CISO Ally B.V. helps municipalities and other public bodies with information security, business continuity management (BCM) and the Dutch Cybersecurity Act (Cbw, the Dutch implementation of NIS2). We think it is important that you know what we do with your data. This privacy statement explains which personal data we process, why, on what legal basis, how long we keep it and what rights you have.
1. Who we are
CISO Ally B.V. is the controller for the processing of personal data described in this privacy statement.
| Name | CISO Ally B.V. |
|---|---|
| Address | Thamerlaan 2, 1421 XX Uithoorn, the Netherlands |
| Chamber of Commerce (KvK) no. | 96975717 |
| Phone | +31 (0)85 105 8888 |
| Email for privacy questions | mvdd@cisoally.com |
| Website | cisoally.com |
| Contact person | Marco van der Does, owner |
Do you have a question about this privacy statement or about your data? Email mvdd@cisoally.com or use the contact page. We do not have a data protection officer; you can send questions to mvdd@cisoally.com.
2. Which data we process and why
2.1 Self-test: feedback on your answers
The self-test '8 questions about continuity' lets you check for yourself how your organisation is doing. The self-test is a paper card. Unsure about an answer? You can have your answers reviewed by emailing a photo or scan of the completed card to mvdd@cisoally.com.
| Data | Name, organisation and email address (required); job title and phone number (if you provide them); your answers per question (Yes, Partly or No) and any comments you add. If you email the paper card, also the photo or scan and the details in your email. |
|---|---|
| Purpose | To send you brief feedback at your request, with a few follow-up questions if needed. |
| Legal basis | Your own request: we process the data to do what you ask of us (Article 6(1)(b) GDPR). Where you act on behalf of your organisation, the basis is our legitimate interest in answering your question properly (Article 6(1)(f) GDPR). |
| Retention | 6 months after the feedback. If you ask for deletion earlier, we delete the data earlier. |
The paper card has a box with the text 'I have read the privacy statement. CISO Ally uses my details and answers to send me feedback.' Ticking it only means you have read this privacy statement. It is not consent: the legal basis is your own request for feedback.
An adviser at CISO Ally reads your answers personally. Your answers do not go into AI tools and we do not share them with anyone, except the parties that run our website and email for us (see chapter 4). We do not have a web form for the self-test.
Do not share confidential details. A general description is enough. Do not put passwords, system names, IP addresses or other confidential details in your answers or in your email. If you do, we will not use those details and will delete or redact them as soon as we notice. Where needed we will let you know, so that you can assess within your own organisation whether any action is required.
2.2 Information about the baseline assessment (nulmeting)
On the paper card you can indicate that you would like to hear more by email about CISO Ally's baseline assessment (nulmeting). This box is optional.
| Data | Name, email address, organisation and, if you provide it, your job title. |
|---|---|
| Purpose | To inform you by email about the baseline assessment. |
| Legal basis | Your consent (Article 6(1)(a) GDPR). For information by email we also ask for consent under Article 11.7 of the Dutch Telecommunications Act. |
| Retention | Information by email: until you unsubscribe. We review our mailing list every year and delete addresses that are no longer correct. If your organisation purchases the baseline assessment or another assignment, we keep (a) our accounts (quotes, contracts, invoices and payment details) for 7 years, because the law requires it (Article 52 of the Dutch General State Taxes Act, Algemene wet inzake rijksbelastingen, and Article 2:10 of the Dutch Civil Code), and (b) the project file (completed questionnaires, reports and correspondence) for 5 years after the assignment is completed, so that we can handle complaints and claims and can help you with follow-up questions. After that we delete or anonymise it. |
You can withdraw your consent at any time, for example by replying to one of our emails or by emailing mvdd@cisoally.com. After that we will not send you any more information about the baseline assessment. Withdrawing consent has no effect on the feedback on your self-test.
2.3 Contact form and email
The contact form on cisoally.com does not send anything itself. When you click 'Send message', your own email program opens a ready-made message addressed to mvdd@cisoally.com. You decide whether to send that message. The website does not store the data from the form.
| Data | The details you enter: name, organisation, type of organisation, job title, subject, email address, phone number and your message. If you email us directly, the details in your email. |
|---|---|
| Purpose | To answer your question and, if you wish, to prepare a meeting or a quote. |
| Legal basis | Our legitimate interest in answering questions (Article 6(1)(f) GDPR). If your question concerns a possible assignment, the basis is taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR). |
| Retention | If your message has no follow-up, we keep it until 2 years after our last contact and delete it after that. If the contact leads to an assignment, the periods in 2.2 apply. As long as you have an ongoing business relationship with us, we keep your contact details for as long as the relationship lasts and review them every year. If you want us to delete your data earlier, email mvdd@cisoally.com; we handle that within one month. |
2.4 Website visits, statistics and cookies
Cookies. Our website is a static website and does not use cookies. We do not store data in your browser to track visitors.
