Who we are
Invelo Express Design is a design subscription service run by Invelo Agency, a Dutch company based in Vlaardingen. Invelo Agency is the controller of the personal data described in this policy. That means we decide why and how your data is used, and we are responsible for it.
- Company
- Invelo Agency, trading as Invelo Express Design
- Address
- Schiedamsedijk 126a, 3134 KK Vlaardingen, the Netherlands
- KvK
- 75859009
- info@inveloagency.com
- Phone
- +31 6 54 72 35 55
We are not required to appoint a Data Protection Officer. Privacy questions go straight to the email address above.
What this policy covers
This policy applies to personal data we process through:
- our website, inveloexpressdesign.com, including the contact form and strategy call requests;
- our design subscriptions (Solo Seat, Growth Seat and Bespoke plans), including onboarding, billing and project work;
- our emails, Slack channels and other communication with clients.
It does not cover other websites we link to. Those sites have their own privacy policies, and we are not responsible for how they handle your data.
Data we collect
Data you give us
- Contact and call requests: your name, email address, phone number, company name and the message you send us.
- Subscription and billing: name, company name, billing address, email address, VAT number and payment details. Card and bank details are processed by our payment provider. We never see or store your full card number.
- Project work: design requests, feedback, brand assets, files and messages you share through Slack, email or your Brand Memory System™. Please only share personal data about other people, such as photos of your team, when you are allowed to.
Data we collect automatically
- Technical and log data: IP address, browser type, device and operating system, pages visited, the page you came from, and the date and time of your visit. Our hosting provider records this to keep the site secure and running.
- Cookie and tracking data: how you use our site and which of our ads you saw or clicked. We only collect this after you give consent (see section 05).
We do not ask for sensitive data, such as health information, and we ask you not to send it to us.
How and why we use it
The GDPR requires a legal basis for every use of personal data. This table shows what we use your data for and which basis applies.
| Purpose | Data used | Legal basis |
|---|---|---|
| Answering your questions and scheduling strategy calls | Contact details, your message | Pre-contractSteps you ask us to take before a contract, Art. 6(1)(b). For general questions, our legitimate interest in replying, Art. 6(1)(f). |
| Delivering your subscription: design requests, revisions, support via Slack and email, and your Brand Memory System™ | Contact details, project data, communication | ContractPerformance of our contract with you, Art. 6(1)(b). |
| Invoicing, payments and bookkeeping | Billing and payment data | Contract Legal dutyArt. 6(1)(b), and Dutch tax law, Art. 6(1)(c). |
| Keeping the website secure and working | Technical and log data | Legitimate interestA safe, working website, Art. 6(1)(f). |
| Measuring how our website is used so we can improve it | Analytics cookie data | ConsentArt. 6(1)(a). |
| Showing you relevant ads and measuring our campaigns | Advertising cookie and pixel data | ConsentArt. 6(1)(a). |
| Sending newsletters, offers and service updates by email | Name, email address | ConsentArt. 6(1)(a). For existing clients, our legitimate interest in telling you about similar services, Art. 6(1)(f). Every email has an unsubscribe link. |
| Handling disputes and legal claims | Data relevant to the case | Legitimate interestArt. 6(1)(f). |
Where we rely on legitimate interest, we have weighed our interest against your privacy, and you can object at any time (see section 09). We do not make decisions about you based only on automated processing, including profiling, that have legal or similarly significant effects.
Cookies and tracking
Cookies are small files a website stores on your device. Pixels and tags are small pieces of code that do a similar job. We use three kinds:
- Functional cookies make the site work, for example by remembering your cookie choice or protecting forms against spam. These do not need consent.
- Analytics cookies show us which pages people visit and how they found us. They are only placed after you accept them.
- Marketing cookies and pixels let advertising platforms measure our campaigns and show our ads to people who visited our site. They are only placed after you accept them.
| Tool | Provider | Purpose | Type |
|---|---|---|---|
| Google Analytics 4 (via Google Tag Manager) | Google Ireland Ltd. | Website statistics | Analytics |
| Meta Pixel | Meta Platforms Ireland Ltd. | Measuring and targeting ads on Facebook and Instagram | Marketing |
| LinkedIn Insight Tag | LinkedIn Ireland Unlimited Company | Measuring and targeting ads on LinkedIn | Marketing |
| Google Ads conversion tracking and remarketing | Google Ireland Ltd. | Measuring and targeting ads on Google | Marketing |
When you accept marketing cookies, the Meta Pixel and LinkedIn Insight Tag send data about your visit to Meta and LinkedIn. For that collection and transfer, we and the platform are joint controllers. What Google, Meta and LinkedIn then do with the data on their own platforms is their responsibility and is covered by their own policies: Google, Meta and LinkedIn.
