Privacy policy

Cogundi Privacy Statement, dated 1 October 2026

  1. scope of the privacy statement This privacy statement applies to website visitors, account users, customers, business contacts, participants in AI telephone calls and persons to whom business information in our sources, business profiles or measurement results relates. This statement provides information about personal data. Acknowledgement does not constitute general consent and does not grant Cogundi any independent publication rights. Customer additions are also subject to the separate approval and Publication Instruction under the product terms and conditions.
  2. What does Cogundi do? Cogundi collects and analyses lawfully available public business information and uses it to compile public Draft business profiles. This may take place before a business registers or becomes a customer. Sources, AI visibility measurements, scores and indications of potentially missing information may be displayed. Authorised business customers may, for a one-off fee, add information through a Questionnaire and, at their choice, AI chat or an AI telephone call. The resulting Business profile remains non-public until the customer has expressly approved the complete version to be published and has issued a Publication Instruction. The purchase also includes twelve months from successful payment, with a new visibility measurement and email update each month. Substantive additions after approval may require a separate paid order. Insofar as the information contains personal data, we process it only on a valid legal basis and within the purposes described below.
  3. What personal data do we process? Depending on your relationship with Cogundi and the service you use, we process the following personal data: Name, address and place of residence, insofar as these data relate to a natural person. Business details, including the trade name and website address, insofar as they can be traced to a natural person. Names and positions of business contacts and representatives. Business email addresses and telephone numbers. Account and registration details. Bank account number, payment details and invoicing details. Public business information that can be linked to a natural person. Information you provide for compiling, checking or correcting a business profile. Email correspondence, chat messages and call summaries. Speech processed during a call with the AI assistant to convert it into text, the resulting transcript and technical call data. The call is not recorded or retained as an audio recording. Data necessary to verify your identity, business relationship or authority to represent the business. Data concerning the approved profile version, the date and method of approval, the Publication Instruction and necessary verification data. Data concerning consent to transcription and summarisation and any withdrawal of that consent. Verification data for the business email address and its link to the business domain. Answers entered directly through the Questionnaire. Measurement questions, AI answers, AI scores and measurement data, insofar as they relate to an identifiable natural person. The email address and necessary dispatch and delivery data for the included monthly updates. Data concerning cancellation, refunds and the consequences for access and publication. Minimal identifying data to respect erasure requests, exclusion from new scans and prevention of republication. Through the Questionnaire, substantive AI chat and the AI telephone call, we request only business information suitable for public publication. Do not provide personal contact details, private data, special categories of personal data or personal data relating to criminal convictions and offences, confidential information, trade secrets, login credentials or security information through these channels. Necessary contact, account, order and invoicing details are processed separately through the designated channels. They are not included in the public business profile.
  4. Where do the data come from? We receive data directly when you register, verify your business email address, place an order, pay, answer questions, add information, use AI chat or an AI telephone call, check a profile or contact us. We may also receive data from someone authorised to act on behalf of your business. We also collect lawfully available public business information from business websites, public trade registers and comparable sources in other countries. We may independently compile a Draft business profile without a prior request from the business. We do not access restricted environments or circumvent security. During visibility measurements, we receive answers from the AI systems being examined. These answers may contain information about businesses and, where applicable, personal data. Public availability does not mean that personal data may be reused without restriction. We assess the legal basis, necessity, source terms, provision of information and retention period. Where we do not receive personal data directly from you, we generally provide the information required by law within one month at the latest, or, if we contact you earlier, no later than that contact, or, if the data are disclosed to another recipient earlier, no later than that first disclosure. This may be departed from only where a statutory exception actually applies. Public business contact details used for lawful business communication do not become part of a public Profile solely for that reason.
