Spectacle B.V. — Privacy Policy
1. Introduction
1.1 This Privacy Policy explains how Spectacle B.V. (“Spectacle”, “we”, “us”, “our”), a private limited company (besloten vennootschap) incorporated under the laws of the Netherlands, registered at the Chamber of Commerce (Kamer van Koophandel) under number 91585937, with its registered office at Wilhelminapark 42, 3581 NK Utrecht, the Netherlands, collects, uses, shares, and protects personal data.
1.2 This Privacy Policy applies when you:
- visit our website at https://www.spectaclehq.com or any website or application that links to this policy;
- create an account and use the Spectacle platform (the “Services”);
- communicate with us, including through support channels, email, or events.
1.3 Spectacle acts as a data controller for the personal data described in this Privacy Policy (i.e., data we collect for our own purposes such as account management, billing, and product improvement). Where Spectacle processes personal data on behalf of a customer through the Services (e.g., website visitor tracking data, attribution data), Spectacle acts as a data processor and that processing is governed by the Data Processing Agreement (Annex 2 to our Terms of Service).
1.4 We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming, “UAVG”).
1.5 If you have questions about this Privacy Policy or wish to exercise your rights, please contact us at privacy@spectaclehq.com.
2. Personal Data We Collect
2.1 Data You Provide Directly
When you register for an account, subscribe to the Services, or communicate with us, we may collect:
| Category | Examples | Purpose |
|---|---|---|
| Identity data | First name, last name | Account creation, personalisation |
| Contact data | Email address, phone number | Communication, support, transactional emails |
| Account data | Username, password (hashed), account preferences | Authentication, account management |
| Billing data | Billing address, company name, VAT number | Invoicing, financial administration |
| Payment data | Payment method details (processed by Stripe) | Payment processing |
| Communication data | Support requests, feedback, survey responses | Support, product improvement |
Without this data we cannot create your account or deliver the Services.
Payment data note: We do not store full credit card numbers or sensitive payment credentials. All payment processing is handled by Stripe Inc. as our payment processor. See Stripe’s Privacy Policy.
2.2 Data Collected Automatically
When you visit our website or use the Services, we automatically collect:
| Category | Examples | Purpose |
|---|---|---|
| Device and browser data | IP address, browser type and version, operating system, device type, screen resolution | Security, compatibility, analytics |
| Usage data | Pages visited, features used, click patterns, session duration, referring URL | Product improvement, analytics |
| Log data | Server logs, error reports, timestamps | Security, debugging, service reliability |
| Approximate location data | Country and city (derived from IP address) | Localisation, analytics |
We do not collect precise geolocation data (e.g., GPS coordinates).
2.3 Data from Third Parties
We may receive limited data from:
- Authentication providers (e.g., Google, Microsoft) if you use single sign-on (SSO) to create or access your account. We receive only the profile information you authorise the provider to share (typically name and email address).
- Google APIs: Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
2.4 Data We Do Not Collect
We do not process special categories of personal data as defined in Article 9 GDPR (e.g., health data, biometric data, racial or ethnic origin, political opinions, religious beliefs). We do not knowingly collect personal data from children under 16 years of age.
3. Purposes and Legal Bases
We process personal data only where we have a valid legal basis under Article 6(1) GDPR. The table below sets out our processing purposes and the corresponding legal basis.
| Purpose | Legal basis (Art. 6(1) GDPR) | Details |
|---|---|---|
| Provide and maintain the Services | Performance of a contract (b) | Account creation, authentication, delivering the subscribed functionality |
| Process payments and billing | Performance of a contract (b) | Invoicing, payment collection, financial administration |
| Communicate with you | Performance of a contract (b) / Legitimate interest (f) | Responding to support requests, sending transactional notifications (e.g., password resets, service updates) |
| Improve and develop the Services | Legitimate interest (f) | Analysing usage patterns, identifying bugs, developing new features. Our legitimate interest is providing a reliable, competitive product. |
| Ensure security and prevent fraud | Legitimate interest (f) | Monitoring for suspicious activity, preventing unauthorised access. Our legitimate interest is protecting our platform and users. |
| Comply with legal obligations | Legal obligation (c) | Tax and accounting requirements, responding to lawful requests from authorities |
| Send marketing communications | Consent (a) | Product updates, newsletters, promotional content. Only with your explicit opt-in consent. You can withdraw consent at any time. |
| Display our website and set non-essential cookies | Consent (a) | Analytics and preference cookies (see Section 7). Only with your consent via our cookie banner. |
Legitimate interest balancing: Where we rely on legitimate interest, we have conducted a balancing test to ensure our interests do not override your fundamental rights and freedoms. You may contact us to request details of these assessments.
4. Who We Share Data With
We share personal data only where necessary and with appropriate safeguards. We do not sell personal data.
4.1 Service Providers (Sub-Processors)
We use the following categories of service providers to operate the Services:
| Provider category | Purpose | Location |
|---|---|---|
| Cloud hosting (e.g., AWS) | Infrastructure, data storage, compute | EEA (Ireland) |
| Database services (e.g., ClickHouse) | Data storage and querying | EEA |
| Payment processing (Stripe) | Payment handling | EEA |
| Email services (e.g., transactional email provider) | Sending transactional and marketing emails | EEA |
| Analytics (e.g., self-hosted or focused analytics) | Website analytics | EEA |
| Customer support tools | Ticketing and support communication, CRM | EEA / US (with SCCs) |
An up-to-date list of our sub-processors is available at https://www.spectaclehq.com/privacy/sub-processors or on request at privacy@spectaclehq.com.
