Imagine AI B.V.
Website: https://imagine-ai.net
Last updated: 19 October 2026
1. Introduction
Imagine AI B.V. (“Imagine AI”, “we”, “us”, or “our”) is committed to protecting your privacy and ensuring that your personal data is handled responsibly, securely, and transparently.
This Privacy Policy explains how we collect, use, store, share, and protect personal data when you visit our website, contact us, engage with our services, or otherwise interact with our organisation.
We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming, or “UAVG”), and other applicable Dutch and European data protection legislation.
By using our website or services, you acknowledge that you have been informed about the processing activities described in this Privacy Policy. Where consent is required by law, we will request it separately.
2. Who We Are
The data controller responsible for the processing of personal data described in this Privacy Policy is:
Imagine AI B.V.
- Registered address: Utrecht, The Netherlands
- Chamber of Commerce (KvK): 77647181
- Email: info@imagine-ai.net
- Website: https://imagine-ai.net
Imagine AI provides artificial intelligence consulting, AI strategy development, generative AI implementation, software development, and related training and advisory services.
For questions regarding this Privacy Policy or the processing of your personal data, please contact us using the details above.
3. Scope of This Privacy Policy
This Privacy Policy applies to personal data processed by Imagine AI in connection with:
- Visitors to our website, imagine-ai.net.
- Individuals who contact us through email or other communication channels.
- Prospective customers and business contacts.
- Customers and representatives of organisations using our services.
- Participants in our training sessions, demonstrations, and workshops.
- Individuals whose personal data we process in our capacity as a data controller.
When we provide AI development, implementation, or consulting services to business customers, we may process personal data on their behalf.
In these circumstances, the customer may act as the data controller and Imagine AI as the data processor. Such processing is governed by the relevant contractual arrangements, including a Data Processing Agreement (DPA) where required by Article 28 GDPR.
Where Imagine AI acts solely as a processor, the relevant customer’s privacy notice generally provides information about the purposes and legal basis of that processing.
4. Personal Data We Collect
The personal data we collect depends on how you interact with us.
4.1 Information You Provide Directly
When you contact us, request information, or engage with our services, we may collect:
- Full name.
- Business email address.
- Telephone number.
- Company name and job title.
- Business address.
- Information included in correspondence.
- Project requirements and business-related information.
- Any additional personal data you voluntarily provide.
4.2 Information Collected Through Our Website
When you visit our website, certain technical information may be processed, including:
- IP address.
- Browser type and version.
- Operating system and device information.
- Date and time of access.
- Pages requested or visited.
- Referring website addresses.
- Technical error and security log information.
- Cookie information, where applicable.
This information may be necessary for website operation, security, troubleshooting, and, where applicable, website analytics.
4.3 Customer and Business Relationship Data
When we enter into or manage a business relationship, we may process:
- Contact details of customer representatives.
- Business correspondence.
- Contractual information.
- Billing and payment administration.
- Meeting notes and project communications.
- Service-related documentation.
- Information necessary to manage and deliver our services.
4.4 Data Processed During AI Projects
As part of our AI consulting, development, and implementation services, we may process information provided by customers, including documents, datasets, text, images, or other project materials.
Such information may contain personal data relating to employees, customers, suppliers, or other individuals.
The specific processing activities, purposes, retention periods, security requirements, and responsibilities depend on the nature of the project and the applicable agreements.
Where Imagine AI acts as a data processor, we process personal data in accordance with the documented instructions of the relevant customer, subject to applicable law.
5. Purposes and Legal Bases for Processing
We process personal data only where we have a valid legal basis under Article 6 GDPR.
