Who is responsible?
CompanyValue B.V. is responsible for personal data processed for account administration, client communications, its own records and the performance and documentation of its professional valuation and review engagements.
Where CompanyValue solely stores and processes client information in the app on a business client’s instructions, it acts as processor for that information. The client determines the purpose and legal basis. The parties enter into a data processing agreement before that processing. Account administration and CompanyValue’s own invoicing remain separate processing activities.
Which data, and whose data?
We process account identifiers, names and email addresses made available at sign-in, business and contact details, subscription and invoice records, valuation inputs, assumptions, results, notes, review requests and attachments. We also process technical information and limited usage events to operate and secure the service.
We receive data from you, the sign-in service and documents supplied by clients. Documents may contain personal data of shareholders, directors, employees or other individuals, such as salary or shareholder loan balances. Only supply information that is necessary and that you may lawfully share.
Purposes and legal bases
We rely on performance of a contract or steps requested before entering into a contract for handling requests, providing services and administering accounts where the individual is personally a party to that contract.
For business contacts, necessary third-party data in professional engagement files and the protection of our legal position, we rely where applicable on legitimate interests in diligent service delivery, business communications and legal claims. For security and abuse prevention, the interest is a reliable service. We assess necessity and balance these interests against individuals’ privacy interests.
Tax records are processed to comply with legal obligations. Where consent is required, we request it separately; it may be withdrawn without affecting earlier lawful processing. We do not use engagement data for our own marketing or make solely automated decisions producing legal or similarly significant effects on individuals.
Hosting, recipients and international transfers
The CompanyValue website and app provided through chatgpt.site are hosted through OpenAI ChatGPT Sites. OpenAI processes published Site data on the provider’s behalf under the ChatGPT Sites Data Processing Addendum or the applicable business DPA. The Sites DPA also covers hosting from Plus and Pro accounts.
The hosting uses Cloudflare infrastructure, including D1 for database records and R2 for files. OpenAI engages subprocessors; see its current subprocessor list. Data is otherwise disclosed only to authorised staff, relevant reviewers, necessary communications and administration providers, or where legally required.
Storage and processing are not guaranteed to remain within the European Economic Area (EEA). ChatGPT Sites currently offers no regional storage selection. The applicable OpenAI DPA provides for European Commission standard contractual clauses or an applicable adequacy decision for transfers outside the EEA. You may request information about the applicable safeguards or a copy by emailing info@companyvalue.nl.
ChatGPT and AI
Signing in with ChatGPT provides access to the app; it does not automatically send your files or review attachments to an AI model. The valuation model uses fixed formulas. CompanyValue does not use client data to train AI models.
“Export to ChatGPT” prepares an overview that you may copy and paste into ChatGPT yourself. It contains financial assumptions and results and may be confidential. Data you enter into ChatGPT or share through a separately enabled connection is subject to your ChatGPT account’s terms and privacy settings. Deleting a CompanyValue file does not delete those conversations.
A separate AI-assisted valuation engagement is performed within the agreed scope. Before CompanyValue supplies client data to an external AI service for that engagement, the relevant processing and confidentiality and model-training arrangements are established.
Retention and deletion
We retain data according to its purpose and necessity: account data for access and administration; app files for the available file service; and review documents for performance, substantiation and necessary follow-up or legal claims. After a subscription ends, existing files in the current app remain readable and exportable while retained. Subscription termination is not a deletion instruction and does not entitle users to unlimited storage.
On termination, a deletion request or completion of an engagement, we assess which data remains necessary. Data no longer required is deleted or anonymised. A legal retention obligation or specific dispute may require retention of only the information needed for that purpose, with restricted use. Basic tax records generally have a statutory seven-year retention period; this does not mean every uploaded client file must be retained for seven years.
There is no general automatic deletion of source files after 30 days. App usage events older than 90 days are deleted when a subsequent usage event is recorded; this is not a daily deletion task and does not cover files or hosting logs. Deletion requests are also assessed for relevant copies held by providers and legal exceptions.
Browser storage and technical information
A manual language choice is stored locally in your browser. The app uses necessary sign-in and session mechanisms. The app records limited usage events under your account identifier, without financial inputs, project names or notes. These events are not anonymous.
CompanyValue has not added advertising pixels. The hosting service may process technical logs and visitor statistics. See also OpenAI’s information on ChatGPT Sites. Your language choice is not consent to marketing tracking.
Your rights and contact
You may request access, correction, deletion or restriction and, where applicable, portability or object to processing based on legitimate interests. Email info@companyvalue.nl. If needed, we verify identity proportionately and normally respond within one month. Where a lawful extension is necessary, we inform you of the reason and deadline within that first month.
Where we process data solely on a business client’s behalf, we coordinate the request with that client. You may complain to the Dutch Data Protection Authority. Without necessary account or engagement information, we cannot provide the relevant service.
CompanyValue B.V.
Meander 251, 6825 ML Arnhem
KvK: 92660401
info@companyvalue.nl