Alumio Privacy Policy
Last updated: 10 October 2026
1. About this statement
Alumio B.V. decides how and why the personal data described here is used. We are registered in the Netherlands under Chamber of Commerce number 71996451, at Laan Corpus den Hoorn 200, 9728 JS Groningen.
This statement covers the personal data we handle as a company: visitors to our websites, contacts at customers, prospects and partners, people who receive our communications, job applicants, and contacts at our suppliers. It applies to www.alumio.com, academy.alumio.com and forum.alumio.com.
For questions or requests about your personal data, write to privacy@alumio.com.
2. When we are a controller, and when we are a processor
Alumio acts in two different roles, and only one of them is covered by this statement.
As a controller. For everything described here, we decide why and how personal data is used. This statement applies.
As a processor. Our customers use the Alumio integration platform to move data between their own systems. That data may contain personal data, but we handle it on their instructions and for their purposes, not our own. Their privacy statement applies to it, and our obligations are set out in the data processing agreement that forms part of their contract with us.
If your personal data reaches us because an organisation you deal with uses our platform, contact that organisation. They can answer questions about their data and pass any request on to us.
3. What we process, why, on what basis and for how long
What we process depends on how you deal with us.
If you visit our websites
We process your IP address, device and browser characteristics, the pages you view and how you move through the site. We use this to operate and secure our websites, to measure how they are used and to improve our content. We rely on our legitimate interest in a working, secure website, and on your consent for analytics and advertising cookies. Retention periods are set out in our cookie statement.
If you are a prospect or business contact
We process your name, job title, business contact details, employer, publicly available professional information and our correspondence with you. We use this to contact you about our services, to assess whether there is a fit and to arrange meetings. We rely on our legitimate interest in business-to-business marketing. We remove your details from our contact database within three years of our last meaningful contact, or immediately if you object.
If you are a contact at a customer
We process your name, job title, business contact details, correspondence, support requests and your platform account and usage records. We use this to deliver and support the service, to administer the account, to invoice and to manage the contract. We rely on the performance of our contract with your organisation, and on our legal obligation to keep financial records. We keep this for the term of the contract, and financial records for the statutory retention period of seven years.
If you receive our newsletter or event invitations
We process your name and email address, whether you opened or clicked a message, and the events you attended. We use this to send our newsletter and invitations and to measure whether they are read. We rely on your consent, or on our legitimate interest where you are already a customer contact. We keep this until you unsubscribe, after which we keep only the record needed to stop contacting you.
If you apply for a job with us
We process your application and CV, our correspondence, interview notes and any references you provide. We use this to assess your application and to run our hiring process. We rely on the steps taken at your request before entering a contract, and on your consent if we keep your details on file. We keep this for four weeks after the procedure ends, or one year if you agree to it.
If you are a contact at a supplier or partner
We process your name, role, business contact details and our correspondence. We use this to manage the relationship, the contract and our supplier assessments. We rely on the performance of our contract with your organisation, or on our legitimate interest in managing the relationship. We keep this for the term of the contract, and financial records for the statutory retention period.
We do not process special categories of personal data about you, and we do not ask you to provide them.
4. Where we obtain your data
Most of what we hold comes from you directly: you fill in a form, send us an email, meet us at an event, sign a contract or apply for a job. We also record how you use our websites.
We obtain business contact details from other sources as well:
Public professional sources, such as a company website or a professional network profile.
Business information and sales intelligence providers, who compile business contact details from public and commercial sources.
What we take from these sources is limited to professional information: name, job title, employer and business contact details. We use it to approach people who we have reason to think would be interested in what we do.
If we obtained your details this way, we say so in the first message we send you, we name the type of source, and we tell you how to stop hearing from us. You can object at any time, including in reply to that first message or at privacy@alumio.com. We will then stop contacting you and remove your details, keeping only what we need to make sure we do not contact you again.
5. Who we share your data with
Inside Alumio, only people who need your data for their work can reach it.
Outside Alumio, we use service providers in the following categories:
Website hosting, content management and website analytics.
Customer relationship management and marketing automation.
Customer support and communication tools.
Advertising platforms, and only where you have consented to the cookies concerned.
Our IT workplace, identity management and security monitoring.
Accountants, auditors and legal advisers.
Every provider that handles personal data on our behalf is bound by a data processing agreement that meets the requirements of the GDPR. We keep a current list of these providers and will send it to you on request at privacy@alumio.com.
We also share personal data where the law requires it, or where it is necessary to establish or defend a legal claim.
We do not sell personal data, and we do not share it with third parties for their own marketing.
6. Transfers outside the European Economic Area
We keep processing inside the European Economic Area wherever we can. Some of our service providers, in particular advertising platforms and parts of our IT estate, are established outside the EEA or use infrastructure outside it.
Where personal data is transferred outside the EEA, we rely on an adequacy decision of the European Commission, or on the European Commission's standard contractual clauses together with any additional measures our assessment shows to be necessary.
If you want to know which mechanism applies to a specific transfer, ask us at privacy@alumio.com.
7. How we protect your data
Alumio holds ISO 27001 certification for its information security management system. The certification is audited by an independent certification body and covers how we grant access, encrypt data, monitor our systems, assess our suppliers, handle incidents and review all of it periodically.
Access to personal data is granted on a need-to-know basis and is reviewed regularly.
No set of measures makes a system completely secure. If a personal data breach affects you and the law requires us to tell you, we will.
8. Your rights
Under the GDPR you can ask us to:
give you a copy of the personal data we hold about you;
correct or complete it if it is wrong or incomplete;
delete it;
limit what we do with it while a question about it is open;
transfer the data you gave us to another party.
You can also object to our processing. If you object to direct marketing, we stop, without weighing any interest against it. Where we rely on your consent, you can withdraw it at any time, which does not affect what we did before you withdrew it.
Send your request to privacy@alumio.com. We answer within one month. If a request is complex we may extend that by two months, and we will tell you if we do. We may ask you to identify yourself before we act.
If you are not satisfied with how we handle it, you can complain to the Dutch Data Protection Authority at autoriteitpersoonsgegevens.nl, or to the supervisory authority in the country where you live or work.
9. Cookies
Our websites use cookies and similar techniques. We ask for your consent for everything other than cookies that are strictly necessary to make the site work. You set your preferences in the banner that appears on your first visit and can change them at any time through the same banner.
Which cookies we use, what each one does, who places it and how long it lasts is listed in our cookie statement. That list is kept up to date automatically, so it is the accurate source rather than this page.
10. Automated decisions
We do not make decisions about you that have legal or similarly significant effects based only on automated processing.
We do segment and score business contacts in our marketing systems, which influences which emails you receive and when someone from our team gets in touch. A person decides whether to contact you. You can object to this at any time at privacy@alumio.com.
11. Changes to this statement
We update this statement when the way we handle personal data changes. The current version is always on this page, with the date it was last changed at the top. If a change is significant and affects you directly, we will tell you by email where we have your address.
12. Contact
Alumio B.V.
Laan Corpus den Hoorn 200
9728 JS Groningen, The Netherlands
Chamber of Commerce 71996451
privacy@alumio.com
We have not appointed a Data Protection Officer. Privacy questions and requests go to the address above.
.svg)