The following table explains the principal purposes and legal bases for processing personal data.
| Purpose | Legal basis |
|---|---|
| Operating, maintaining, and securing our website | Legitimate interests (Article 6(1)(f)) |
| Responding to enquiries and communicating with prospective customers | Legitimate interests or steps prior to entering into a contract (Articles 6(1)(f) and 6(1)(b)), depending on the circumstances |
| Preparing proposals and delivering services | Performance of a contract or legitimate interests (Articles 6(1)(b) and 6(1)(f)) |
| Maintaining customer and business relationships | Legitimate interests (Article 6(1)(f)) |
| Managing invoices, accounting, and tax administration | Compliance with legal obligations (Article 6(1)(c)) |
| Sending marketing communications | Consent or legitimate interests, where permitted by applicable electronic marketing legislation (Articles 6(1)(a) and 6(1)(f)) |
| Website analytics involving personal data | Legitimate interests or consent, depending on the technology and applicable requirements |
| Preventing fraud, misuse, and security incidents | Legitimate interests (Article 6(1)(f)) |
| Establishing, exercising, or defending legal claims | Legitimate interests (Article 6(1)(f)), or legal obligations where applicable |
Our legitimate interests include maintaining a secure and functional website, communicating with business contacts, managing commercial relationships, improving our services, and protecting our organisation against misuse and security threats.
When relying on legitimate interests, we assess whether those interests are overridden by the rights and freedoms of the individuals concerned.
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
We do not process personal data for purposes incompatible with the purposes for which it was originally collected unless permitted by applicable law.
6. Artificial Intelligence and Data Processing
Artificial intelligence is central to our services. We recognise that AI applications may involve additional privacy, confidentiality, and information security considerations.
Depending on the project, AI-related processing may include:
- Analysis and classification of documents.
- Processing of natural-language inputs.
- Retrieval and organisation of information.
- Development and evaluation of AI models.
- Integration of AI systems into existing business processes.
- Generation of reports, recommendations, or other outputs.
- Development and evaluation of retrieval-augmented generation (RAG) applications and other AI solutions.
Where personal data is involved, we assess the applicable data protection requirements and our role as either controller or processor.
6.1 Customer Data and AI Models
The use of customer-provided information for AI development, model training, fine-tuning, evaluation, or inference depends on the specific project and contractual arrangements.
Providing information for an AI project does not, by itself, constitute consent to use that information for unrelated model training.
Any processing of personal data for model training or improvement must have an appropriate legal basis and comply with the applicable contractual arrangements and data protection requirements.
Where external AI technology providers are involved, we assess their role, applicable contractual protections, and relevant data protection considerations.
6.2 Confidentiality and Data Minimisation
We aim to limit the processing of personal data to what is necessary for the relevant project or service.
Where appropriate, privacy-preserving techniques such as anonymisation, pseudonymisation, restricted access, or data minimisation may be used.
6.3 Automated Decision-Making
Our website and ordinary business communications are not intended to involve decisions based solely on automated processing that produce legal or similarly significant effects on individuals.
AI systems developed for customers may support automated analysis or decision-making. The precise functionality and associated responsibilities depend on the specific application.
Where Article 22 GDPR applies, the responsible controller must ensure that the relevant requirements, safeguards, and transparency obligations are met.
7. Cookies and Similar Technologies
Our website may use cookies and similar technologies to support website functionality, security, preferences, and analytics.
Cookies are small files that may be stored on your device when you visit a website.
The main categories are:
Strictly necessary cookies
These support essential website functions, technical operation, and security. Where they meet the applicable legal requirements, they may be used without prior consent.
Analytical cookies
These may be used to understand how visitors interact with our website and improve its performance.
Where analytical cookies have no or only a limited impact on visitor privacy and meet the applicable exemption requirements, prior cookie consent may not be required.
Marketing and tracking cookies
These may be used for advertising, measuring campaigns, or tracking user behaviour.
Such cookies and similar technologies will only be used where the necessary consent or other applicable legal conditions have been satisfied.
Where prior consent is required, we must obtain it before activating the relevant technology.
You may refuse or withdraw consent for non-essential cookies without losing access to the ordinary functionality of the website.
You can also manage stored cookies through your browser settings.
The specific cookies, providers, purposes, and storage durations used by the website must be documented in the website’s cookie information or preference interface.
8. Sharing Personal Data with Third Parties
We may share personal data with third parties where necessary for the operation of our business, the provision of services, or compliance with applicable law.
