Privacy Statement ModelMatic B.V.
Version April 2026
Translator's note: This is an English translation of the Dutch original "Privacyverklaring ModelMatic B.V.". In the event of any discrepancy between this translation and the Dutch original, the Dutch version shall prevail. References to the GDPR correspond to references to "AVG" in the Dutch original.
1. Who is responsible for processing your data?
ModelMatic B.V., having its registered office at Princetonlaan 6, 3584 CB Utrecht, the Netherlands, is responsible for the processing of personal data described in this privacy statement.
ModelMatic B.V. acts as a processor on behalf of the customer.
The customer (company, consultancy, (semi-)government body) determines the purposes and means of the processing of personal data within ModelMatic. ModelMatic B.V. processes personal data solely on behalf of and in accordance with the customer's instructions.
Contact details ModelMatic B.V.
• Address: Princetonlaan 6, 3584 CB Utrecht, the Netherlands
• Email: info@modelmatic.nl / support@modelmatic.nl
• Website: https://www.modelmatic.nl / https://www.modelmatic.ai / https://app.modelmatic.nl / https://app.modelmatic.ai
2. When does this privacy statement apply?
This privacy statement applies to all services and software applications of ModelMatic B.V. under the name ModelMatic, including:
• the online SaaS platform ModelMatic for automated documentation generation;
• the use of ModelMatic by companies, consultancies, (semi-)government bodies and their employees;
• use via web browser or other online means of access;
• the websites modelmatic.nl, modelmatic.ai and related services.
This privacy statement applies to anyone involved with ModelMatic, in particular users (employees of customers) and data subjects whose personal data appears in input (audio, video, text, PDF).
3. What data do we process?
ModelMatic processes personal data necessary to operate the platform, generate documentation (transcription, summary, BPMN models, insights) and support the service.
We distinguish the following categories of data:
Identification and organisation data — name of user, role, organisation, contact person
Contact details — email address, telephone number
Audio and transcription data — audio recordings of interviews, transcribed conversation content
Document and file data — files uploaded by users (e.g. text, PDF, video) for the purpose of document processing
Process and workflow data — content of conversations relevant to process models (variable per customer)
Usage and technical data — log-in times, IP address, browser information, session duration, usage statistics
Document processing — document processing and storage, such as but not limited to: images, Microsoft Office documents and PDFs
Billing data — billing address, organisation name, payment details
Special categories of personal data: In principle, ModelMatic does not process special categories of personal data (Article 9 GDPR, such as health data, racial or ethnic origin, sexual orientation) unless specifically agreed between the parties in writing and in accordance with the GDPR. The starting point is that such data is not entered or processed via ModelMatic.
4. Purposes and legal bases
We process personal data only for clearly defined purposes and on a lawful basis (Article 6 GDPR).
Creating and managing user accounts and access to ModelMatic — Performance of the contract
Performing transcription, summarisation, AI insights and generation of BPMN models and other documentation — Performance of the contract
Audit logging, security, technical administration and prevention of misuse — Legitimate interest / legal obligation
Responding to questions and providing support — Performance of the contract / legitimate interest
Billing, administration and tax obligations — Legal obligation
Improving the platform and analysing (anonymised) usage data — Legitimate interest (product improvement)
AI functionality and AI Act
ModelMatic uses AI for:
• transcription of audio/video;
• summarisation and extraction of insights;
• automatic generation of BPMN process models and other documentation.
The AI provides supporting output only (drafts). ModelMatic emphasises that the output is not necessarily substantively correct or complete and must always be validated and verified by the user. ModelMatic is not responsible for the substantive accuracy of the generated models or insights.
Under the EU AI Act, ModelMatic falls within the limited-risk category. Accordingly:
• users are clearly informed that ModelMatic is an AI-driven platform;
• the output is presented as a draft that requires validation;
• there is no high-risk classification (no autonomous decision-making with legal effects).
5. From whom do we receive the data?
ModelMatic receives personal data:
• directly from customers (companies / (semi-)government bodies) when creating accounts and uploading input;
• automatically when the platform is used (e.g. IP address, browser information, session duration, usage statistics).
6. With whom do we share data?
ModelMatic only shares personal data with third parties where necessary for the service or to comply with legal obligations.
Possible recipients are:
• sub-processors: AWS, AssemblyAI, Google Workspace, Sentry, Moneybird, Pipedrive, Jira, Kinde;
• supervisory authorities or other authorities: only if and to the extent legally required.
ModelMatic does not sell personal data to third parties. All processing takes place within the EU/EEA.
7. Retention periods
ModelMatic does not retain personal data longer than necessary for the purposes for which it was collected, unless a statutory retention period applies.
Account and contact data — For the duration of the contract + max. 2 years after termination
Audio, transcripts and generated output — Determined by the customer; default 30 days read-only access after termination, deletion within 90 days
Usage and technical log data — Maximum 1 year
Financial records — 7 years (statutory tax retention)
Anonymised and aggregated data — As long as necessary for analysis and product improvement (no longer identifiable)
After the end of the retention periods, data is deleted or anonymised.
8. Where is your data stored?
Personal data is stored with carefully selected sub-processors within the European Economic Area (EEA). No transfers take place outside the EEA.
9. How do we secure your data?
ModelMatic takes appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. ModelMatic is ISO 27001 certified. Examples of measures include:
• encryption of data in transit and at rest;
• Multi-Factor Authentication (MFA);
• Role-Based Access Control (RBAC);
• extensive logging and monitoring of all access;
• daily automated, geographically redundant back-ups within the EU;
• periodic penetration tests and security audits;
• incident response plan in accordance with ISO 27001.
10. Your rights
Under the GDPR, you have the following rights:
• Right of access
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object
Data subjects exercise their rights through the customer (the controller). For requests relating to processing by ModelMatic B.V. itself (e.g. contact details), please email info@modelmatic.nl or support@modelmatic.nl. Requests are handled within the statutory time limits (in principle 1 month; access within 5 working days, rectification within 2 working days, erasure/objection within 24 hours of receiving instructions).
11. Complaints
If you consider that ModelMatic is not handling personal data with due care, you can always first contact us at info@modelmatic.nl or support@modelmatic.nl. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via www.autoriteitpersoonsgegevens.nl.
12. AI use, transparency and control
ModelMatic uses AI for transcription, summarisation and generation of process models. The output is supporting in nature and must always be validated by the user. ModelMatic communicates clearly that the platform is AI-driven. User feedback is actively collected and processed in further development (on an anonymised basis). Significant model changes are communicated in advance.
13. Changes
ModelMatic may amend this privacy statement, for example when legislation (GDPR or AI Act) changes or when we expand our services. The most recent version is always available at https://www.modelmatic.nl and https://www.modelmatic.ai. In the event of material changes, we will inform customers in an appropriate manner.
