Privacy Policy

1. Who We Are

FirmLens is operated by MR-Consulting, a company registered in the Netherlands.

• Company: MR-Consulting
• KvK Number: 70143234
• VAT (btw-id): NL002469518B21
• Location: Amsterdam, The Netherlands
• Contact: info@firmlens.io

MR-Consulting is the data controller for the personal data processed through firmlens.io.

2. What Data We Collect

Browsing FirmLens does not require an account. If you create a free account to unlock contact details, we store the data you give us and the data needed to run and protect the account:

• Name and email address
• Password, stored only as a salted hash
• Session tokens (a strictly necessary cookie keeps you logged in)
• IP address at sign-up and login, used for rate limiting and abuse prevention
• An unlock log: which company profiles you viewed contact details for, and when

The legal basis is the performance of our contract with you (running your account) and our legitimate interest in preventing abuse of the service. Account data is stored in a MySQL database hosted by Strato in the EU. Transactional email (verification, password reset) is sent through Strato from no-reply@firmlens.io.

When you visit our website, the following data may be collected through cookies and analytics:

• IP address (anonymized where possible)
• Browser type and version
• Operating system
• Pages visited and time spent
• Referring website
• Approximate geographic location (country/city level)
• Device type (desktop, mobile, tablet)

3. Why We Collect This Data

We process this data for the following purposes:

• Website functionality: Ensuring the site works properly on your device. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Analytics: Understanding how visitors use FirmLens so we can improve the experience. Legal basis: consent (Art. 6(1)(a) GDPR).

4. Cookies

FirmLens uses the following types of cookies:

Google Analytics 4: We use GA4 to understand how our website is used. GA4 cookies (including _ga and _ga_*) are only placed after you give consent through our cookie banner. These cookies expire after 2 years. Google may transfer data to servers in the United States. Google is certified under the EU-US Data Privacy Framework. You can learn more about Google's privacy practices.

You can withdraw your cookie consent at any time by clearing your browser cookies or using the cookie settings on our website.

5. Who We Share Data With

We do not sell your data. We share data only with the following service providers, who act as data processors on our behalf:

• Google LLC (Analytics). Data may be transferred to the US under the EU-US Data Privacy Framework.
• Strato / hosting provider (Website hosting, account database, transactional email). Data is stored and processed within the EU.

6. Data Retention

Analytics data is retained for 14 months in Google Analytics, after which it is automatically deleted. Functional cookies expire at the end of your browser session; the login session cookie expires after 30 days of inactivity.

Account data is kept for as long as your account exists. Accounts that are never email-verified are deleted after 30 days. Expired sessions are removed automatically. The unlock log is kept for 24 months or until you delete your account, whichever comes first. You can delete your account at any time from the account page, which removes all of the above immediately.

7. Your Rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing of your data
• Object to processing based on legitimate interest
• Data portability where applicable
• Withdraw consent at any time (this does not affect the lawfulness of processing before withdrawal)

If your email address or name appears on a company profile, you can have it removed yourself on the Remove my data page. It removes the data from FirmLens, our API and data exports once you confirm by email.

To exercise any of these rights, contact us at info@firmlens.io.

8. Complaints

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Dutch Data Protection Authority:

• Autoriteit Persoonsgegevens
• Bezuidenhoutseweg 30, 2594 AV Den Haag
• www.autoriteitpersoonsgegevens.nl

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

10. Automated Decision-Making

FirmLens does not use automated decision-making or profiling that produces legal effects or similarly significant effects on individuals. We use AI to process publicly available company data for our directory. This does not involve processing personal data of our website visitors.