4.2 Other Disclosures
We may also share personal data:
- With your consent — where you have given explicit permission.
- For legal compliance — to comply with applicable laws, regulations, legal processes, or enforceable governmental requests.
- To protect rights and safety — to enforce our Terms of Service, protect against fraud, or protect the rights, property, or safety of Spectacle, our users, or the public.
- In business transfers — in connection with a merger, acquisition, reorganisation, or sale of assets, your personal data may be transferred to the successor entity. We will notify you of any such change and any choices you may have regarding your data.
5. International Data Transfers
5.1 The Services are primarily hosted on infrastructure located in the European Economic Area (“EEA”). We store and process personal data within the EEA wherever possible.
5.2 Where we transfer personal data outside the EEA (e.g., to sub-processors in the United States), we ensure appropriate safeguards are in place in accordance with Chapter V GDPR, including:
- Standard Contractual Clauses (SCCs) — as adopted by the European Commission;
- Adequacy decisions — where the European Commission has determined that the receiving country provides an adequate level of data protection;
- Supplementary measures — where necessary, including encryption and access controls.
5.3 You may request a copy of the relevant transfer safeguards by contacting privacy@spectaclehq.com.
6. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.
After the applicable retention period expires, we either delete or anonymise the data so that it can no longer be associated with you.
7. Cookies and Tracking Technologies
7.1 We use cookies and similar technologies (e.g., local storage, pixels) on our website and in the Services.
7.2 We classify cookies into the following categories:
| Category | Consent required? | Purpose |
|---|---|---|
| Strictly necessary | No (exempted under ePrivacy Directive Art. 5(3)) | Essential for the website/application to function (e.g., authentication, security, load balancing) |
| Analytics | Yes | Understanding how visitors use our website (e.g., page views, session duration) |
| Functional / Preference | Yes | Remembering your preferences (e.g., language, display settings) |
| Marketing | Yes | Not currently used. If introduced, consent will be required. |
7.3 When you first visit our website, we present a cookie consent banner that allows you to accept or reject non-essential cookies. You can change your preferences at any time through our cookie settings or by adjusting your browser settings.
7.4 Rejecting non-essential cookies does not affect the core functionality of the Services.
8. Your Rights
8.1 Rights Under the GDPR
As a data subject, you have the following rights under the GDPR and UAVG:
| Right | Description |
|---|---|
| Access (Art. 15) | Request a copy of the personal data we hold about you. |
| Rectification (Art. 16) | Request correction of inaccurate or incomplete personal data. |
| Erasure (Art. 17) | Request deletion of your personal data, subject to legal exceptions. |
| Restriction of processing (Art. 18) | Request that we limit how we process your data in certain circumstances. |
| Data portability (Art. 20) | Receive your personal data in a structured, commonly used, machine-readable format. |
| Objection (Art. 21) | Object to processing based on legitimate interest or direct marketing. |
| Withdraw consent (Art. 7(3)) | Withdraw any previously given consent at any time, without affecting the lawfulness of processing before withdrawal. |
| Not be subject to automated decision-making (Art. 22) | Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Spectacle does not currently make such automated decisions. |
8.2 How to Exercise Your Rights
You can exercise your rights by emailing us at privacy@spectaclehq.com.
We will respond to your request within one (1) month. This period may be extended by a further two (2) months where necessary, taking into account the complexity and number of requests. We will inform you of any extension within one month of receipt of the request.
We will not charge a fee for exercising your rights, except where requests are manifestly unfounded or excessive (in which case we may charge a reasonable fee or refuse the request, with reasons).
8.3 Right to Lodge a Complaint
If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. In the Netherlands, the competent authority is:
Autoriteit Persoonsgegevens Bezuidenhoutseweg 30, 2594 AV Den Haag https://www.autoriteitpersoonsgegevens.nl
You may also lodge a complaint with the supervisory authority of the EU Member State of your habitual residence or place of work.
9. Security
9.1 We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction.
9.2 While we take reasonable steps to protect your personal data, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.
9.3 In the event of a personal data breach as defined in Article 4(12) GDPR that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay in accordance with Article 34 GDPR.
10. Children
The Services are intended for use by businesses and professionals. We do not knowingly collect personal data from children under 16 years of age. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that data promptly. If you believe we may have collected data from a child under 16, please contact us at privacy@spectaclehq.com.
11. Changes to This Privacy Policy
11.1 We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or applicable law.
11.2 If we make material changes, we will provide notice through the Services (e.g., a banner notification) or by email at least fourteen (14) days before the changes take effect.
11.3 Your continued use of the Services after the effective date of a revised Privacy Policy constitutes acceptance of the changes. If you do not agree, you should stop using the Services and contact us to request deletion of your data.
12. Contact Details
If you have questions about this Privacy Policy, wish to exercise your rights, or want to make a complaint, please contact us at:
Spectacle B.V. Attn: Privacy Wilhelminapark 42 3581 NK Utrecht The Netherlands
Email: privacy@spectaclehq.com