The RTE Toolbox

Legal

Privacy Notice

What we process, why, with whom, for how long — and what you can ask of us.

1. Who is responsible

The RTE Toolbox (rte-toolbox.com) is operated by Gavant, established in the Netherlands, which is the controller for the processing described here. Contact: toolbox@gavant.eu.

2. What we process, and why

Account and membership

Name, email address, password (stored hashed by our authentication provider), sign-in times, plan, subscription status, paid-through dates, and the identifiers our payment provider assigns to you. Purpose: to create and secure your account, provide the membership you bought, and handle renewals, cancellations, refunds and withdrawal requests. Legal basis: performance of the contract with you; keeping payment records is also a legal obligation (Dutch tax law, 7 years).

Your work in the tools

What you enter into a tool — team names, risks, coaching notes, assessment answers, workshop plans, and similar — is stored so you can return to it. Some tools keep this in your browser only; tools that sync to the cloud say so on screen. Purpose: providing the tool. Legal basis: performance of the contract. You are responsible for what you enter about other people; enter the minimum you need and avoid special-category data.

Participants in sessions you run

When a member runs a live poll, questionnaire, If–Then workshop, or shares an ART Sync view, participants provide answers and, where the organiser asks for it, a name or email address. We process this on behalf of the organiser, who decides what is asked and sees the results. Participant pages show a short notice before any answer is sent. Legal basis: the organiser's legitimate interest in running the session (or their contract with you); anonymous questionnaires collect no identifier beyond a random per-device key.

Community

Posts and your display name are visible to other members when published. Legal basis: contract.

Newsletter

Your email address, subscription source and confirmation status. We use confirmed (double) opt-in: nothing is sent until you click the confirmation link. Legal basis: consent; withdraw any time via the unsubscribe link in every email or by writing to us.

Analytics

With your consent (the cookie banner), we record page views and product events with a random session id, your screen width, the referring site's domain, and — when you are signed in — your account id. No analytics request is sent before you choose "Accept analytics"; choosing "Essential only" stores that choice on your device and sends nothing. Legal basis: consent.

Security and abuse prevention

Sign-up uses hCaptcha to keep bots out. Our hosting and function logs contain IP addresses and request metadata for a short period. Legal basis: legitimate interest in keeping the service secure.

3. Who processes data for us

These providers act on our instructions under data-processing terms:

  • Supabase (database and authentication) — EU region hosting.
  • Netlify (website hosting, serverless functions, logs).
  • Mollie B.V. (payments; Mollie is an independent controller for the payment itself and sees your name, email, bank or card details, and amounts).
  • hCaptcha (bot protection on sign-up; loads only when the sign-up form is opened).
  • Mailchimp or Buttondown (newsletter delivery, when configured).
  • Google Fonts — the site's typefaces are fetched from Google's servers, which receive your IP address when a page loads. We are working on self-hosting these files.

Some of these providers are established outside the EEA (United States). Transfers rely on the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

We do not sell personal data, and we do not use it for advertising.

4. How long we keep it

  • Account and tool data: for as long as your account exists, then deleted within 30 days of an account-deletion request.
  • Payment and subscription records: 7 years after the transaction (Dutch fiscal retention).
  • Participant answers to polls and questionnaires: until the organiser deletes the session, or until the organiser's account is deleted.
  • Newsletter: until you unsubscribe, plus a suppression record so we do not email you again.
  • Analytics events: 24 months.
  • Hosting and security logs: up to 30 days.

5. Your rights

You can ask for access to your data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Where processing is based on consent you can withdraw it at any time without affecting what happened before. Write to toolbox@gavant.eu; we answer within one month. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

6. Cookies and local storage

Essential: your sign-in session and your cookie choice. Optional (consent): an analytics session id kept for the browser session. Tools may also keep your drafts in your browser's local storage; these are tied to your account id and cleared when you sign out.

7. Changes

We will announce material changes on this page and, for members, by email.

Last updated: 4 September 2026 · See also the General Conditions.