You can change or withdraw your consent at any time by reopening the cookie settings, or by deleting cookies in your browser. Withdrawing consent does not affect processing that took place before you withdrew it.
Who we share it with
We only share personal data when we need to for the purposes in section 04. We never sell it. The parties we work with are:
- hosting and IT providers that run our website and email;
- our CRM and email platform, where we keep contact details and conversation history and send newsletters;
- our payment provider, which processes subscription payments;
- collaboration tools such as Slack, which we use for client support and project communication;
- design and AI software that we use to produce your designs;
- analytics and advertising platforms (Google, Meta and LinkedIn), only if you accepted the relevant cookies;
- our accountant and legal advisers, who are bound by confidentiality;
- government bodies, such as the Dutch Tax Administration, when the law requires it.
Providers that process data on our behalf do so under a data processing agreement. They may only use your data on our instructions and must keep it secure.
Transfers outside the EU
Some of our providers, such as Google, Meta, LinkedIn and Slack, are based in the United States or can access data from there. When personal data leaves the European Economic Area, we keep it protected by working with providers certified under the EU-US Data Privacy Framework, or by agreeing the European Commission's Standard Contractual Clauses with them. You can ask us for details of these safeguards.
How long we keep it
We keep personal data no longer than we need it. When a period below ends, we delete the data or make it anonymous.
| Data | How long |
|---|---|
| Contact and call requests that do not lead to a subscription | 12 months after our last contact |
| Client, project and brand data, including your Brand Memory System™ | For the length of your subscription and up to 2 years after it ends, so we can handle follow-up questions and claims. You can ask us to delete brand files sooner. |
| Invoices and financial records | 7 years, as required by Dutch tax law |
| Analytics data | 14 months |
| Website log files | Up to 6 months |
| Newsletter details | Until you unsubscribe |
Your rights
Under the GDPR you have the following rights:
- Access: ask for a copy of the personal data we hold about you.
- Rectification: ask us to correct data that is wrong or incomplete.
- Erasure: ask us to delete your data, unless we have to keep it, for example for tax reasons.
- Restriction: ask us to limit how we use your data while a question or complaint is being handled.
- Portability: receive the data you gave us in a common, machine-readable format, or have it sent to another company.
- Objection: object to processing based on our legitimate interest. If you object to direct marketing, we will always stop.
- Withdrawing consent: where we rely on your consent, you can withdraw it at any time.
To use any of these rights, email info@inveloagency.com. We may ask you to confirm your identity first. We reply within one month. For complex or multiple requests we can extend this by up to two more months, and we will tell you if we need to and why. Using your rights is free, unless a request is clearly unfounded or excessive.
If you are unhappy with how we handle your data, please tell us first so we can try to put it right. You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or with the supervisory authority in your own EU country.
California residents
If you live in California, the California Consumer Privacy Act (CCPA), as amended by the CPRA, may give you the right to:
- know which categories and specific pieces of personal information we have collected about you, where it came from, why we collected it and who we shared it with;
- ask us to delete or correct it;
- opt out of the sale or sharing of your personal information;
- use these rights without being treated differently.
We do not sell personal information for money. Advertising pixels can count as "sharing" for cross-context behavioral advertising under the CCPA, and you can opt out of that by declining marketing cookies. To make a request, email info@inveloagency.com. We respond within 45 days and may extend this once by another 45 days, in which case we will tell you why.
Security
We take appropriate technical and organizational measures to protect your data against loss, misuse and unauthorized access. These include an encrypted (HTTPS) connection on our website, access limited to the team members working on your account, and data processing agreements with every provider that handles personal data for us. If a data breach puts your rights at risk, we will report it to the Autoriteit Persoonsgegevens and, where the law requires, tell you directly.
Children
Our website and services are meant for businesses and are not aimed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has sent us personal data, contact us and we will delete it promptly.
Changes to this policy
We may update this policy when our services, our tools or the law change. The date at the top shows when it was last updated. If a change is significant, we will let our clients know by email before it takes effect.
Contact us
Questions about this policy or about your data? Get in touch and we will help.
Schiedamsedijk 126a, 3134 KK Vlaardingen, the Netherlands
KvK 75859009
info@inveloagency.com · +31 6 54 72 35 55 Email us