Privacy Statement

1. Who we are

Part of the Protocol B.V. (hereinafter "the Company") is a Dutch private limited company that delivers SaaS products at the intersection of AI and live-entertainment operations.

2. Two roles

We process personal data in two clearly separated contexts. The rest of this statement is structured accordingly.

3. Which personal data we process — Context A (platform users)

For the Company's products to function, we process the following from every platform user. Source of data (GDPR Art. 14(2)(f)): all Context A personal data is provided by your employer at account provisioning, entered by you when you use the product, or generated automatically by the product (telemetry, audit logs, connection data) in the course of your use. The Company does not source Context A data from public directories or third-party data brokers.

We collect no marketing trackers, no advertising cookies, and no profiling pixels on the logged-in parts of our products. The marketing website partoftheprotocol.com itself runs on a minimal technical stack without third-party tracking; no consent banner is shown because there is nothing to ask consent for.

Cookies: we use only strictly necessary cookies — session cookies for the operation of the login system and cookies that our hosting platform itself sets for basic functionality of the website. These cookies are exempt from consent under the Dutch Telecommunications Act Art. 11.7a(3). We use no analytics, advertising, or tracking cookies.

4. Which personal data we process — Context B (data subjects via customer products)

When a customer organisation uses a Company product to process personal data on its behalf, the categories below may be involved. Which categories apply depends entirely on the product; they are recorded per product in the applicable Data Processing Agreement. No single product processes all of these categories.

4.1 Analysis of publicly available information

Applies to products that prepare a risk or background analysis (for example: a venue has the Venue Vera platform generate a booking-risk analysis on an artist).

4.2 Conversations and messaging

Applies to products in which employees or suppliers of the Deployer communicate with an AI assistant (for example via WhatsApp).

Where an employee raises a question about their own employment situation, that message content may include sensitive personal circumstances. This data is processed solely to answer the question and to escalate it to the Deployer's designated staff where required.

4.3 Documents and administrative data

Applies to products that read or verify documents submitted by the Deployer.

Identity documents and work permits are read for the purpose of the verification the Deployer requests. No biometric processing takes place: no facial recognition, no template extraction, and no comparison against a biometric database.

4.4 Recordings and content production

Applies to products that convert recordings of presentations or events into written content.

Important: the product does not actively select these data on the basis of special categories (GDPR Art. 9) or criminal data (GDPR Art. 10). It collects public professional data, and that data inevitably sometimes contains statements that fall within those categories. We refer to this in our documentation as "by-catch" and have taken technical and organisational measures to minimise by-catch:

• System prompts instruct AI models not to actively search for special-category or criminal data;
• We do not perform biometric processing on image by-catch (no face encoding, no template extraction);
• Source attribution is mandatory in reports so that the Deployer can assess whether a finding constitutes by-catch;
• The DSAR route in §7 is open for deletion or restriction of by-catch data on request by data subjects.

Legal basis for by-catch processing: where special-category data are incidentally captured in this way, the Company relies on GDPR Art. 9(2)(e) — data manifestly made public by the data subject, scope-bound to statements that the data subject themselves placed in the public professional record. Where criminal-data by-catch is captured, the Company relies on UAVG Art. 32 and Art. 33 (the Dutch implementing-law grounds for incidental processing of criminal-conviction and offence data in the context of the Deployer's legitimate-interest assessment). The Company does not process either category for any purpose other than supporting the Deployer's own assessment, and does not retain by-catch beyond the retention periods in §6.

5. Why we process (legal bases)

We base each processing activity on a specific legal basis under GDPR Art. 6.

6. Retention periods

We do not retain personal data longer than necessary for the purpose for which they are processed or than required by law. The periods below reflect our current operational practice and the periods to which we contractually commit.

7. Your rights as a data subject

Under the GDPR (Articles 15 to 22) you have a number of rights regarding your personal data:

8. Sub-processors

In the delivery of our products we use the following sub-processors under GDPR Art. 28(2-4). This list covers all Company products. Not every sub-processor is engaged for every product — the sub-processors applicable to a specific product are recorded in the Data Processing Agreement for that product.

We update this list at least fifteen (15) business days before a new sub-processor begins processing personal data. Updating this list constitutes notice to our customers; the objection procedure is set out in the applicable Data Processing Agreement.

9. Transfers to countries outside the EEA

A number of our sub-processors are established in the United States: OpenAI, Anthropic, xAI, Deepgram, Twilio, Resend, DocRaptor, Webflow, Slack, Basecamp, GitHub, and Backblaze. Transfer of personal data to these parties takes place primarily on the basis of Standard Contractual Clauses (SCCs):

• SCCs: approved by the European Commission in Implementing Decision (EU) 2021/914 — module 2 (controller-to-processor) or module 3 (processor-to-processor) depending on the position of the sub-processor;
• Supplementary technical measures: encryption in transit (TLS 1.2+) and at rest, opt-out of model training with all AI providers, strict API-only integration (no shared infrastructure);
• Transfer Impact Assessments (TIAs): in line with EDPB Recommendations 01/2020, performed per sub-processor and documented in Annex D of our standard Data Processing Agreement.

