ProvenKPI acts as the data controller for personal data of its users and as a data processor for personal data submitted by customers into the Service.

We process personal data on the following legal bases: performance of a contract (providing the Service), legitimate interests (improving the Service and ensuring security), consent (where required, e.g. marketing), and legal obligations.

As a data subject in the EU, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data ("right to be forgotten")
• Restrict or object to processing
• Receive your data in a portable format
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority

To exercise any of these rights, contact us via our contact page. We will respond within 30 days. We may need to verify your identity before processing your request.

For customers using ProvenKPI to process personal data, we offer a Data Processing Agreement on request. Contact us to obtain a copy.

We engage a limited number of trusted sub-processors (e.g. hosting, payment, email delivery) to operate the Service. A current list is available on request.

When personal data is transferred outside the EU/EEA, we rely on Standard Contractual Clauses approved by the European Commission to ensure adequate protection.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, inform affected users without undue delay.

If you are in the Netherlands, you may lodge a complaint with the Autoriteit Persoonsgegevens (AP). In other EU countries, contact your local data protection authority.

For GDPR / AVG-related questions, contact us through our contact page.