Privacy Policy

1. Who We Are and What This Policy Covers

This Privacy Policy explains how Paylo One, registered with the Dutch Chamber of Commerce (KvK) under number 42091728, with its registered address at Lange Viestraat 2B, 3511 BK Utrecht, Netherlands ("Paylo.One", "we", "us", or "our"), collects, uses, and protects personal data.

Paylo.One is a systems engineering firm. This policy covers the personal data we process as a controller: data about visitors to paylo.one, people who contact us, the representatives of our clients and suppliers, people who apply to work with us, and the account holders of our Pilot service. It also explains, in section 6, the different role we take when we process personal data inside a client's systems during an engagement.

Paylo One is the controller for the processing described in sections 2 to 5 and 7 to 16. Where we act as a processor on a client's instructions, the client is the controller and their own privacy notice governs the processing; our obligations are then set by the data processing agreement between us.

We have not appointed a Data Protection Officer, because our processing does not meet the criteria in Article 37 GDPR. Privacy questions and requests go to access@paylo.one and are handled directly by the people responsible for the business.

2. Website Visitors

This website is a static, published site. It has no accounts, no login, no forms, and no analytics, advertising, tracking, or profiling technologies of any kind. We do not build visitor profiles and we do not share visitor data with advertising networks.

Our hosting provider processes standard server request data in order to deliver the site and keep it secure. This includes your IP address, the page requested, the time of the request, the referring page where your browser sends one, and your browser and device type. We use this only to serve the site, diagnose faults, and defend against abuse.

The only cookie this site sets is NEXT_LOCALE, which remembers the language you chose so the site stays in that language. It is strictly necessary to deliver the preference you asked for and therefore requires no consent. Full details are in our Cookie Policy.

The lawful basis for this processing is our legitimate interest under Article 6(1)(f) GDPR in operating a secure and functioning website. You can object to processing based on legitimate interests as described in section 13.

3. Enquiries and Correspondence

When you write to us, for example about a possible engagement, we process the contact details and the content of your message, along with any material you choose to send us. We use it to understand what you are asking, to reply, and to assess whether we are the right firm for the work.

The lawful basis is our legitimate interest under Article 6(1)(f) GDPR in responding to business enquiries and in operating our business, and, where your enquiry leads towards an engagement, the steps taken at your request before entering into a contract under Article 6(1)(b) GDPR.

Please do not send us special categories of personal data, production data, credentials, or confidential client material in an initial enquiry. If an engagement requires access to such material, we agree the access, the safeguards, and the written terms first.

We keep enquiry correspondence for as long as the enquiry is active and for up to twenty-four months afterwards, so that we can pick up a conversation that resumes and evidence how an opportunity was handled. After that it is deleted unless it has become part of a contractual record.

4. Client and Supplier Contacts

When we work with a client or a supplier, we process the business contact details of the individuals we deal with: name, role, employer, email address, telephone number, and the record of our dealings with them. Where an engagement requires it, we also process details needed for access management, such as an account identifier in your systems.

The lawful basis is the performance of a contract under Article 6(1)(b) GDPR where the individual is our counterparty, and otherwise our legitimate interest under Article 6(1)(f) GDPR in administering a business relationship with the organisation that employs them. We also process this data to comply with legal obligations under Article 6(1)(c) GDPR, in particular Dutch accounting and tax law.

Records that form part of our administration are retained for seven years from the end of the financial year to which they relate, as required by Dutch law. Contact records held only for relationship purposes are deleted when the relationship ends and no legal obligation requires us to keep them.

5. People Who Apply to Work With Us

If you apply to work with us, or send us a speculative approach, we process the information you provide: your contact details, your application and any attachments, your work history, and our notes and assessments from any conversation or technical exercise.

The lawful basis is the steps taken at your request before entering into a contract under Article 6(1)(b) GDPR, and our legitimate interest under Article 6(1)(f) GDPR in assessing candidates and keeping a record of that assessment.

We keep an unsuccessful application for four weeks after we tell you the outcome, unless you agree in writing that we may keep it for up to one year in case another opportunity arises. Consent given for that longer period may be withdrawn at any time.

6. Personal Data Inside Client Systems

During an engagement we may work in systems that contain personal data belonging to our client: source code, databases, logs, test fixtures, documents, and production or production-like environments. In that processing the client is the controller and Paylo One acts as a processor on their documented instructions.