  5. Why do we process data and on what legal basis? We process personal data for the purposes below and on the legal bases indicated. The applicable legal basis depends on the processing concerned and your relationship with Cogundi. Purpose Legal basis Managing accounts, handling orders and providing the services Performance of a contract with you. Where you act on behalf of an organisation: legitimate interests in carrying out the business assignment and maintaining the customer relationship. Processing payments and handling invoices Performance of a contract with you or legitimate interests in handling business payments where you act on behalf of an organisation. A legal obligation applies to legally required record-keeping. Collecting and analysing public business information, compiling and publicly publishing Draft business profiles and displaying business-focused measurement results. Legitimate interests in providing a business-focused information index and insight into measured AI visibility, only insofar as the specific processing is necessary and the interests and rights of data subjects do not override those interests. Without an adequate legal basis, the personal data concerned are not processed or published. Handling customer questions, emails and chats Performance of a contract with you or legitimate interests in business communication and customer service. Transcribing and summarising the AI telephone call to record the business information provided and compile the Business profile. Prior consent of the actual call participant. Without that consent, the Questionnaire remains available. See section 8. Processing answers from the Questionnaire and AI chat for preparation, checking and publication of the Business profile. Performance of the contract where the data subject is personally a contracting party, insofar as necessary. Where someone acts on behalf of an organisation: legitimate interests in carrying out the business assignment, only insofar as necessary and following a balancing of interests. Performing the included monthly visibility measurements and sending the email updates for twelve months from payment. Performance of the contract where the data subject is personally a contracting party, insofar as necessary. For business contacts of an organisation: legitimate interests in providing the agreed services and business communication. Investigating specific errors in questions, answers, transcripts, summaries and profile processing and improving our own services. Where possible, we use genuinely anonymised information. For necessary processing of personal data: legitimate interests in limited quality control, only following an assessment of necessity, compatibility and the interests of data subjects. This does not justify unlimited retention or use for AI model training. Where this legal basis is insufficient, processing does not take place without another valid legal basis and prior information. Handling specific complaints and disputes Legitimate interests in careful complaint handling and the establishment, exercise or defence of legal claims, insofar as necessary. A legal obligation applies where it actually applies. Continuing to respect granted erasure requests and preventing new scans and automatic republication. Legitimate interests in respecting requests and preventing unwanted republication, and a legal obligation insofar as it actually applies. Only necessary identifying data are retained for this purpose. Verifying identity, business relationship and authority to represent the business Legitimate interests in authorised commissioning, careful handling of requests and prevention of fraud and misuse, insofar as necessary and following a balancing of interests. Keeping demonstrable records of consent, profile approval and Publication Instructions Legitimate interests in lawful evidence and, insofar as applicable, compliance with legal obligations. Publishing business information traceable to a customer who is personally the natural person concerned Performance of the contract concluded with that customer, only insofar as publication is objectively necessary for that contract. Publishing permitted business information traceable to other natural persons Legitimate interests in publishing, at the customer's request, an accurate, business-focused profile that makes the business recognisable and findable, only where publication is necessary and the interests and rights of the person concerned do not override those interests. Without an adequate legal basis, the information is not published. Conducting business marketing Consent or legitimate interests, depending on the processing and in compliance with the applicable rules on commercial communications. Securing data and systems and preventing fraud and misuse Legitimate interests in protecting data, systems and services, insofar as necessary and following a balancing of interests, or an actually applicable legal obligation. We assess each separate processing purpose for a valid legal basis. Consent to transcription is not general consent for other purposes. We do not use withdrawn consent as a reason to continue the same processing on another legal basis. Separate processing for a specific dispute or another independently justified necessity is limited to the data necessary for that purpose. We do not use the information provided to train AI models and configure the supplier services we use accordingly. A scan instruction, acceptance of terms and conditions, acknowledgement of this privacy statement or a Publication Instruction does not automatically constitute GDPR consent for every instance of data processing. Approval by a customer likewise does not constitute consent on behalf of other data subjects.
  6. Approval and publication of business profiles Draft business profiles may be published independently by Cogundi on the basis of lawfully available public business information and its own analyses. They have not necessarily been checked or approved by the business. Insofar as personal data are published, the legal bases and restrictions in section 5 apply. We call the non-public working version in which customer additions are processed the Business profile. Answers, chat content, transcripts and additions do not become public solely through entry or processing. The complete version to be published is first submitted to the customer for checking. Following express approval and a valid Publication Instruction, this version is published as the Final business profile and replaces the Draft business profile on the profile page. The existing Draft business profile may remain public during preparation. Public Profiles contain business-focused information. Personal contact details, private data, special categories of personal data and personal data relating to criminal convictions and offences are not included. Contact, account, order, invoicing and call data remain separate from them. A trade name, website address or other business information may also constitute personal data where that information relates to an identifiable natural person. We process that information only where necessary and lawful. Customer approval does not remove our own legal obligations and does not constitute consent on behalf of other persons. We may remove or restrict access to unsuitable or unlawfully processed information. After publication, visitors, search engines and AI systems may consult and independently process the public information, insofar as lawful. Removal by Cogundi does not guarantee that external copies, caches or indexing will disappear. Our own statutory erasure and cooperation obligations continue to apply.
