Legal

Privacy policy

Version 1.0 · last updated 10 July 2026

This is an English translation provided for convenience. In case of any discrepancy, the Dutch version prevails.

Certly (gocertly.com) helps businesses track the expiry dates of certificates, inspections and licences. In doing so we process personal data. This policy explains what data that is, why we process it and what rights you have under the GDPR.

1. Who is responsible?

The controller for account data and website usage is Universal Canvas, Dutch Chamber of Commerce (KvK) 92815111, reachable via support@certly.nl.

For the data a customer enters into Certly themselves (such as employee names and certificates), the customer is the controller and Certly acts as processor. See also the data protection page.

2. What data do we process?

Account data

• Name, email address and password (stored encrypted)
• Organisation name and invited team members
• Subscription and payment status (via our payment provider Stripe)

Data you enter as a customer

• Employee names and vehicle registrations (holders)
• Documents: type, number, issue and expiry date, and optionally an uploaded file (e.g. a scan of a certificate)

Automatically collected data

• Technical log data (IP address, timestamp, browser type) for security and troubleshooting
• Functional cookies for logging in and security — see the cookie policy

3. What do we use this data for?

• Providing the service — accounts, the dashboard and automatic email reminders (legal basis: performance of the contract).
• Invoicing and administration (legal basis: legal obligation and performance of the contract).
• Security and abuse prevention (legal basis: legitimate interest).
• Service communication about your account or changes to the service (legal basis: performance of the contract).

We do not sell data to third parties and do not use your data for advertising.

4. Who do we share data with?

We use a small number of sub-processors to run Certly:

Data processing agreements are in place with these parties. For transfers outside the EEA, appropriate safeguards apply, such as EU Standard Contractual Clauses (SCCs) or the EU-U.S. Data Privacy Framework.

5. How long do we keep data?

• Account data and entered data: for as long as the account exists. After cancellation we delete it within 30 days.
• Invoice data: 7 years (statutory tax retention obligation).
• Technical logs: at most 90 days.

6. Security

We take appropriate technical and organisational measures: encrypted connections (TLS), encrypted password storage, strict separation of data per organisation (multi-tenancy), role-based access and secured uploads.

7. Your rights

Under the GDPR you have the right to:

• Access the data we process about you
• Correction of inaccurate data
• Erasure ("right to be forgotten")
• Restriction of processing and objection
• Data portability

Email your request to support@certly.nl; we respond within 30 days. Are you an employee of a business that uses Certly, and does your request concern data that business entered? Then we forward your request to your employer (the controller) or refer you to them.

You can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or with your local supervisory authority — in the UK, the Information Commissioner's Office (ICO).

8. Changes

We may amend this policy. In the event of material changes we inform account holders by email. The current version is always on this page.