Before any such access begins, we agree a written data processing agreement under Article 28 GDPR covering the subject matter, duration, nature, and purpose of the processing, the categories of data subjects and personal data, our obligations of confidentiality and security, the use of sub-processors, assistance with data subject requests and breach notification, and what happens to the data at the end of the engagement.

Our operating defaults are the narrowest access that allows the work, for the shortest period that completes it, recorded and removed when the engagement ends. We prefer anonymised, pseudonymised, or synthetic data for development and testing, and we ask for production data only where the work genuinely cannot be done without it.

If you are an individual whose personal data sits in a client system we worked in, the client is your point of contact for exercising your rights. We will assist them in responding to you, and you may also contact us at access@paylo.one and we will pass the request on.

7. The Pilot Service

Paylo.One operates Pilot, a subscription software service for individual professionals and teams. This website no longer markets Pilot, but the service remains live and this policy continues to cover it. Use of Pilot is governed by our Terms and Conditions and our Refund Policy.

For Pilot account holders we process account data (name, email address, authentication details, workspace memberships, roles, and settings), billing data handled by our payment processor acting as merchant of record, content you upload, data ingested from the third-party sources you explicitly connect, and technical usage data generated by your use of the service.

Pilot only ingests data from a source after you have connected and approved that source for your workspace. We never access a source you have not connected. Credentials and session tokens for connected sources are encrypted at rest, held server-side only, never exposed to your browser, and used solely to retrieve data from the sources you authorised. Disconnecting a source stops further ingestion.

Pilot is multi-tenant. Data belonging to one workspace is logically isolated from every other workspace, and access is limited to the members of that workspace.

The lawful bases for Pilot processing are the performance of our contract with you under Article 6(1)(b) GDPR, our legitimate interests under Article 6(1)(f) GDPR in securing and improving the service, your consent under Article 6(1)(a) GDPR where we ask for it, and compliance with our legal obligations under Article 6(1)(c) GDPR.

Where you connect a Google account, Pilot requests read-only access to your Google account email address, Gmail messages and labels, and Google Calendar calendars and events, and ingests content only from the labels and calendars you activate. Pilot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising or credit decisions, or use it to train generalised artificial intelligence models.

8. Artificial Intelligence Processing

We use AI-assisted engineering tools in our own delivery work, and the Pilot service uses artificial intelligence to generate briefings, summaries, and suggested actions from workspace content.

Where AI processing is performed by third-party model providers acting as our processors or sub-processors, we send only the data necessary for the requested operation, under contractual terms that prohibit the provider from using the data for any purpose other than providing the service to us, including model training. We do not use client material or Pilot workspace content to train generalised AI models.

In engagement work, whether a client's code or data may be processed by an AI-assisted tool is agreed with that client in writing before the work starts, and is subject to the same access limits as any other processing. A named human engineer remains accountable for every output.

AI-generated output can be inaccurate or incomplete and is not professional advice. Within Pilot, outputs are stored in the workspace alongside the data they were generated from, under the same isolation, retention, and deletion rules.

9. Sharing and Subprocessors

We do not sell personal data, and we do not share it for advertising or cross-context behavioural profiling.

We use a limited set of service providers who process personal data on our behalf, under contracts that require them to protect it and to process it only on our instructions. These cover website and application hosting, cloud infrastructure and storage, email delivery, AI model providers, payment processing for Pilot, and professional advisers such as accountants. A current list of our subprocessors, including the processing they perform and where they are located, is available on request at access@paylo.one.

We may also disclose personal data where we are required to by law, legal process, or a binding request from a public authority; where it is necessary to establish, exercise, or defend legal claims; or in connection with a merger, acquisition, or sale of assets, in which case we will notify affected individuals of any change in control.

Where you connect a third-party source to Pilot, that provider's own privacy policy governs its handling of your data. We access it using only the permissions you grant and the scopes the features you use require.

10. International Transfers

We prefer service providers that process personal data within the European Economic Area. Some of our providers, in particular certain cloud infrastructure and AI model providers, are established outside the EEA or use sub-processors outside it.