The EU-US Data Privacy Framework (Adequacy Decision EU 2023/1795) is recognised by us as an additional mechanism for sub-processors certified under it. We base our transfers primarily on SCCs to remain independent of the outcome of any future judicial rulings on that adequacy decision.

One sub-processor, Ynoox GmbH (PDF4me), is established in Switzerland. Switzerland is covered by an adequacy decision of the European Commission, so transfer to this party does not require Standard Contractual Clauses. Processing of document content takes place within the EU (Ireland).

For Backblaze, Inc. (B2 cloud storage), the backup data is stored exclusively within the EU (Amsterdam) and is encrypted before transmission with a key that Backblaze does not hold — Backblaze only ever receives ciphertext. The SCCs apply as transfer mechanism for the US establishment of this sub-processor.

10. Right to lodge a complaint with the Dutch Data Protection Authority

When you feel that we are not handling your personal data correctly, we hope you will first raise this with us via governance@partoftheprotocol.com — we take every complaint seriously and aim to resolve it within 30 days.

Without prejudice to your right to address us directly, you always have the right to lodge a complaint with the Dutch supervisory authority:

If you are located in another EU member state, you can instead lodge a complaint with the supervisory authority of your place of residence; that authority coordinates with the Dutch Autoriteit Persoonsgegevens as lead supervisory authority for the Company on the basis of GDPR Art. 56.

11. Data breaches — what we do in case of a security incident

When, despite our technical and organisational measures, a personal data breach does occur, the notification duties under GDPR Art. 33 and Art. 34 apply. Our procedure differs per role:

In our role as controller (Context A — platform users):

• We notify the data breach within 72 hours of becoming aware to the Autoriteit Persoonsgegevens, unless the breach is unlikely to result in a risk to the rights and freedoms of data subjects (GDPR Art. 33);
• When the breach is likely to result in a high risk to the rights and freedoms of the affected platform users, we inform them without undue delay and independently of the AP notification (GDPR Art. 34);
• We maintain an internal incident register in line with GDPR Art. 33(5).

In our role as processor (Context B — data subjects via customer products):

• We notify the breach without undue delay and in any event within 72 hours of becoming aware to the relevant Deployer. The Deployer is controller and decides whether to inform data subjects (artists, promoters) directly under GDPR Art. 34;
• In this role we do not have direct communication with data subjects about incidents — that responsibility lies with the Deployer.

In both roles we support the affected parties with the information they need for their own statutory obligations, and we cooperate with investigations by supervisory authorities.

12. Responsible disclosure (security reports)

Have you discovered a security vulnerability in one of our products or in our infrastructure? We appreciate notification through a coordinated-disclosure route.

How to report: send a description of the vulnerability to governance@partoftheprotocol.com. Include:

• The product or URL where the issue occurs;
• A reproduction path or proof-of-concept;
• An estimate of the impact;
• Whether, and if so how, you have published or tested.

What we promise:

• We confirm the report within 5 business days;
• We keep you informed of progress and provide a lead-time indication once we have assessed the scope;
• We acknowledge your contribution and are grateful for coordinated disclosure.

What we (do not yet) offer: at this time we operate no bug-bounty programme with monetary rewards and we do not yet maintain a public security acknowledgements page. We are considering setting up both as soon as the scale of incoming reports justifies it.

What we ask of you:

• No access to or modification of third-party data;
• No denial-of-service tests, social engineering against our staff, or physical intrusion attempts;
• No public disclosure until we have jointly agreed a reasonable timeline for patch and disclosure (the usual guideline is 90 days, sooner if the risk situation requires it).

Research carried out in good faith in line with the rules above will not lead to legal action from the Company.

13. Changes to this statement

We update this Privacy Statement when our processing materially changes, when legislation or supervisory guidance gives reason to do so, or when we discover an error that requires correction.

• Non-material changes (typography, click-through links, rephrasings that do not change the substance) we make without separate announcement; the version-history block below tracks these.
• Material changes (new data categories, new legal bases, or changes to retention periods) we announce at least 30 calendar days before the effective date via our website and — for active platform users — by e-mail.
• Changes to the sub-processor list (§8) we publish at least 15 business days before the new sub-processor begins processing personal data. This shorter, specific term follows the change procedure in our Data Processing Agreements; publication on this page constitutes notice.

The current version is always available at partoftheprotocol.com/privacy. Earlier versions can be requested via governance@partoftheprotocol.com.

14. Version history

Questions, comments, or complaints? governance@partoftheprotocol.com — we aim for a first response within 5 business days.

The Company's conduct policies — the Human Rights & Modern Slavery Statement and the Anti-Bribery & Corruption Policy — are published separately in the Company's Trust Portal.