  7. Use of AI and external information services We use AI services for source analysis, drafting questions, collecting information, summarising and structuring business information. We also consult external AI systems for visibility measurements. The systems stated for a measurement indicate which services were examined in that measurement round. A service being measured does not receive non-public customer answers or transcripts solely for that reason. We limit disclosure of data to what is necessary for the processing concerned. Further information on recipients and international processing is provided in §10 and §11. In AI chat and AI telephone calls, we make clear that you are communicating with AI. AI output may contain errors and omissions. Customer additions are published only after separate approval. Draft business profiles from public sources, by contrast, may be published independently as described in section 6. Consent to transcription and summarisation does not include training general-purpose AI models. Contractual rights to use information supplied likewise do not constitute general consent to model training or other incompatible use. We calculate business-focused visibility scores and rankings automatically. These are not intended to assess personal characteristics, creditworthiness, suitability or rights of natural persons. Insofar as business-focused outcomes also constitute personal data, the GDPR and the rights of data subjects continue to apply. If processing were nevertheless to lead to solely automated decision-making producing legal effects or similarly significant effects on a person, we assess in advance the applicability of Article 22 GDPR and the necessary safeguards.
  8. Telephone calls and chat We use Twilio for telephony and ElevenLabs for AI voice functionality. Speech is processed during the call for interaction, conversion to text and summarisation. Within the services as configured by us, no audio recording is made or retained. Before transcription, we inform the actual participant about the processing and request separate consent. At the start, the AI assistant repeats that the call is being transcribed. Consent from a person placing an order does not replace that of another participant. Consent concerns transcription and summarisation to record business information and compile the Business profile. Other purposes are subject to the separate legal bases and restrictions in section 5. You may withdraw consent via info@cogundi.com and ask during the call for transcription to stop. We stop the processing based on that consent. Personal data already recorded are erased unless another, previously distinguished and actually applicable legal basis justifies limited further retention. We do not switch to another legal basis solely because of withdrawal in order to continue the same processing. Without consent to transcription, direct completion through the Questionnaire remains possible. Availability of the interactive chat route follows from the chosen performance route under the product terms and conditions. Answers from the Questionnaire and AI chat are processed to prepare the Business profile. Section 5 and the retention periods in section 12 apply to specific customer service and limited quality control. The information is not used to train AI models.
  9. Business email and marketing Cogundi may approach businesses by email with information about its products. Lawfully available business contact details from public sources may be used for this purpose, in compliance with the applicable rules on commercial communications. Public availability does not automatically mean that every contact detail may be used for commercial email. You may always object free of charge to the use of your personal data for direct marketing, for example by replying to the email or emailing info@cogundi.com. Following an objection, we no longer use your personal data for direct marketing. We may retain minimal data on a suppression list to prevent us from contacting you again. The included monthly updates and necessary messages about registration, payment, performance, approval and security are distinguished from direct marketing. Insofar as these messages serve solely to perform the agreed service, we treat them as service communications. An offer for a new paid addition or another commercial extension is not exempted from the rules on commercial communications solely by inclusion in a service message. For such offers, we separately assess what consent or other statutory exception is required.
  10. With whom do we share data? We use the following service providers for the business operations described: Service provider Function STRATO Hosting, database and file storage Google Workspace and Postmark Email and email delivery Stripe Payment processing Twilio Telephony and technical call handling, with the telephone and connection data necessary for that purpose. Anthropic, OpenAI, Microsoft and Google The AI applications referred to in §7 ElevenLabs AI voice functionality for AI telephone calls and the associated processing of speech and call information. Not every service provider receives all data. We limit disclosure to what is necessary for the function concerned. Depending on the service and processing concerned, a supplier acts as a processor or as an independent controller. A data processing agreement is required for processing by a processor. Within Cogundi, the three collaboration partners have access to data from the Netherlands insofar as necessary for their work. Customers have access to their own account and data. Draft business profiles and Final business profiles are publicly accessible. Visitors, search engines and AI systems may consult and independently process the published information. Non-public account, order, contact, answer and call data do not thereby become public. In the event of a lawful succession to the operation, data may be disclosed to a successor operator, only for the same purpose, within the same substantive and privacy safeguards and insofar as a valid legal basis exists. This does not constitute general consent to the sale of non-public information, model training or other incompatible use. For the services used, we check the applicable processing arrangements, storage settings, retention periods and settings for use of data for model training. The actual processing and contractual role of a supplier are decisive; mere mention in this statement does not replace that assessment.
