Privacy

Privacy Policy

How SIPRONE processes the information you provide in the free Sovereignty Readiness Scan and when you apply for the paid Sovereignty Assessment.

Last updated 12 October 2026

Who is responsible for your data

SIPRONE is the controller for the personal data described in this policy. SIPRONE is a Dutch company and processes personal data under Dutch law and the General Data Protection Regulation.

SIPRONE B.V., a private limited company under Dutch law with its registered seat in The Hague, trading as SIPRONE, registered with the Dutch Chamber of Commerce under number 95583483, Doris Lessinglaan 114, 2553 ZB The Hague, the Netherlands. VAT number NL867191739B01. For any question about your personal data, write to that address or call +31 (0)85 902 00 62.

What we collect, and why

When you complete the Sovereignty Readiness Scan we collect your name, job title, work email address, organisation, sector and country; context about your current environment, critical workloads and existing infrastructure; your self-reported position across Ownership, Control, Jurisdiction, Independence, Portability, Exitability, Survivability and Evidence; and decision-timeframe, authority and investment-readiness information used separately for qualification.

When you submit an application we collect your name, work email address, organisation, country and, if you provide it, your direct phone number. We also collect the answers you give about your role, sector, decision authority, budget position and timeline, and anything you write in the free text field.

We use that information for one purpose: to assess whether your organisation qualifies for a follow-up conversation or for the paid Sovereignty Assessment, and to contact you about that next step. The preliminary eight-dimension Exposure Profile is calculated from your answers in your own browser. Commercial qualification is recalculated separately in SIPRONE’s CRM from the raw answers and is not the same as the sovereignty diagnostic.

If sending fails because of a connection problem, your scan answers are kept in your own browser and sent on your next visit to this site; once sent, they are removed from the browser. For the rest of your visit, your name, organisation and email address are also kept in the browser, so you do not have to type them again in the application form. That copy disappears when you close the tab.

The legal basis

We process this information on the basis of our legitimate interest in assessing and responding to business enquiries, and where you have asked us to take steps before entering into an agreement. If we later want to use your details for anything else, we will ask you separately first.

For the Sovereignty Readiness Scan we also ask for your explicit agreement before anything is sent. You can withdraw it at any time, and we then delete your submission.

We do not use scan or application data for marketing unless you have separately and actively agreed to it. Nothing on this site is pre-ticked.

Who else sees it

Your scan and application are handled by SIPRONE staff involved in qualification and follow-up. It is stored in our own customer relationship system, which runs on infrastructure SIPRONE controls.

Besides the SIPRONE staff involved, three categories of processor can come into contact with the data, each on our instructions and under a processing agreement: the hosting provider of this website, the provider of our business email, and the analytics provider described under Cookies. Our customer relationship system runs on infrastructure SIPRONE controls, so your application is not held by an external CRM vendor. We do not sell personal data, and we do not pass it to advertisers.

How long we keep it

We keep scan and application data for as long as it is needed for the purpose above, and after that only where a legal obligation requires it.

If your scan or application does not lead to an agreement, we keep it for 24 months after our last contact with you and then delete it. If it does lead to an agreement, we keep what the agreement and Dutch tax law require, which is seven years for the financial record.

Data outside the European Economic Area

Our aim is that scan and application data stays inside the European Economic Area.

The one processing that can reach outside the European Economic Area is website analytics, and it only runs after you accept it. That provider may process data outside the EEA under an adequacy decision or the European Commission's standard contractual clauses. Decline analytics and no analytics data is collected at all.

Your rights

You can ask us for a copy of the personal data we hold about you, and you can ask us to correct it, delete it, restrict how we use it, or object to our using it. Where processing is based on consent, you can withdraw that consent at any time.

To exercise any of these rights, write to the contact address above. We answer within one month.

If you are not satisfied

If you believe we have handled your personal data incorrectly, you can lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens, or with the supervisory authority in your own country.

Cookies

This site uses analytics only, and only after you accept it. You can decline it without losing access to any part of the site. Which cookies are involved, how long they last and how you change your choice is set out in the Cookie Policy.