DATA PROTECTION
Basewise Privacy Policy - Platform
This policy explains how Basewise ("Basewise," "we," "us," or "our") processes personal data through the Basewise platform (DRE, RQA, REF, AI Assistant Chat, and Knowledge Chat). It does not cover the basewise.ai marketing website, which is addressed in a separate privacy policy.
Version: 2.0 | Effective: 14 June 2025 | Last updated: 31 August 2026
02 Our role: when we are controller, and when we are processor
For account, security, and support data described below, Basewise is the "data controller": we decide why and how that data is processed.
For the substantive content processed through the platform's applications — uploaded documents, extracted requirements, verification evidence, quality-analysis results, and chat messages — Basewise acts as a "data processor" on behalf of your organisation (the "Client"), which is the controller for that data. We process it only on the Client's instructions, as set out in the agreement between Basewise and the Client.
03 The personal data we process, why, and our legal basis
|
What we process |
Why we use it |
Our role / legal basis |
|
Account data. Business email address, name, and login credentials for each user your organisation registers on the platform. |
To create and manage user accounts and provide access to the applications you use. |
Controller — contractual necessity. |
|
Usage and security logs. Records of sign-ins, application usage, and technical logs needed to keep the platform secure and available. |
To operate, secure, and maintain the platform, and to investigate and prevent misuse. |
Controller — legitimate interest (security and operation of the platform). |
|
AI interaction and platform content. Documents you upload, prompts and inputs to DRE, RQA, REF, AI Assistant Chat, and Knowledge Chat, the outputs generated, and any evidence retrieved in response. |
To provide the application feature you are using, including extracting, analysing, verifying, and answering questions about your content. |
Processor, on your organisation's instructions. We do not use this data to train or improve our underlying AI models, and our AI infrastructure providers do not have direct access to it for that purpose. |
|
Support and feedback correspondence. Your name, email address, and the content of your message when you contact us. |
To respond to your enquiry and resolve your issue. |
Controller — legitimate interest, or contractual necessity where your message relates to your organisation's agreement with us. |
Special categories and children's data. We do not intentionally collect special categories of personal data (such as health, racial or ethnic origin, political opinions, or biometric data). The platform is a business tool intended for use by professional users within client organisations; it is not aimed at, or designed for, children of any age.
04 Data processed on behalf of your organisation
Because Basewise acts as a processor for the content described above, individuals wishing to exercise data protection rights over that content (for example, a named requirement author or reviewer) should generally contact their own organisation first, as the controller for that data. Basewise will support the Client in responding to such requests as required by our processing agreement. Rights relating to your own account, log-in, or direct correspondence with Basewise can be exercised directly with us using the details in Section 1.
05 How long we keep your data (retention)
|
Data type |
Typical retention |
|
Account data |
Until cancellation/deletion of platform account |
|
Usage and security logs |
184 days |
|
AI interaction and platform content (documents, requirements, verification evidence, chat history) |
365 days or until user deletes manually |
|
Support and feedback correspondence |
contact@basewise.ai |
When retention ends, we delete or irreversibly anonymise the data.
06 Who we share your data with
We share personal data only as needed, and under appropriate safeguards:
-
Subprocessors. Companies that host our systems or help us deliver the platform on our behalf, including our technical implementation partner. They process data only on our instructions, under a data processing agreement. A current list — including each subprocessor's role, the categories of data they handle, their data location, and safeguards applied to any international transfer — is maintained in the Basewise Subprocessors (Platform) document.
-
Legal and safety. Where required by law, regulation, legal process, or to protect the rights, safety, or property of Basewise, our clients, or others.
-
Business transfers. If Basewise is involved in a merger, acquisition, or sale of assets, your data may be transferred, with notice where required.
We do not sell your personal data.
07 International transfers
Basewise Consultancy B.V. is established in the Netherlands. Our subprocessors host and process data within the EU/EEA, with the exception of our technical implementation partner, which is established in the United Kingdom; transfers to the UK are covered by the EU–UK adequacy decision. Full details are set out in the Basewise Subprocessors (Platform) document.
08 Your rights under data protection law
Depending on the circumstances and subject to legal limits, you have the right to access your personal data, request rectification or erasure, restrict or object to processing, request data portability, withdraw consent where processing is based on consent, and lodge a complaint with a supervisory authority.
To exercise any of these rights over data for which Basewise is the controller, contact us at contact@basewise.ai. We aim to respond within one month, as the GDPR requires, and may extend this by up to two further months for complex requests, with notice. We may need to verify your identity first.
09 How to complain
If you believe we have handled your personal data unlawfully, please contact us first at office@basewise.nl so we can try to resolve it. You also have the right to complain to your supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens, or your own national data protection authority if you are located elsewhere in the EU or EEA (a list is available from the European Data Protection Board).
10 How we protect your data
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or alteration, including encryption in transit, access controls, and a secured hosting environment. No method of transmission or storage is fully secure, so we cannot guarantee absolute security.
11 Changes to this policy
We may update this policy from time to time. We will post the updated version with a new version number and effective date and, where changes are significant, provide additional notice.
12 Accessibility and languages
For an alternative accessible format, contact contact@basewise.ai.