  11. Processing outside the European Economic Area Use of international service providers may entail personal data being processed outside the European Economic Area or being accessible from there. Such transfers require a valid transfer mechanism, such as an applicable adequacy decision or appropriate safeguards. Those safeguards may consist of European standard contractual clauses and, where necessary, supplementary measures. You may request information via info@cogundi.com about the safeguards applicable to a particular transfer and how you can obtain a copy of them. For each relevant service provider, we assess the actual processing locations, any access from third countries and the applicable transfer mechanism. Where standard contractual clauses are used, we also assess whether supplementary measures are necessary. A transfer does not take place solely because a supplier generally states that it complies with the GDPR.
  12. How long do we retain data? We retain personal data no longer than necessary for the purpose for which they are processed. The periods and criteria below apply. Data are erased earlier where further retention is no longer necessary or lawful. Data Retention period or criterion Publicly collected source data and Draft business profiles. Personal data in this category are retained for a maximum of two years from collection, with earlier erasure where necessity or legal basis ceases to exist. Before further retention or renewed inclusion, we reassess currency, necessity and lawfulness. Merely consulting the same source again does not automatically extend the period. A granted erasure request and exclusion from new scans are respected. Account details For as long as necessary for the account and associated services. They are then generally erased within three months, except insofar as separate data must lawfully be retained longer. Non-public Business profiles For as long as necessary and lawful for the ongoing addition and approval process. The absence of a fixed completion deadline does not justify unlimited retention of all underlying personal data. We periodically assess which data are still needed. After termination, data no longer necessary are generally erased within three months, subject to separately justified further retention. Public Final business profiles For as long as active publication under the product terms and conditions continues and processing remains lawful. Upon definitive termination, they are removed from the public Database or unpublished. Measurement results, monthly updates and necessary dispatch data, insofar as personal data. During the included twelve-month period and thereafter only for as long as necessary for customer service, checking and lawful evidence. For regular customer service, a maximum of two years after the end of that period applies, with earlier erasure where necessity or legal basis ceases to exist. Public profile information is subject to the separate retention period for the profile category concerned. Minimal data on the suppression list for new scans and republication. For as long as necessary to respect the granted erasure request. We limit this record to data allowing the business to be reliably recognised and periodically assess whether further retention is necessary. The record is not used for other purposes. Full transcripts after approval A maximum of three months after approval of the Business profile, with earlier erasure as soon as further retention is no longer necessary or lawful. Full transcripts where approval is not given or the assignment ends early Only for as long as necessary and lawful for ongoing performance or settlement. Failure to approve or termination does not justify unlimited retention. Once this necessity ceases to exist, the transcript is erased unless another specific legal basis justifies further retention. Necessary call summaries, chats and customer correspondence For as long as necessary for performance and customer service and thereafter for a maximum of two years after termination of the assignment concerned. Earlier erasure takes place where necessity or legal basis ceases to exist. Evidence of consent, profile approval and Publication Instruction Only the necessary data, for as long as needed to demonstrate the act concerned and the lawfulness of processing or to handle a specific dispute. Verification data, including any redacted identity document copy received No longer than necessary for verification and any lawfully necessary evidence. An identity document copy is erased as soon as further retention is unnecessary. Administrative data For the applicable statutory retention period. Minimal data on a marketing suppression list For as long as necessary to continue respecting the objection to direct marketing. Following valid contractual cancellation with a refund, we remove the public Profile and terminate further services under the product terms and conditions. This does not mean that invoicing data, necessary evidence and the minimal suppression record are erased immediately. Separate statutory legal bases and retention periods apply to them. Use for quality improvement does not automatically extend the stated retention periods. Insofar as quality analysis can take place without personal data, we anonymise the information needed for it. Upon withdrawal of consent, the rules in §8 apply. A stated maximum period does not confer an independent right to continue retaining data after withdrawal. A specific complaint, payment issue, legal proceeding or legal obligation may justify longer retention of relevant data. This concerns only the data necessary for that purpose. After termination of active publication, limited internal retention may remain necessary for lawful backups, administration, evidence, security, fraud prevention or legal obligations. Such retention does not confer a right to continued or renewed public publication. Anonymised or aggregated statistics may be retained insofar as they can no longer be traced to persons and do not disclose protected or confidential content. The fact that information remains public with third parties does not automatically extend our own retention period.