Where personal data is transferred outside the EEA, we rely on an adequacy decision of the European Commission under Article 45 GDPR where one covers the recipient, and otherwise on the European Commission's Standard Contractual Clauses under Article 46(2)(c) GDPR, supported by a transfer impact assessment and any supplementary technical and organisational measures that assessment identifies as necessary.

You can request details of the safeguards applied to a specific transfer, and a copy of the relevant clauses, at access@paylo.one.

11. Retention

We keep personal data only for as long as we need it for the purpose it was collected for, or for as long as the law requires.

Where a period is not stated above, we apply the following. Engagement records and deliverables are retained for the duration of the engagement and for the limitation period that applies to claims arising from it. Personal data processed inside client systems is returned or deleted at the end of the engagement, as the data processing agreement directs. Pilot account data is retained while the account is active and for a reasonable period afterwards; workspace content is retained while the workspace exists and is removed from active systems within a reasonable period after deletion, and from backups in line with our backup rotation. Security and usage logs are retained for limited periods appropriate to their purpose and are then deleted or anonymised.

12. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit and at rest, logical isolation between Pilot tenants, role-based access control, least-privilege access to client systems, review and removal of access, and logging and monitoring of access to production systems.

Security is treated as an architectural characteristic in our engineering work: trust boundaries, authentication, authorisation, data classification, retention, and abuse cases are settled at design time rather than retrofitted.

No method of transmission or storage is completely secure and we cannot guarantee absolute security. Where a personal data breach is likely to result in a risk to individuals, we will notify the Autoriteit Persoonsgegevens within 72 hours of becoming aware of it, as Article 33 GDPR requires, and we will notify affected individuals without undue delay where Article 34 GDPR requires it. Where we act as a processor, we will notify the controller without undue delay.

13. Your Rights

Under the GDPR you have the following rights in relation to personal data we hold about you as a controller:

To exercise any of these rights, contact us at access@paylo.one. We will respond within one month of receiving your request, and may extend that by two further months where the request is complex, telling you within the first month if we do. We may need to verify your identity before acting, and we will not charge a fee unless a request is manifestly unfounded or excessive.

Where you have exercised your right to object to processing based on legitimate interests, we will stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is needed for legal claims.

• Access: to be told whether we process your personal data and to receive a copy of it, with information about the processing (Article 15).
• Rectification: to have inaccurate personal data corrected and incomplete data completed (Article 16).
• Erasure: to have your personal data deleted where one of the grounds in Article 17 applies.
• Restriction: to have processing limited in the circumstances set out in Article 18.
• Portability: to receive personal data you provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible (Article 20).
• Objection: to object at any time to processing based on our legitimate interests, on grounds relating to your particular situation, and to object absolutely to direct marketing (Article 21).
• Withdrawal of consent: to withdraw consent at any time where processing is based on it, without affecting the lawfulness of processing before withdrawal (Article 7(3)).
• Automated decisions: not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (Article 22). We do not make such decisions.

14. Complaints

If you are not satisfied with how we have handled your personal data or your request, please tell us first at access@paylo.one so that we have the opportunity to put it right.

You also have the right to lodge a complaint with a supervisory authority, in the EU Member State of your habitual residence, your place of work, or the place of the alleged infringement (Article 77 GDPR). Our lead supervisory authority is the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, Netherlands, autoriteitpersoonsgegevens.nl.

Exercising your right to complain does not affect any other remedy available to you, including the right to an effective judicial remedy under Articles 78 and 79 GDPR.

15. Children

Our services are directed at businesses and professionals. They are not intended for children and may not be used by anyone under the age of 16, which is the digital consent age set by the Dutch implementation of Article 8 GDPR.

We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at access@paylo.one and we will delete it promptly.

16. Changes to This Policy

We may update this policy to reflect changes to our services, our practices, or applicable law. The version identifier and effective date at the top of this page identify the current revision.

Where a change materially affects how we process your personal data, we will notify you directly before it takes effect, by email where we hold your address or through the Pilot service for account holders.

17. Contact

Paylo One, Lange Viestraat 2B, 3511 BK Utrecht, Netherlands. Registered with the Dutch Chamber of Commerce under KvK 42091728. Email access@paylo.one.

Privacy requests, requests for our current subprocessor list, requests for transfer safeguard documentation, and privacy complaints should all be sent to access@paylo.one. Formal legal notices should additionally be sent in writing to the postal address above.