1. Who we are
SimpliSoft B.V. ("we"), Tokyostraat 19 M, 1175 RB Lijnden, the Netherlands, Chamber of Commerce number 96268735. Email: privacy@simplisoft.app.
This policy applies to the SimpliSoft Portal, its modules, the SimpliSoft app for Android and iOS, and the customer portals organisations run with it. Our public website has its own privacy policy.
2. Our role
The Portal is used by organisations (our customers).
We are controller for the data in section 3: accounts, sign-in and security, support, the agreement with your organisation, invoicing, acceptance of our terms, and account and security emails.
We are processor for everything an organisation puts into or pulls into the Portal (section 4). The organisation is the controller and we process that data only on its instructions. If your data is in the Portal because an organisation put it there, please contact that organisation first.
3. Personal data we process as controller
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Your account | Name, email address, role, organisation | Art. 6(1)(f) GDPR, our interest in giving the users of our customers access to the service their organisation contracted | As long as your account exists |
| Sign-in and security | Sign-in details (with single sign-on, those your organisation's identity provider returns), sign-in events and server logs with IP address, browser and time, an audit log of significant actions, and, to monitor the service, which accounts are active and, per country derived from the IP address, how many visits and sign-ins there are | Art. 6(1)(f), our interest in a secure and accountable service | Server and gateway logs with IP addresses: 90 days. Monitoring of active accounts: 30 days. Sign-in events and expired sessions: 12 months. The audit log: as long as your organisation's account exists |
| Usage statistics: which pages of the Portal are used, to improve it | Per page view: the address without ids or query, the referring website (its domain only), screen size, language, browser, operating system, device type and country. Your IP address is used only to derive the country and an anonymous visit code that changes every month, and is not stored with the statistics. Not linked to your account or organisation | Art. 6(1)(f), our interest in knowing which parts of the Portal are used, so we can improve it | 12 months |
| Support, including the Simpli assistant (which uses an AI model) | Your messages and the resulting tickets | Art. 6(1)(f), our interest in supporting our users | As long as your account and your organisation's account exist |
| Concluding and managing the agreement with your organisation | Name, email address, phone number and position of contact persons and signatories | Art. 6(1)(f), our interest in concluding and performing the agreement with your organisation | As long as the agreement runs, then as long as needed for claims about it; seven years where it is part of our financial records |
| Invoicing | Name, address and VAT number of the organisation; name, email address and phone number of its billing contact | Art. 6(1)(f), our interest in invoicing the agreement; for our financial records art. 6(1)(c) | Seven years (article 52 of the General Tax Act) |
| Acceptance of our terms and the SimpliComply disclaimer | Which version was accepted, by whom, when and at which prices; for the disclaimer also the text, IP address and browser | Art. 6(1)(f), our interest in being able to prove what was agreed | For the duration of the agreement with your organisation plus five years (the limitation periods of articles 3:307 and 3:310 Dutch Civil Code); the IP address stored with the SimpliComply disclaimer is deleted after one year |
| Account and security emails (password resets, account messages, ticket notifications) | Name, email address, message | Art. 6(1)(f), our interest in running the service your organisation uses | As for the account |
Where the data comes from. Mostly from your organisation, which gives us your name, email address and role when it invites you, and from you. With single sign-on, your organisation's identity provider supplies your sign-in details.
What you must provide. To get an account, your name and email address are needed. Without them we cannot give you access. No law obliges you to provide them.
4. Personal data we process for organisations (as processor)
What we hold depends on the modules an organisation uses. The organisation decides the purpose and legal basis, and our agreement with it sets out what happens to the data when that agreement ends. Invitations, notifications and reports the Portal sends to you or to recipients you add are sent on the organisation's instruction.
- SimpliDash, SimpliOps, SimpliLog: shipment data from the organisation's own systems, including names and addresses of shippers and consignees; staff assignments, notes and tasks; the SimpliDash assistant's questions and answers, kept for 90 days.
- SimpliTrack: shipment data including the names of customers, shippers and consignees; the organisation's customers' users (name, email, access settings), their notification and report recipients, followed shipments and document downloads and uploads.
- SimpliComply: names, addresses and registration details of business partners screened, the results, uploaded documents, company financial reports, quality records and incident reports.
- Screens (optional function, if the organisation uses it): what the organisation's administrator puts on a screen on a wall, such as running shipments, tasks and figures, and the time, title and location of appointments from a calendar the organisation published itself. A screen is visible without sign-in to whoever is in front of it.
- SimpliAgents (optional module, if the organisation uses it): agent instructions, conversations, attached documents and a record of actions. A question you speak in the app is sent as sound to our AI provider only to turn it into text; we do not keep the recording. An agent can also work for the organisation on a schedule or when something happens, with the rights of the user who set that up; what it proposes, and who approved or rejected it, is kept. The organisation decides whether a report, a task or a quote request may be carried out without approval. If the organisation connects a Microsoft 365 mailbox, the Portal reads the mail that mailbox receives (sender, subject, text) so an agent can propose work; it never sends, moves or changes mail.
- SimpliPeople: employee records, leave requests and leave (for sick leave only the fact, dates and days), overtime, the decisions of line managers and HR on them, qualifications and training results; a calendar link HR publishes shows per employee only that they are away and when.
- SimpliAccept (optional module, if the organisation uses it): records of goods the organisation accepts, with the shipper's name and city, the names of the staff who took in and accepted them, and photos of the goods. The organisation can share an accepted record with a link; whoever holds the link sees it without sign-in.