  13. Required data No paid order is required to view a public Profile. Registration and access to the addition environment require a verified business email address on the business domain belonging to the business. For ordering, payment, invoicing and monthly updates, we request the data necessary for those acts. We may request additional necessary and proportionate information to verify business capacity, business relationship or authority to represent the business. We state what data are required in the request concerned. Where necessary data are missing, we may be unable to provide the access, order or services concerned. Participation in an AI telephone call is not mandatory. Without consent to transcription, the Questionnaire remains available. Contact, account, order, invoicing and verification data are not included in the public Profile.
  14. Security We take appropriate technical and organisational measures to protect personal data against loss, unauthorised access and unlawful use. The measures are tailored to the nature of the data and the risks of processing. Access to non-public personal data is restricted to persons who need them for their work. Contact, account, order, invoicing and call data are not included in the public business profile. Access to the addition environment is linked to verification of the business email address and business domain. That verification is not conclusive evidence of authority to represent the business. In the event of doubt or indications of unauthorised use, we may request additional verification and temporarily restrict access. We also restrict access by staff and suppliers to what is necessary for their work.
  15. Cookies and website use Our website may use cookies and similar technologies for functions such as logging in, security, remembering preferences and operation of the ordering process. The current cookie overview states which technologies are actually used, by which provider, for what purpose and with what retention period. For technologies requiring consent by law, we request it before they are activated. You may refuse consent and change an earlier choice through the available cookie settings. Refusal of non-essential technologies does not prevent use of functions that can operate independently of them. Insofar as personal data are processed through these technologies, the purposes, legal bases and rights in this privacy statement also apply.
  16. Your rights and complaints Depending on the circumstances, you have the right to: Access your personal data. Rectification of inaccurate personal data. Erasure of personal data. Restriction of processing. Transfer of data where the right to data portability applies. Object to processing based on legitimate interests. Withdraw previously given consent. Object unconditionally to direct marketing. You may send a request to info@cogundi.com. We generally respond within one month. For complex or multiple requests, this period may be extended by a maximum of two months. We inform you of this within the first month. If necessary, we request necessary and proportionate additional information to verify your identity. For a request on behalf of a business, we may also verify the business relationship and authority to represent the business. Only where verification is not possible in a less intrusive way may we request a redacted copy of an identity document. We state in advance which data must remain visible and why. You may redact all unnecessary data. The citizen service number, including in the machine-readable zone, and the photograph must be redacted. You may add a watermark to the copy with the date and the statement ‘Solely for verification by Cogundi’. The business or its authorised representative may also request removal of a public Draft business profile or Final business profile without a paid order. Following sufficient verification, we remove the entire public Profile and the score displayed with it without undue delay. We record the business with minimal identifying data on a suppression list to prevent new scans and automatic republication. A profile removal request is not automatically a request to erase all personal data. Lawfully necessary administration, evidence and suppression data may continue to exist under section 12. The natural persons concerned may also exercise their GDPR rights independently. Even where you are not the customer or commissioning party, you may exercise your rights in relation to your own personal data. Approval by a customer does not restrict those rights. For withdrawal of consent to transcription and summarisation and its consequences, we refer to §8. You may lodge a complaint with the Autoriteit Persoonsgegevens or with the competent data protection supervisory authority in the country where you habitually reside, work or where the alleged infringement took place. Where we process personal data on the basis of legitimate interests, you may object on grounds relating to your particular situation. We assess that objection under the GDPR. An unconditional right to object applies to direct marketing. The broader procedure described above applies to the contractually offered removal of the entire business profile.
  17. Privacy responsibility Cogundi is a trade name of Bram Muilwijk's sole proprietorship. Business address: Frans Halsstraat 12, 3372 XD Hardinxveld-Giessendam, Netherlands, Chamber of Commerce number: 78270200, email address: info@cogundi.com, website: cogundi.com, Bram Muilwijk, trading as Cogundi, is the controller for personal data processed for the purposes described below.
  18. Changes We may amend this privacy statement where our data processing, business operations or applicable rules change. The current version, with its version date, is made available on our website. In the event of material changes, we inform data subjects where required. An amendment to this privacy statement does not in itself constitute new consent, a Publication Instruction or an extension of contractual rights of use. Where changed processing requires separate consent or prior information, we provide for that separately. Privacy Statement Cogundi