Privacy Policy
Last updated: April 2026
1. Data controller
Distilo is operated from the Netherlands. Whichever domain you reach us on, the controller of your personal data is the Dutch entity below, and the GDPR applies.
| Company name | Leonardo Christino (t/a Distilo) |
| Chamber of Commerce (KvK) | 89650166 |
| VAT ID | NL004750027B58 |
| Contact | contact@distilo.nl |
| Data protection contact | privacy@distilo.nl |
2. What personal data we collect
2.1 Contact form (/contact)
- Name, email address, company name, size (number of customers)
- Areas of interest (churn, overdue payments, revenue, channel, losses, segmentation)
- Optional message
Legal basis: performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR).
2.2 Newsletter
- Email address
Legal basis: consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time.
2.3 Technical data
- PARAGLIDE_LOCALE cookie: stores your language preference. Duration: 400 days. Strictly necessary for the site to work.
- PostHog (product analytics): usage events, identification of logged-in users, and session recording on specific screens (creating an analysis and viewing a report). Enabled only with your consent (see the cookie banner); until then we set no cookies and record no personal data. Hosted in the European Union (Frankfurt). You can change your choice at any time using the control at the top of this page.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR) for strictly necessary cookies; consent (Art. 6(1)(a) GDPR, and Art. 11.7a of the Dutch Telecommunications Act for storing cookies) for PostHog product analytics.
2.4 Data we do NOT collect
- We use no advertising cookies and no cross-site tracking
- We use no Google Analytics, Facebook Pixel or ad networks
- We do not collect payment card data (payments are handled by our payment provider, which we never see card details from)
3. Purposes of processing
- Responding to contact requests and commercial proposals
- Sending communication about our services (newsletter, with consent)
- Improving the performance and user experience of the website
- Complying with legal obligations
4. Sharing of data
Your data may be shared with:
| Third party | Purpose | Location | Safeguard |
|---|---|---|---|
| Hetzner Online GmbH | Website, application and database hosting (the Convex backend runs self-hosted on this infrastructure) | Germany (European Union) | Processor within the EU; DPA |
| PostHog | Product analytics, session recording and error monitoring (only with consent) | European Union (Frankfurt) | DPA; data stays within the EU, no transfer outside the EEA |
We do not sell, rent or trade your personal data.
5. Transfers outside the EEA
Website and application data, including contact form and newsletter data, is stored on servers in Germany (Hetzner Online GmbH) and product analytics is hosted in the European Union (Frankfurt). We do not transfer this data outside the EEA.
6. Retention periods
| Data | Retention |
|---|---|
| Contact form data | For as long as the commercial relationship lasts, or until you ask for deletion |
| Newsletter email | Until you unsubscribe or ask for deletion |
| Necessary cookies | PARAGLIDE_LOCALE: 400 days |
7. Your rights (Art. 15-22 GDPR)
You have the following rights:
- Right of access (Art. 15): ask which data we process about you
- Right to rectification (Art. 16): have inaccurate or incomplete data corrected
- Right to erasure (Art. 17): request deletion of your personal data
- Right to restriction (Art. 18): have the processing of your data restricted
- Right to data portability (Art. 20): receive your data in a structured format
- Right to object (Art. 21): object to processing based on legitimate interest
- Rights regarding automated decision-making (Art. 22): not be subject to automated decisions
- Right to withdraw consent (Art. 7(3)): at any time, without affecting the lawfulness of processing before withdrawal
To exercise your rights, email privacy@distilo.nl. We respond within 1 month (Art. 12(3) GDPR).
If your rights are not respected, you can lodge a complaint with the Dutch data protection authority (Autoriteit Persoonsgegevens) via autoriteitpersoonsgegevens.nl.
8. Security
We take appropriate technical and organisational measures to protect your data, including: encryption in transit (HTTPS/TLS), restricted access control, and security monitoring by our infrastructure providers.
9. Changes
This privacy policy may be updated from time to time. The date of the last change is always shown at the top of this page. We recommend reviewing this page periodically.
10. Contact
For questions about this privacy policy or the processing of your data:
Privacy: privacy@distilo.nl
General: contact@distilo.nl