- SimpliQuote (optional module, if the organisation uses it): quote enquiries, with the sender's name, e-mail address and the text of the enquiry, the business partner it belongs to and the reply the organisation drafts; the Portal's AI reading proposes the fields from the text of that mail. Where the organisation switched it on, the quotation and the text of the enquiry go to the organisation's own forwarding system.
- The SimpliSoft Portal app: the same data as the modules above, on your phone, with an outbox of what you entered while offline until it is sent.
- SimpliFleet: vehicles linked to a named driver or employee (which can be the employee's own car), with licence plate, VIN, contract and insurance details, odometer readings, maintenance and damage records with their invoices, and notes.
5. Who receives your data
We share personal data only with these categories of recipients, and only in so far as your organisation uses the feature concerned:
- our hosting provider (EU);
- our email delivery provider (EU);
- our email and office software provider (EU), for emails you send us and support requests the Portal forwards to us;
- a provider of AI models in the EU, for the AI features in the Portal;
- screening and credit information providers, for SimpliComply;
- our compliance partner, for support on SimpliComply;
- your organisation's own systems it connects to the Portal (such as its forwarding system or a mailbox), and its own mail server where it asked us to send its mail that way;
- our bookkeeping and accounting providers and professional advisers where necessary, and public authorities where the law requires it.
6. How long we keep data
We keep personal data only as long as needed for the purpose in section 3 or 4, or longer where the law requires it. Backups are replaced on a rolling basis, so deleted data also disappears from them.
7. Transfers outside the European Economic Area
Per category of recipient in section 5:
- hosting, email delivery and AI models: in the EU. Support staff of the email delivery provider's group in the United States and India can access the data, and the AI model provider may transfer data outside the EEA, in both cases only under the Standard Contractual Clauses of the European Commission (for the United States also under the EU-US Data Privacy Framework);
- email and office software: in the EU (Ireland); the provider's group may also process data in the United States, under the EU-US Data Privacy Framework (an adequacy decision of the European Commission) and the Standard Contractual Clauses;
- screening and credit information providers: in the EU; the credit information provider's group may also process data in the United Kingdom, under an adequacy decision of the European Commission;
- our compliance partner: in Switzerland, under an adequacy decision;
- your organisation's own systems: wherever your organisation runs them;
- bookkeeping and accounting providers and professional advisers: in the EEA.
You can ask us at privacy@simplisoft.app for a copy of the Standard Contractual Clauses.
8. Cookies and browser storage
When you sign in, the Portal sets a sign-in cookie that keeps you signed in. By default it is a session cookie: it is deleted when you close your browser, or earlier when you sign out. If you tick "Keep me signed in" on the sign-in page, the sign-in cookie stays after you close your browser, until you sign out or for up to 400 days, and a small cookie remembers that choice for the same period; signing out deletes both. Some browsers restore session cookies when you reopen them ("continue where you left off"); that is a setting of your browser. The Portal also sets a few cookies that a specific function needs for a short time, and two that remember a display choice for up to a year: whether you closed the menu in Settings, and your last list view in a customer portal. It also uses your browser's storage to remember settings on your device. If you use the SimpliDash assistant, your last conversations with it (up to 15) are kept in your browser's storage, on that device only. To count which pages are used (section 3), the Portal loads a statistics script from our own server. It sets no cookies and stores nothing on your device. If your browser sends a "Do Not Track" signal, it counts nothing. We do not use advertising or tracking cookies.
The SimpliSoft app. The app for Android and iOS shows the modules your organisation switched on for you. It uses the camera only when you scan a label or take a picture, and the microphone only when you tap the microphone button to speak a question to an agent. If you pick a picture from your library, the app receives only the pictures you pick. We remove location data from pictures before we store them. The app does not use your location and sends no notifications. On the phone it keeps your sign-in (encrypted), the screens and choices you last used, and, while there is no connection, what you entered in SimpliAccept, until it is sent. Signing out removes all of it, except acceptances that were not sent yet: those stay on the phone, for you only, until you sign in again and they are sent. On Android the app is not part of a backup of your phone; on an iPhone it can be. Removing the app removes all of it. Before you first use an AI feature (a question to an agent or to Simpli, or the HS code check in SimpliComply), the app asks whether it may send what you enter, including documents you add, to our AI provider, Mistral AI (France); if you say no, the rest of the app works as before. The app contains no analytics, advertising or crash-reporting software.
9. Your rights
You have the right to access, correct and erase your personal data, to restrict its processing and to receive it in a machine-readable format (articles 15 to 20 GDPR). Send your request to privacy@simplisoft.app; we respond within one month and may ask you to confirm your identity. For data we process for an organisation (section 4), please contact that organisation; if you contact us, we pass your request on.
Deleting your account. Your organisation creates your account; there is no sign-up in the app. To have your account and the data we hold about it (section 3) deleted, ask your organisation's administrator, or write to privacy@simplisoft.app and name your organisation. What your organisation recorded in the Portal (section 4) stays under its control.
Your right to object. Where we rely on our legitimate interests (article 6(1)(f)), you can object at any time on grounds relating to your particular situation (article 21 GDPR). We then stop, unless we have compelling legitimate grounds or need the data for a legal claim.
You can also complain to the Autoriteit Persoonsgegevens (https://www.autoriteitpersoonsgegevens.nl) or to the supervisory authority where you live or work.
10. Automated decisions
We do not take decisions about you based solely on automated processing that have legal or similarly significant effects (article 22 GDPR).
11. Changes
We may update this policy. The date at the top shows the current version.