Privacy,
in plain terms.

Who we are

fundflow is a product of CRJ Ventures V.O.F., based in Amsterdam, the Netherlands. CRJ Ventures V.O.F. is the controller responsible for the personal data described in this notice.

For privacy questions or requests, email rj@fundflow.nl. This notice covers our public website and inquiries, not personal data processed within software we build for clients, which is covered by the relevant client agreements and privacy information.

What we collect

When you use our contact form, we receive your name, email address, subject and message, together with your IP address and the time of submission. If you email us directly, we receive your email address and the information you include in your correspondence.

Our server uses IP addresses and submission times to limit spam and abuse. Application logs can include IP addresses, delivery or error details, and a partially masked email address. Our hosting provider may also process technical request data to deliver and secure the site.

The contact form requires its four visible fields so we can handle your inquiry. You can email us instead. Please do not include sensitive personal information or confidential investor data.

Why we use it

We use your contact details and correspondence to respond, discuss your requirements and arrange a demo. Where you ask us to take steps towards a contract with you, our legal basis is those pre-contractual steps. For other business inquiries, we rely on our legitimate interest in communicating with prospective customers and business contacts.

We process technical and anti-spam data on the basis of our legitimate interest in keeping the website reliable and preventing misuse. Where records must be kept by law, we rely on that legal obligation.

Submitting an inquiry does not subscribe you to a newsletter. We do not use this information for automated decisions that produce legal or similarly significant effects on you.

Who receives it

Your inquiry is available to the fundflow team handling it. We use Resend to deliver contact-form emails, including the information you submit, your IP address and the submission time. These messages are delivered to our team's Google-hosted mailboxes. Hosting and infrastructure providers also process data needed to operate the website.

Providers may process information outside the European Economic Area, including in the United States. Such transfers must meet GDPR requirements, for example through an applicable adequacy decision or standard contractual clauses and any necessary additional safeguards. Contact us for information about the safeguards applicable to your data and how to obtain a copy.

See also Resend's privacy notice and Google's privacy notice.

How long we keep it

We keep inquiry correspondence for as long as needed to handle your request and relevant follow-up. The period depends on whether a discussion is ongoing, whether it leads to a client relationship, and whether records are needed to meet legal obligations or establish, exercise or defend legal claims.

The form's in-memory rate limiter counts attempts within a one-hour window. This is not the retention period for emails or server logs, which are separate records. Technical records are retained according to operational and security needs and the relevant provider settings. Contact us if you would like more information about a particular record or to request its deletion.

Cookies & external fonts

Our website application does not set cookies or use browser storage for advertising or analytics. We have not added advertising pixels or visitor-tracking scripts.

We load fonts from Google Fonts. Your browser connects to Google to request these files, sharing your IP address and technical request information. Google states that its Fonts API does not set or log cookies. We use these fonts for the site's typography, relying on our legitimate interest in presenting a consistent, readable website. Read about Google Fonts and privacy.

Your rights

Depending on the circumstances, you can ask to access, correct or delete your personal data, restrict its use, or receive it in a portable format. You can object to processing based on legitimate interests. If processing is based on consent, you can withdraw that consent without affecting earlier lawful processing.

Send requests to rj@fundflow.nl. We may need to verify your identity. We normally respond within one month; if a permitted extension is needed, we will explain why within that month.

You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, or your local data protection authority.

Changes to this notice

We update this page when our website or data practices change. The date above shows when this notice was last revised.