company details. Location: US and worldwide.
• Meta (Lead Ads) — Source of leads from ad forms. Location: EU (Ireland) and US.

For each party, the data, the legal basis for transfer outside the EEA and the data processing agreement are listed on our sub-processors page.

We never sell your personal data to third parties.

• Account data and all other Customer Data: for as long as the contract runs. After that the data remains available for retrieval for 30 days and is then deleted; back-ups expire within 7 days. See Switching and export.
• Voice recordings: retained only for processing after the call and deleted no later than 24 hours after recording. The transcription and summary form part of the Customer Data.
• Invoice data and signed contracts: 7 years (statutory retention obligation)
• Evidence of electronic acceptance (time, e-mail address, IP address, version of the terms): for as long as the contract runs plus 7 years
• Usage data (such as call minutes and credits): 13 months, as the basis for invoicing and its verification
• Technical logs of the processing (voice processing, notifications, background tasks): 30 to 365 days, depending on the log
• Audit log (who changed what and when): for as long as the contract runs, thereafter deleted together with the Customer Data
• Enquiries through advertisements, demo requests through our website and WhatsApp conversations: if you do not become a customer, we delete your data no later than 12 months after the last contact. If you become a customer, the retention periods for account data apply

Under the GDPR you have the following rights:

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure (“right to be forgotten”)
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent given
• Right to human intervention in an assessment with the help of AI

You may exercise your rights via info@suusiq.com. We respond within 30 days. You also have the right to lodge a complaint with the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority) (autoriteitpersoonsgegevens.nl).

You may ask us at any time to delete your data, including if you have completed a form attached to one of our advertisements on Facebook or Instagram or have been in contact with us through WhatsApp.

• Send an e-mail to info@suusiq.com with the subject “Deletion request”
• State the telephone number or e-mail address you used for your enquiry, so that we can locate your data
• We confirm your request and delete your enquiry, your answers, the associated assessment and your WhatsApp conversation within 30 days
• Data we are legally required to retain, such as invoices, is excluded from this

The full instructions and the status of a request can be found at suusiq.com/data-deletion.

Data that Meta itself holds about you is managed through the settings of your Facebook, Instagram or WhatsApp account.

We take appropriate technical and organisational measures to protect your personal data, including encryption of data in transit (TLS) and at rest, role-based access control and regular security audits.

We use functional and analytical cookies. See our Cookie policy for more information.

We may amend this privacy policy from time to time. In the event of material changes we will inform you by e-mail or by a notification in the application. The date at the top of this document indicates when the policy was last updated.