Privacy statement
HalloSlaap values your privacy and handles your personal data with care. This privacy statement explains which personal data we collect, why we do so, how long we keep it and what rights you have.
This privacy statement applies to all HalloSlaap services, including the website, the platform and the account environment.
I. Who are we?
HalloSlaap is a service of Sparklab B.V.
Sparklab B.V. (trading as HalloSlaap)
Chamber of Commerce number: 68034229
Address: Brugwal 1, 3432 NZ Nieuwegein, the Netherlands
Email: info@halloslaap.nl
The technical implementation and hosting of the halloslaap.nl website and the HalloSlaap online platform are provided by The MindOffice B.V. (Schiedamsedijk 126, 3134 KK Vlaardingen, the Netherlands, Chamber of Commerce number 78419689). The MindOffice acts as a processor within the meaning of the GDPR, under a data processing agreement with Sparklab B.V.
II. What is personal data?
Personal data is any information relating to an identified or identifiable natural person. Collecting, storing and using personal data is referred to as ‘processing’. When processing personal data, HalloSlaap complies with the General Data Protection Regulation (GDPR).
III. Which personal data do we process?
We process the following categories of personal data:
A. Account data (business platform users)
Users of the HalloSlaap platform are employees of companies that are given access through a company account. When an account is created, we process:
- First name and surname
- Email address (work)
- Name of the company / organisation
- Password (stored encrypted, never readable)
- Login details and session data
- Date and time of registration and last login
B. Sleep scan data
Users can complete a sleep scan on the platform. The following wellbeing data is processed in doing so:
- Nature and severity of sleep problems (difficulty falling asleep, difficulty staying asleep, waking up early)
- Satisfaction with sleep pattern
- Impact of sleep problems on daily functioning and concentration
- Impact on quality of life (as experienced by yourself and as perceived by others)
- Degree of concern about the sleep problem
- Duration of the sleep complaints
- Self-rated energy level (score)
- Self-rated sleep quality (score)
- Final score and sleep classification (e.g. ‘Poor’)
- Gender
- Age group
- Date and time of completion
C. Contact details
If you contact us via the website or a form:
- Name
- Email address
- Telephone number (if provided)
- Content of your message
D. Website usage data
When you visit our website, we automatically record:
- IP address
- Pages visited and click behaviour
- Browser type and device information
- Date and time of your visit
- Searches within the website
E. Communication history
We record when and how you have been in contact with us and what was discussed.
IV. For what purposes do we process your personal data?
We process personal data solely for specified, explicit purposes:
| Purpose | Legal basis | Data |
|---|---|---|
| Account management and access to the platform | Performance of a contract (Art. 6(1)(b) GDPR) | Account data, session data |
| Provision of services and customer service | Performance of a contract (Art. 6(1)(b) GDPR) | Name, email, communication history and wellbeing data |
| Customer administration and invoicing | Performance of a contract / legal obligation | Payment details, name and address details |
| Improving the website and the platform | Legitimate interest (Art. 6(1)(f) GDPR) | Website usage data |
| Marketing activities (newsletter, email) | Consent (Art. 6(1)(a) GDPR) | Email address, name |
| Statistical analyses (anonymised) | Legitimate interest | Website usage data |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c) GDPR) | Payment details, administrative data |
V. With whom do we share your personal data?
We only share personal data with third parties where this is necessary to provide our services, where we are legally required to do so, or where you have given your consent. We enter into a data processing agreement with every party that processes personal data on our behalf.
| Party | Role / purpose | Location |
|---|---|---|
| The MindOffice B.V. | Hosting, technical management of the platform, account structure (processor) | The Netherlands (EU) |
| Rootnet B.V. | Server hosting and email on secure infrastructure (sub-processor) | The Netherlands (EU) |
| Google Analytics | Website analytics (anonymised, IP masking enabled) | US – SCCs apply |
| Meta Platforms (Facebook/Instagram) | Marketing & tracking pixels (only with cookie consent) | US – SCCs apply |
| Email service provider (e.g. Mandrill) | Sending transactional emails via the platform | US – SCCs apply |
| Bailiffs / debt collection agencies | Where legally necessary in the event of non-payment | The Netherlands |
| Supervisory authorities and government bodies | Where legally required (e.g. the Dutch Data Protection Authority, the police) | The Netherlands |
VI. How long do we keep your data?
We do not keep personal data for longer than is necessary for the purpose for which it was collected, or for as long as the law requires.
| Category | Retention period |
|---|---|
| Account data (active account) | For as long as the account is active |
| Account data (after account deletion) | Up to 6 months after deletion, unless otherwise required by law |
| Financial and invoicing data | 7 years (statutory retention obligation) |
| Website data / log files | Up to 6 months |
| Backups | Up to 2 months |
| Contact form data | Up to 12 months after receipt |
| Communication history | 7 years after termination of the agreement |
VII. Security
We take the security of personal data seriously. The following measures apply:
- Encrypted connections (SSL/TLS) for all data traffic via the halloslaap.nl website
- Passwords are stored encrypted (hashed) — never in plain text
- Access to personal data is restricted to authorised staff
- All staff have signed a confidentiality agreement
- Hosting on a secure server at Rootnet B.V. in the Netherlands, in line with common security standards
- Continuous vulnerability scans and an active patch and update policy
- Data breaches are recorded. Where notification is required, the Dutch Data Protection Authority is informed within 72 hours
Internally, the Data Protection Officer of NN Group oversees compliance with privacy legislation. They can be contacted at: FG-Schade@nn.nl.
VIII. Cookies
The website www.halloslaap.nl uses cookies and similar technologies. We distinguish between:
- Functional cookies: necessary for the website and the platform to work (no consent required)
- Analytical cookies: for measuring website usage via Google Analytics (IP anonymisation enabled)
- Marketing cookies: for showing personalised advertisements via Meta Platforms — only after active consent
On your first visit to our website, you will be asked for consent to non-functional cookies. You can withdraw this consent at any time via the cookie settings on the website. You can find more information in our separate cookie policy.
IX. Your rights
Under the GDPR, you have the following rights with regard to your personal data:
| Right | What does it mean? |
|---|---|
| Right of access | You can ask which personal data we hold about you and for what purpose. |
| Right to rectification | You can have incorrect or incomplete data corrected. |
| Right to erasure (‘right to be forgotten’) | You can ask us to delete your data, unless we still need it to perform the agreement or to meet legal obligations. |
| Right to restriction | You can ask us to temporarily restrict processing, for example during an objection procedure. |
| Right to data portability | You can request your data in a structured, commonly used format for transfer to another provider. |
| Right to object | You can object to processing based on legitimate interest or for direct marketing purposes. |
| Right to withdraw consent | You can withdraw consent you have previously given (e.g. for marketing) at any time. |
To exercise any of these rights, please contact us at info@halloslaap.nl. We will respond within 30 days. You always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).
X. Where do we process your data?
In principle, your personal data is processed within the European Economic Area (EEA). For services where data is transferred to parties outside the EEA (such as Google Analytics and Meta Platforms), appropriate safeguards are in place in the form of Standard Contractual Clauses (SCCs) in accordance with Article 46 GDPR.
XI. Changes to this privacy statement
We reserve the right to amend this privacy statement. In the event of material changes, we will inform you via the website or by email. The date of the most recent change is always shown at the top of this page. We recommend that you consult this statement periodically.
XII. Contact
Do you have any questions or comments, or would you like to exercise one of your rights? Please get in touch:
HalloSlaap
Email: info@halloslaap.nl
Dutch Data Protection Authority: autoriteitpersoonsgegevens.nl | 0900 2001 201