Privacy Statement InControlRating B.V.
At InControlRating B.V. (ICR), we recognize the importance of protecting your personal data and handling information with care. Trust, transparency, and responsible data processing are essential to the way we provide our services. This Privacy Statement explains how we collect, use, protect, and retain personal data, and what rights you have regarding your information.
ICR is established in the Netherlands. This Privacy Statement applies to our website, routeicr.com, and our related services, including the ICR Growth & Success SaaS Platform, the ICR mobile app, and the ICR Community, where applicable.
Last updated: October 29, 2026
1. Our Responsibilities
ICR acts as data controller for personal data relating to website use, account management, billing, marketing, and other activities for which we determine the purposes and means of processing.
For personal data entered into the ICR Growth & Success SaaS Platform by customers, ICR acts as data processor on behalf of the customer. The customer determines the purposes of this processing, which is governed by our Data Processing Agreement (DPA).
We process personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection requirements.
2. Personal Data We Process
Depending on how you interact with ICR, we may process:
Name and contact details, such as email address, telephone number, and address
Account, subscription, and billing information, including payment details where applicable
Information you provide when contacting us or using our services
Technical information necessary for website functionality, maintenance, and security
Website usage information to help us understand and improve our website
Business-related information entered into our services by customers
We collect and process only the information relevant to the purposes for which it is needed.
3. How We Use Personal Data
We process personal data to:
Provide, maintain, and improve our websites and services
Manage accounts, subscriptions, and payments
Respond to questions and provide customer support
Communicate about our services and relevant updates
Send newsletters and other communications where permitted
Understand website usage and improve the visitor experience
Maintain the security and reliability of our services
Meet applicable legal and regulatory obligations
We process personal data on the basis of contractual necessity when providing our services, legal obligations for matters such as financial administration, and legitimate interests in maintaining security, responding to inquiries, and improving our services. Where consent is required, such as for certain marketing activities or technologies, we request it separately. You may withdraw your consent at any time.
For customer data processed within the SaaS Platform, the customer is responsible for determining the appropriate legal basis.
4. Artificial Intelligence (AI)
ICR uses artificial intelligence, including Claude by Anthropic, to provide relevant insights, explanations, and recommendations within its services. To generate responses tailored to the user's specific situation, relevant customer information may be securely transmitted to the AI service provider. Depending on the functionality used, this information may include business information and personal data.
We use AI to support users in understanding information, improving their organizations, and making informed decisions. AI does not replace human judgment or responsibility. We apply appropriate data protection measures and contractual safeguards when using external AI services. For customer data processed within the ICR Growth & Success SaaS Platform, these activities are governed by the applicable Data Processing Agreement.
AI-generated information should be evaluated in the context of the user's circumstances. Users remain responsible for decisions based on such information.
5. How Long We Retain Personal Data
We retain personal data only for as long as necessary for the purposes described in this Privacy Statement or as required by applicable law.
Website and communication data
Information provided through contact forms, correspondence, or other website interactions is retained for as long as necessary to handle the relevant request and any appropriate follow-up.
Technical information used for website operation and security is retained in accordance with applicable operational and security requirements.
ICR SaaS Platform data
During an active subscription, customer data is processed and stored to provide the agreed services.
Following termination of the agreement, customer data may be retained for a maximum of three (3) years solely to enable possible account reactivation or comply with applicable legal obligations.
During this period, the data is not actively processed, and access is restricted to authorized personnel.
Customers may request earlier deletion in writing. We will delete the relevant data within a reasonable period unless retention is required by law.
After the applicable retention period, data is permanently deleted from active systems. Data in backups is overwritten in accordance with standard technical retention cycles.
Administrative and financial records
Information required for administration, billing, and legal compliance is retained for the periods required by applicable law.
6. Website Analytics
We use Plausible Analytics to understand how visitors use our website and to improve its content and usability.
Plausible is a privacy-friendly analytics service that does not use tracking cookies or persistent identifiers, does not store visitors' raw IP addresses, and does not track individuals across different websites.
It provides aggregated information such as pageviews, traffic sources, and general browser and device information.
We use these statistics to improve our website, not to identify individual visitors or create advertising profiles.
For more information, see Plausible's Data Policy.
7. Cookies
Our websites use cookies and similar technologies where necessary for essential functionality, security, and remembering user preferences.
We use Plausible Analytics for website statistics without placing tracking cookies.
Other technologies that require consent are used in accordance with applicable privacy requirements. Where relevant, visitors can manage their preferences through our cookie settings.
You can also manage or delete cookies through your browser settings.
8. Sharing and International Data Transfers
We do not sell personal data.
Where necessary to provide our services, we work with carefully selected service providers, such as hosting, payment, and technical service providers.
We share personal data only where there is an appropriate legal basis and apply relevant contractual and security safeguards.
Where personal data is transferred outside the European Economic Area (EEA), we apply appropriate safeguards in accordance with applicable data protection legislation.
For customer data processed within the SaaS Platform, the use of subprocessors is governed by our Data Processing Agreement.
9. Security
Protecting personal data is an important part of how we manage our services.
We apply appropriate technical and organizational security measures, including access controls, secure data transmission, encryption where appropriate, and restricted access to information.
We review and maintain these measures to support the confidentiality, integrity, and availability of personal data.
For customer data processed within the SaaS Platform, our responsibilities are further described in the Data Processing Agreement.
10. Your Privacy Rights
Under the GDPR, you may have the right to access, correct, delete, or restrict the processing of your personal data.
You may also have the right to object to certain processing activities, request data portability, or withdraw consent where applicable.
To exercise your rights, please contact us using the details below. We will respond in accordance with applicable data protection legislation.
For personal data processed by ICR on behalf of a customer, requests should generally be directed to that customer. We will provide assistance as required under the Data Processing Agreement.
If you are dissatisfied with how your request is handled, you may lodge a complaint with the relevant supervisory authority, including the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
11. Updates to This Privacy Statement
We may update this Privacy Statement to reflect changes in our services, data processing activities, or applicable legal requirements.
The latest version will always be available on our website, together with the date of the most recent update.
12. Contact
If you have questions about this Privacy Statement or how ICR handles personal data, please contact us.
InControlRating B.V. | Route ICR
Millennium Tower
Radarweg 29 12A/B
1043 NX Amsterdam
The Netherlands
Email: support@incontrolrating.com
Website: https://routeicr.com