Privacy statement
This statement covers the public marketing websites only. Processing of patients' data by the GRAI voice service is governed by the contract and Data Processing Agreement between GRAI and each clinic, where the clinic is the controller — not by this statement.
1. Who is responsible (controller)
Patrick Neicu, sole proprietorship (eenmanszaak) trading as GRAI
Netherlands Chamber of Commerce (KvK) no. 98239562
Van Leeuwenhoekpark 1, 2611 DW Delft, Netherlands
Contact for privacy matters: patrickneicu2006@gmail.com
2. What we collect, why, and on what legal basis
These are marketing/brochure sites with no user accounts and no login. We keep data collection to a minimum.
| Data | Purpose | Legal basis (GDPR Art 6) |
|---|---|---|
| IP address + technical request data (via our hosting provider's server logs) | Serve the site, security, abuse prevention | Legitimate interest, Art 6(1)(f) |
| IP address sent to Google Fonts when the page loads its web fonts | Display the site's typography | Legitimate interest, Art 6(1)(f) — see §5; we intend to self-host fonts to remove this |
| Booking details you enter on Cal.com (name, email, chosen time) if you click "book a demo" | Schedule and hold the meeting you requested | Performance of a step you requested / consent, Art 6(1)(b)/(a) |
We do not run advertising or analytics cookies, tracking pixels, or profiling on these sites.
3. Cookies
These sites set no cookies and use no analytics or tracking. If that changes, we will add a cookie banner and update this statement first.
4. Who we share data with (processors)
- Vercel — website hosting (serves the pages; processes request logs).
- Cal.com — demo-booking scheduling (only if you book a demo).
- Google — web fonts served from Google's servers (see §5).
We do not sell your data. We share it only with the providers needed to run the site, each under their own data-processing terms.
5. International transfers
Some providers above are based in, or may process data in, the United States. Where that happens, transfers are covered by an adequacy decision (the EU-US Data Privacy Framework) and/or the EU Standard Contractual Clauses. We are migrating font delivery to self-hosted fonts so that visiting the site no longer sends your IP address to Google.
6. How long we keep it
- Server logs: kept only as long as needed for security/operations, then deleted.
- Demo-booking details: kept for the purpose of the meeting and reasonable follow-up, then deleted.
7. Your rights
You have the right to access, rectify, erase, restrict or object to the processing of your personal data, and to data portability, under the GDPR. To exercise them, email patrickneicu2006@gmail.com. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
8. Changes
We may update this statement; the "last updated" date above reflects the current version.