Visitor statistics. We want to know how many people visit our website and which pages they read. For this we use GoatCounter (cisoally.goatcounter.com), an external party. GoatCounter works anonymously and without cookies. According to GoatCounter, IP addresses and full browser details are not stored. We only see summarised figures, such as pages, country, browser type and referring website. We cannot see who you are. Your browser loads the measurement script (count.js) from GoatCounter; that file is delivered via a content delivery network (BunnyCDN), which receives technical data such as your IP address in the process. Visitor figures stay in GoatCounter for 31 days. After that we only keep monthly totals (counts per month), which contain nothing about individual visitors. The legal basis is our legitimate interest in improving the website (Article 6(1)(f) GDPR).
Fonts and icons. Fonts and icons are hosted on our own website. Your browser does not fetch them from Google, Cloudflare or other parties.
Server logs. Our hosting provider Namecheap records technical data with every visit, such as your IP address, the requested file, time and browser type, for the operation and security of the website (legitimate interest, Article 6(1)(f) GDPR). According to Namecheap, the raw log files in our hosting account may contain only a few hours' worth of data, because they are discarded after the system processes them. We have set our account so that archived log files are deleted after one day. Namecheap also keeps technical logs, backups and statistics that may contain IP addresses. With our hosting plan we cannot switch this off or shorten it, and Namecheap does not disclose how long it keeps this data. According to Namecheap's terms, data is kept for as long as necessary to provide the hosting service. We do not use it to track or identify visitors. If you would like to know more, email mvdd@cisoally.com.
Links to other websites. Our website contains links to other websites, such as the websites of our strategic partners. Their own privacy statements apply on those websites.
2.5 Current projects and assignments
For current assignments we keep data for as long as the assignment lasts. After that the periods in 2.2 apply.
2.6 Data we do not receive from you directly
Sometimes we receive your name and business contact details not from you yourself, but from your organisation or from public sources (such as your organisation's website). We only use them to contact you about our services; you will hear this within one month at the latest or at our first contact, and you can object. The legal basis is our legitimate interest in establishing business contact (Article 6(1)(f) GDPR); how long we keep the data is stated in 2.3.
3. Smart tools and AI
We use smart tools that speed up analysis and document work. Client data does not go into them without the client's permission. Your answers to the self-test never go into AI tools: an adviser reads them personally. We do not make decisions about you that are based solely on automated processing.
4. Who we share data with
We do not sell your data. We only share it with parties that provide services for us, and only as far as necessary. For hosting our website we use Namecheap, and for email we use Google (Google Workspace). These parties process data on our behalf. For anonymous visitor statistics we also use GoatCounter (see 2.4). Other than these parties, we only pass data on if the law requires it or if you ask us to, for example for a quote or an assignment.
Transfers outside the EEA. The website is hosted in a data centre in the EU. Namecheap and Google may process data in the United States. Namecheap states in its terms that transfers take place through a legally permitted transfer mechanism. Google LLC participates in the EU-U.S. Data Privacy Framework. If you would like to know which safeguards we rely on, please contact us at mvdd@cisoally.com.
| Service | Party |
|---|---|
| Website hosting | Namecheap (processor) |
| Google (Google Workspace, processor) | |
| Visitor statistics | GoatCounter (anonymous, see 2.4) |
5. Security
We handle your data with care and take appropriate technical and organisational measures to protect it. For example, traffic to our website runs over a secure connection (HTTPS) and only people who need the data for their work have access to it. No system is completely secure. If something does go wrong with your data, we act as the GDPR requires and report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and to you where necessary.
6. Your rights
You have the following rights:
- Access: you can ask which data we hold about you.
- Rectification: you can have incorrect data corrected.
- Erasure: you can ask us to delete your data.
- Restriction: you can ask us to temporarily restrict the use of your data.
- Objection: you can object to the use of your data on the basis of our legitimate interest. You can always object to use for direct marketing; we will then stop immediately.
- Data portability: where applicable, you can ask to receive your data in a common format or have it passed to another party.
- Withdrawing consent: if you have given consent, you can withdraw it at any time. This applies for the future.
Email your request to mvdd@cisoally.com. We respond within one month. Sometimes we first ask you to prove that the request really comes from you.
7. Complaints
Not satisfied with how we handle your data? Please tell us first at mvdd@cisoally.com and we will look for a solution together. You also always have the right to lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).
8. Changes
We may update this privacy statement, for example if our services or the law change. The current version is always available on cisoally.com. We will announce significant changes on the website.