Depending on the services and technologies used, recipients may include:
- Website hosting and infrastructure providers.
- Email and communication service providers.
- IT maintenance and security providers.
- Cloud infrastructure and storage providers.
- AI technology and model service providers.
- Business software and customer relationship management providers.
- Accountants, legal advisers, and other professional service providers.
- Government authorities or regulatory bodies where disclosure is legally required.
Where third parties process personal data on our behalf, we seek to ensure that appropriate contractual and technical safeguards are in place, including Data Processing Agreements where required.
Third parties may process personal data only in accordance with their applicable legal role, contractual obligations, and relevant data protection legislation.
We do not disclose personal data to third parties for purposes unrelated to our legitimate business activities without an appropriate legal basis.
Where a recipient acts as an independent controller, that recipient is responsible for its own processing activities and applicable privacy obligations.
9. International Data Transfers
Imagine AI is established in the Netherlands and operates under European data protection legislation.
Depending on the technical infrastructure, service providers, and customer projects involved, personal data may be processed or accessed from countries outside the European Economic Area (EEA).
Where personal data is transferred outside the EEA, we ensure that a valid transfer mechanism is available under Chapter V GDPR.
Depending on the circumstances, this may include:
- An adequacy decision issued by the European Commission.
- European Commission-approved Standard Contractual Clauses (SCCs).
- Other appropriate safeguards or legally permitted transfer mechanisms.
Where required, we assess the circumstances of the transfer and implement supplementary measures to provide an appropriate level of protection.
Information about the safeguards applicable to a particular transfer may be requested using the contact details in this Privacy Policy.
10. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by law.
Our retention decisions take into account the nature of the information, the purpose of processing, applicable statutory obligations, contractual requirements, and the need to establish or defend legal claims.
The principal retention criteria are:
Contact enquiries
Contact information and correspondence are retained for the time necessary to handle the enquiry and any relevant follow-up or prospective business relationship. Information is deleted or anonymised when it is no longer required for these purposes, subject to applicable legal requirements.
Customer and contractual information
Information related to customer relationships is retained for the duration of the relationship and, where necessary, afterwards to comply with contractual obligations, applicable limitation periods, and legal requirements.
Financial administration
Accounting information, invoices, and other records subject to Dutch statutory retention requirements are generally retained for at least seven years. Certain records may be subject to longer statutory retention periods.
Website and security information
Technical information and security logs are retained for the period necessary to maintain website functionality, investigate technical problems, detect security incidents, and protect our systems.
AI project data
Retention periods for customer-provided project data are determined by the nature of the engagement and, where applicable, the relevant contractual arrangements and Data Processing Agreement.
Marketing information
Where personal data is processed for marketing, it is retained while a valid legal basis exists and the information remains necessary. Where an individual opts out, limited information may be retained to ensure that their preference is respected.
At the end of the applicable retention period, personal data is deleted, anonymised, or otherwise handled in accordance with applicable law.
11. Data Security
We take the protection of personal data seriously and apply technical and organisational security measures appropriate to the nature and risks of the processing.
Depending on the systems and services involved, such measures may include:
- Access restrictions and authentication controls.
- Secure transmission and storage of data.
- Confidentiality obligations.
- Appropriate infrastructure and system security.
- Security monitoring and maintenance.
- Backup and recovery measures.
- Procedures for responding to security incidents.
- Periodic review of security practices.
Access to personal data is restricted according to business necessity and applicable responsibilities.
While we take appropriate measures to protect personal data, no electronic transmission or storage system can be guaranteed to be completely free from risk.
Where a personal data breach occurs, we assess and address the incident in accordance with applicable GDPR requirements, including relevant notification obligations.
12. Your Rights Under the GDPR
If we process your personal data as a controller, you may have the following rights under the GDPR, subject to the applicable conditions and limitations.
Right of access
You may request confirmation of whether we process your personal data and obtain access to relevant information.
Right to rectification
You may request correction of inaccurate personal data or completion of incomplete data.
