Circlo Privacy Policy

Last updated: 9 February 2026

1. Introduction

This Privacy Policy explains how Naviza B.V., trading as Circlo, collects, uses, and protects personal data when you visit wearecirclo.com or use Circlo's B2B circular fashion infrastructure services (together, the "Services").

This Privacy Policy applies to both:

visitors to our website, and
users of our platform and services.

Data Controller (unless stated otherwise):

Naviza B.V. (trading as Circlo)

Eerste Passeerdersdwarsstraat 82-86

1016XD Amsterdam

The Netherlands

KvK: 93300867

📧 privacy@wearecirclo.com

We comply with the GDPR, the Dutch Telecommunications Act (Telecommunicatiewet), and applicable EU data protection laws.

2. Role of Circlo (Controller vs Processor)

2.1 Business Contacts

For business contacts (clients, prospects, partners), Circlo acts as data controller.

2.2 Employee Participation (Engage)

When employees of client organizations interact with Circlo services (e.g. Engage dashboards, QR scans, uploads):

The employer is the data controller
Circlo acts as a data processor on behalf of the employer
Processing is governed by contractual agreements and, where applicable, Data Processing Agreements (DPAs).

3. Data Protection Officer

Naviza B.V. is not required to appoint a Data Protection Officer under GDPR Art. 37.

For all privacy-related inquiries or data subject requests: 📧 privacy@wearecirclo.com

4. Personal Data We Collect

4.1 Information You Provide Directly

Contact details (name, work email, phone number)
Company details (company name, role, industry)
Business information (project scope, timelines, budgets)
Communications (emails, contact forms, support requests)
Uploaded documents (RFPs, compliance documents, requirements)
Meeting information (calendar availability, notes)
Billing and invoicing information (processed via third parties)

4.2 Information Collected Automatically

Technical data (IP address, browser, device, OS)
Usage data (pages visited, interactions, referrals)
Approximate location (city/country via IP)
Cookies and similar technologies (see Section 10)

4.3 Information from Other Sources

Public business sources (LinkedIn, company websites)
Business intelligence tools (e.g. Apollo, ZoomInfo, Clearbit)
Referrals and business partners (with appropriate safeguards)

Where required, we inform you of third-party data sources within one month.

5. Product & Lifecycle Data: Personal Data Limitation

Circlo services primarily process product and operational data.

Clients must not upload unnecessary personal data into product, lifecycle, or free-text fields. Where personal data is included incidentally, it is processed strictly for service delivery and auditability purposes.

6. Legal Basis for Processing

Purpose	Legal Basis
Responding to demos & inquiries	Contract (Art. 6(1)(b))
Service delivery	Contract (Art. 6(1)(b))
B2B sales & outreach	Legitimate Interest (Art. 6(1)(f))
Marketing communications	Consent or Legitimate Interest
Analytics & optimisation	Legitimate Interest (Art. 6(1)(f))
Legal & tax obligations	Legal Obligation (Art. 6(1)(c))
Call & meeting recordings	Consent (Art. 6(1)(a))

You may object to processing based on legitimate interest at any time.

7. Automated Processing & AI

Circlo may use automated systems, including analytics and AI-supported tools, to:

analyse usage patterns,
improve reporting and insights,
optimise service performance and marketing effectiveness.

No automated decision-making is used that produces legal or similarly significant effects on individuals (GDPR Art. 22).

8. How We Use Personal Data

Deliver and support our Services
Manage contracts, billing, and operations
Improve products and user experience
Conduct B2B marketing and communications
Maintain security, audit logs, and compliance records

9. Data Sharing

9.1 Service Providers

We use vetted processors under DPAs, including:

Hosting & databases (Supabase, EU)
Email & collaboration (Google Workspace, DPF)
Marketing & analytics (Google Analytics, Klaviyo, DPF)
Scheduling & communication tools (e.g. Calendly)

9.2 Legal & Business Transfers

We may disclose data where legally required or in the event of corporate restructuring, with appropriate notice.

We do not sell personal data.

10. Cookies & Tracking

We use strictly necessary, analytics, and (with consent) marketing cookies. A cookie banner allows you to manage preferences at any time.

11. Call & Meeting Recordings

Recordings occur only with explicit consent, are securely stored, and deleted after 6 months, unless required for an active business process.

12. Data Security

We implement appropriate technical and organisational safeguards, including:

Encryption in transit and at rest
Role-based access controls and MFA
EU-based infrastructure where possible
Incident response and breach notification procedures

13. Data Retention

We retain personal data only as long as necessary, including:

Customer data: contract duration + 7 years
Invoices & financial records: 7 years
Website logs: up to 90 days
Operational, access, and audit logs: retained as required for security, compliance, and dispute resolution

14. Your GDPR Rights

You have the right to access, correct, delete, restrict, object, and export your data, or withdraw consent at any time.

📧 privacy@wearecirclo.com. Response time: within 14 days (max. 1 month under GDPR)

15. International Transfers

Where data is transferred outside the EU/EEA, we rely on:

EU–US Data Privacy Framework (DPF), and/or
EU Standard Contractual Clauses (SCCs)

16. Age Restriction

Our Services are intended for business professionals aged 18+.

17. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via the website or email.

18. Contact & Supervisory Authority

Naviza B.V. (Circlo)

Eerste Passeerdersdwarsstraat 82-86

1016XD Amsterdam

📧 privacy@wearecirclo.com

You may also lodge a complaint with the Autoriteit Persoonsgegevens.

19. Language

This Privacy Policy is written in English. In case of discrepancies, the English version prevails unless local law requires otherwise.