Privacy statement
Version 1.0 · 10 October 2026
Companies that were checked · Users · Visitors
1. Who we are
about.biz is a service of Hiwodo B.V., Saturnusstraat 60, unit 8, 2516 AH Den Haag, the Netherlands, Dutch Chamber of Commerce (KvK) 24412690, VAT NL817804225B01. We are the controller for the processing in this statement. Privacy questions: support@about.biz. We have no data protection officer; we are not required to.
Hiwodo B.V. also provides Cloudpliant. about.biz uses Cloudpliant's technology for the checks in Dutch registers. We use that data only for about.biz.
2. If your company was checked
Why. A business user (the requester) asked us to check your company, before or during a business relationship.
What we check, and at which source:
- public technical data of your own domain: DNS, the website certificate (TLS), security.txt and a link to your trust center (not its content);
- a Legal Entity Identifier (LEI), if your company has one, in GLEIF's public LEI register;
- if a Dutch registration number is known: the registration in the Handelsregister (KvK), insolvency (Centraal Insolventieregister) and sanctions lists (through OpenSanctions).
What we do not check: lists of politically exposed persons, criminal records, watchlists, media reports, home addresses and officers.
When it is personal data. If your company is a sole trader or a partnership (eenmanszaak, vof, maatschap or cv), or if the contact address names you, this is personal data about you. For a private or public limited company or a foundation the company data itself is not personal data, but a named contact address is.
Legal basis. Legitimate interest (GDPR article 6(1)(f)): the requester's interest in knowing who it does business with, and ours in making that check possible and letting you answer once. We send you a summary of our balancing test on request.
Who sees it. Only the requester who asked, until you claim your passport. Then you decide. Nothing is public unless you choose a public page.
Where the contact address came from. The requester supplied it, and the requester sends the invitation from their own mailbox. We do not collect addresses from websites, registers or security.txt files.
Your right to object. You can always object, with one click on the request page or through support@about.biz. We then delete the check and you hear nothing more from us about this request. You do not have to give a reason.
Retention: see section 6.
No automated decisions. Labels come from fixed rules or from a named member of staff. We do not score or rank companies.
3. If you use about.biz
- Account: name, work e-mail, organisation and role, sign-in records (sign-in links), your requests, the facts you add, statements you sign and share links you create. Legal basis: the contract (GDPR article 6(1)(b)) for your account, and legitimate interest for security logs and abuse prevention.
- Confirmation codes: if you enter an address on your own domain (for example security@), or choose to confirm your domain through its admin@ or postmaster@ address when claiming, we send one e-mail with a code there. Your passport shows only that the address was confirmed, not the administrator's address.
- Signers: name, role, verified work e-mail, time and the signed version. Visible to whoever the company shares with.
- Requesters: your name, job title and organisation are visible to the company you check, in the invitation and on the request page.
- Share links (abt.bz): we record when a share link was viewed and, if the viewer is signed in, by which organisation. Only the owner of the link sees this.
4. Visitors
- No cookies for visitors, no analytics cookies and no third-party trackers. Only signed-in users get a session cookie.
- If you choose light or dark, your own browser remembers that choice; we never receive it.
- Server logs (IP address, time, page) are kept by our hosting provider for at most one day, for security and troubleshooting.
- The free tools: the result of a check is not stored. To limit abuse we count per day the checks per visitor, with a code derived from the IP address that changes every day. We do not store the IP address itself. We do the same for how often a share link is opened per day.
- E-mails from about.biz contain no tracking pixels and no tracked links.
5. Recipients and processors
| Party | Role | What | Where |
|---|---|---|---|
| Vercel Inc. | Processor | Hosting of the website and the app, storage of certificate PDFs | Frankfurt (DE); Vercel is based in the US |
| Databricks Inc. (Neon) | Processor | Database | Frankfurt (DE); Databricks is based in the US |
| Sendinblue SAS (Brevo) | Processor | The app's e-mail: sign-in links and confirmation codes | EU (FR) |
| Google (Workspace) | Processor | Support and staff mailboxes | EU and US |
| OpenSanctions Datenbanken GmbH | Processor | Matching against sanctions lists (the company name; for a sole trader the owner's name) | DE |
| Cloudpliant (Hiwodo B.V.) | Part of our own company | Running the KvK, insolvency and sanctions checks | DE (Hetzner) |
| Sources (KvK, Rechtspraak/CIR, GLEIF) | Independent public sources | We ask, they receive the query | NL / CH |
| Requesters and recipients you approve | Independent controllers | Your shared facts | Wherever they are |
Each processor's own data processing terms apply. Transfers to the US rely on the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.
6. Retention
| Data | Period |
|---|---|
| Check, the company never opened the link | 30 days after the request, then deleted |
| Check, the company opened the link but did not claim | At most 90 days after the request, then deleted |
| Check, the company objected | Deleted within 24 hours |
| Objection list | As long as the objection must work; only a hash of the address or domain and the date |
| Course of a request | 12 months after closure |
| Facts and history of a claimed company | While the passport exists; deleted within 30 days after you close it, except signed statements |
| Signed statements | 5 years after they are replaced or withdrawn, as evidence of what was stated |
| KvK data | Always shown with its retrieval date |
| Insolvency data | 6 months after the insolvency ended |
| Account data | While the account exists; deleted within 30 days after you close it |
| Server logs | At most one day |
| Database restore points | At most 7 days |
To close your account or passport, e-mail support@about.biz.
7. Your rights
You have the right of access, rectification, erasure, restriction, objection and, where it applies, portability. E-mail support@about.biz, or use the buttons on the request page. We answer within one month. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
8. Security
Connections to about.biz are always encrypted (HTTPS). The database and the files are stored encrypted in Frankfurt. Only named staff who need it for their work can access production data. No AI model makes decisions about you. You can report a vulnerability through our security page.
9. Changes
The version date is at the top. We e-mail account holders before important changes.