Right to erasure
You may request deletion of your personal data where the legal requirements for erasure are met.
Right to restriction of processing
You may request that we restrict the processing of your personal data in certain circumstances.
Right to data portability
Where applicable, you may request to receive certain personal data in a structured, commonly used, machine-readable format or have it transferred to another controller.
Right to object
You may object to processing based on legitimate interests, subject to the conditions set out in the GDPR.
You also have the right to object at any time to the processing of your personal data for direct marketing purposes.
Right to withdraw consent
Where processing is based on your consent, you may withdraw it at any time without affecting processing that was lawful before withdrawal.
Rights relating to automated decision-making
Where applicable, you have rights relating to certain decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.
Exercising Your Rights
To exercise any of these rights, contact:
We may request additional information where necessary to verify your identity and prevent unauthorised disclosure of personal data.
We will respond without undue delay and, in principle, within one month of receiving your request.
Where permitted by the GDPR, this period may be extended by up to two additional months, taking into account the complexity and number of requests. We will inform you of any extension and the reasons for it within the initial one-month period.
Requests are generally handled free of charge, subject to the exceptions permitted by law.
If Imagine AI processes your information solely on behalf of a customer, we may refer your request to the relevant data controller or assist that controller as required.
13. Complaints
If you have concerns about how we process your personal data, we encourage you to contact us first so that we can review and address the matter.
You also have the right to lodge a complaint with a competent data protection supervisory authority.
In the Netherlands, the relevant authority is:
Autoriteit Persoonsgegevens (Dutch Data Protection Authority)
Website: https://autoriteitpersoonsgegevens.nl
You may also have the right to lodge a complaint with another competent supervisory authority in the European Union, particularly in the country where you habitually reside, work, or where an alleged infringement occurred.
14. Data Collected from Other Sources
In addition to information provided directly by individuals, we may receive business-related personal data from:
- Organisations with which we work.
- Employees or representatives of prospective or existing customers.
- Publicly available professional or company information.
- Professional networking platforms.
- Suppliers and business partners.
- Customer-provided project documentation and datasets.
Where we act as a controller, we process such data only where a valid legal basis exists and provide information to individuals as required by applicable law.
Where we receive personal data from customers in our capacity as a processor, the relevant customer remains responsible for determining the applicable legal basis and fulfilling its transparency obligations.
15. Providing Personal Data
Providing personal data is generally voluntary when visiting our website or making an initial enquiry.
However, certain information may be necessary to respond to a request, prepare a proposal, enter into a contract, deliver our services, or comply with legal obligations.
If the necessary information is not provided, we may be unable to respond to an enquiry or provide certain services.
Where information is legally or contractually required, we will explain the relevant requirements and potential consequences where appropriate.
16. Children’s Privacy
Our website and services are primarily intended for businesses, professionals, and organisations.
They are not specifically directed at children.
We do not intentionally solicit personal data from children through our website.
If we become aware that personal data relating to a child has been collected or processed without an appropriate legal basis, we will take the measures required under applicable data protection legislation.
If you believe that a child has provided personal data to us inappropriately, please contact info@imagine-ai.net.
17. External Websites and Third-Party Services
Our website may contain links to websites, platforms, or services operated by third parties.
These third parties may process personal data under their own privacy policies.
We encourage users to review the privacy information provided by third-party websites and services before submitting personal information.
This Privacy Policy does not govern processing activities for which an unrelated third party acts independently as data controller.
18. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, business operations, processing activities, or applicable legal requirements.
The latest version will be made available on our website.
The “Last updated” date at the beginning of this document indicates when the policy was most recently revised.
Where changes materially affect the processing of personal data, we will provide additional notice where required by law.
19. Contact Information
If you have questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact:
Imagine AI B.V.
Utrecht
The Netherlands
Email: info@imagine-ai.net
Website: https://imagine-ai.net
Chamber of Commerce (KvK): 77647181
We will review privacy-related enquiries and requests in accordance with applicable data protection legislation.
© 2026 Imagine AI B.V. All rights reserved.