Privacy statement

Version 1.3, August 2026

Courtesy translation. This statement was drawn up in Dutch. In case of differences, the Dutch text prevails.

This privacy statement describes how Citizar handles personal data of visitors to citizar.com and normcontrol.nl, of (contact persons at) prospects and clients, and of others with whom Citizar has business contact. We process personal data with care and in accordance with the General Data Protection Regulation (GDPR).

NormControl is a product of Citizar and not a separate legal entity. For the normcontrol.nl website, Citizar is therefore the controller, just as it is for citizar.com.

For our other product websites and hosted services (such as abroquickscan.nl and white-label environments), the privacy statements on those websites additionally apply.

Who is responsible?

The controller is:

• Citizar, Amersfoort, the Netherlands
• Chamber of Commerce no.: 90089871
• Email for privacy questions and requests concerning your rights: privacy@normcontrol.nl
• Email for questions about NormControl: support@normcontrol.nl

Our two roles

Controller. For the processing described in this statement (our own websites, business development, client relationships and administration), Citizar determines the purposes and means itself and acts as controller.

Processor. Where Citizar provides a hosted service to a client, or temporarily receives access to a client's systems or data in the course of support or consultancy, Citizar processes any personal data therein solely on that client's instructions. The client is then the controller; the agreement and a data processing agreement apply, and that processing falls outside this statement. If you have questions about data a Citizar client processes about you, please contact that organization.

NormControl falls outside both roles. The NormControl application runs entirely in the customer's own Azure subscription: Citizar has no access to that environment and processes no data from customer deployments. This statement therefore covers only the normcontrol.nl website and the business contact around it, not the data a customer processes in its own NormControl environment.

What data do we process, for what purpose and on what basis?

Contact and inquiries. If you contact us via the contact form on citizar.com, by email or by phone, we process the data you provide (such as name, email address, phone number, organization and the content of your message) to answer your question and discuss possible next steps. Basis: our legitimate interest in responding to your message, or steps taken at your request prior to entering into an agreement. We keep this data as long as needed for handling, and no longer than two years after the last contact.

Contact form on normcontrol.nl. Normcontrol.nl carries a contact form you can use to request a demo, ask a support question, propose a partnership, or ask a general question. We process the data you enter: your name, your business email address, your organization, the topic you select and the content of your message. The form deliberately does not ask for a phone number and contains no sign-up for newsletters or other marketing communications; we use your data only to answer your message and handle your request. Basis: our legitimate interest in responding to your message, steps taken at your request prior to entering into an agreement, or, if you are already a client, performance of the agreement. Your message arrives in a Citizar mailbox; our website and email hosting providers are involved in its transmission and delivery (see below). We keep this data as long as needed for handling, and no longer than two years after the last contact. If your inquiry leads to a client relationship, the retention period under "Quotations and client relationship" applies from that moment.

NormControl support questions by email. You can also reach us about NormControl directly at support@normcontrol.nl. We process the data in your message (such as name, email address, organization and the content and attachments of your question) in order to handle the request. Basis: performance of the agreement, or our legitimate interest in responding to your message. Please do not send us more personal data in a support question than is needed to handle it.

Quotations and client relationship. Of (contact persons at) prospects and clients we process name, role, business contact details and the correspondence and arrangements belonging to the relationship, in order to issue quotations and to perform and manage agreements. Basis: performance of the agreement, or our legitimate interest in maintaining business relationships. We keep this data for the duration of the relationship and up to two years thereafter, unless a longer statutory period applies.

Administration and invoicing. Data appearing on invoices and in our administration (such as clients' names, addresses and payment details) is kept for seven years under our statutory fiscal retention obligation.

Support. For support requests we process the reporter's details and the information in the request (such as log files supplied by the client) in order to handle the request. Basis: performance of the agreement. If supplied material contains personal data for which the client is responsible, our processor role applies (see above).

On-site consultancy. In advisory and implementation work, Citizar may incidentally see personal data within the client's organization (for example in documents or systems under review). Citizar accesses such data only to the extent necessary for the engagement, does not copy it to its own systems unless agreed for the engagement, and treats it confidentially.

Website and security. When you visit citizar.com or normcontrol.nl we process technical data (such as IP address and requested pages) in server logs, for the operation and security of the website. Basis: our legitimate interest in a secure and functioning website. These logs are kept briefly. Citizar.com places functional cookies necessary for the site to work; for any analytics or other cookies we first ask consent there via a cookie notice.

Cookies on normcontrol.nl. Normcontrol.nl is deliberately built without tracking cookies. We place no cookies to track your behavior, build no visitor profiles, do not follow you across other websites, and use no advertising or marketing cookies. Only strictly functional storage in your browser may be used to make the site work, for example to remember your language choice (Dutch or English); that storage does not serve to track or analyze you. The language switch and the contact form likewise set no tracking cookies. This site therefore needs no cookie notice.

Visitor statistics on normcontrol.nl. To see how our site is used, we may measure visits in a cookieless, aggregated way: nothing is stored on or read from your device for this purpose, your IP address is not retained in full, and the statistics cannot be traced back to you as an individual. What we see are totals only, such as the number of visits per page and where traffic comes from. Basis: our legitimate interest in understanding how our website is used and improving it. Should we later deploy a measurement method or other service that does set cookies or does track visitors individually, we will first update this statement and, where required, ask your consent in advance via a cookie notice.

With whom do we share data?

We do not sell personal data. We share data only with service providers (processors) engaged for our business operations, with whom we have concluded data processing agreements, including:

• Microsoft Azure: hosting, storage and email; processing within the European Union (West Europe/North Europe regions);
• Our bookkeeping and invoicing provider in the Netherlands: bookkeeping and invoicing.

In addition, we disclose data where a legal obligation to do so exists. Processing takes place within the European Economic Area; to the extent a service provider processes data outside it, this happens only with appropriate safeguards (such as EU standard contractual clauses).

Security

Citizar implements appropriate technical and organizational measures to protect personal data against loss and unauthorized access, appropriate to the nature of the data. Security and compliance are the core of our profession; we organize our own operations along the principles of ISO/IEC 27001.

Your rights

You have the right of access to, rectification and erasure of your personal data, the right to restriction of and objection to processing, and the right to data portability. You may withdraw consent at any time. To exercise these rights, contact privacy@normcontrol.nl; we respond within one month. If you disagree with how we handle your data, you may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Changes

We may amend this statement, for example when our services or legislation change. The current version is published on citizar.com and on normcontrol.nl; the version date at the top indicates the latest change.