Kevlex Privacy Policy
Last updated: 19 October 2026
This Privacy Policy explains how Kevlex Management B.V. handles personal data when it decides why and how that data is processed. It covers visitors to our website, contacts at our clients and prospective clients, and users of our client portals and Platforms.
1. Who we are
Kevlex Management B.V., trading as Kevlex Digital and Kevlex Academy ("Kevlex", "we", "us"), is the controller for the processing described in this policy.
- Registered office: Sisalbaan 5a, 2352 AZ Leiderdorp, The Netherlands
- Chamber of Commerce (KvK) number: 81126042
- VAT (BTW) number: NL861943120B01
- Privacy contact: hello@kevlex.digital
2. When this policy does not apply
When we process personal data on behalf of a client, for example a client's leads, customers or policyholders in a CRM we manage, the client is the controller and we are its processor. That processing is governed by our Data Processing Agreement and by the client's own privacy policy. Individuals with questions about that data should contact the client directly. We will forward requests we receive to the relevant client.
3. Business use only
Our services are offered only to businesses. We do not knowingly collect personal data from anyone under 16, and our website and services are not intended for them.
4. What we collect, why, and on what legal basis
| Who | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Website visitors | IP address, browser and device data, pages visited, cookie identifiers | Operating and securing the website; analytics where you consent | Legitimate interest (operation and security); consent (non-essential cookies) |
| People who contact us or submit a form | Name, email, phone, company, role, message content | Responding to enquiries and following up | Legitimate interest; steps at your request before a contract |
| Client contacts | Name, business contact details, role, communications, meeting notes | Performing and managing our Agreement with the client | Performance of a contract; legitimate interest |
| Prospective clients | Name, business contact details, company, role, publicly available professional information | Business-to-business outreach about our services | Legitimate interest |
| Meeting participants | Audio, video, transcripts and summaries of meetings | Accurate notes, follow-up and quality of delivery | Legitimate interest |
| Portal and Platform users | Name, email, login data, usage and activity logs | Providing access, security, support and improving the Platforms | Performance of a contract; legitimate interest |
| Billing contacts | Name, company, billing address, VAT number, invoice and payment records | Invoicing, collection and legal record-keeping | Performance of a contract; legal obligation |
Where we rely on legitimate interest, we have weighed our interest against your rights. You can object at any time (see clause 9).
5. Outreach and meeting recordings
We contact prospective clients only at a business address and only about services relevant to their business. Every outreach message lets you opt out, and we honour opt-outs promptly.
We record and transcribe meetings only after telling participants at the start or in the invitation. You may ask us not to record a meeting.
6. Use of AI tools
We use AI tools, including large language models, to help draft content, summarise meetings, analyse data and write code. We use them under business terms with our providers. We do not use your personal data to train AI models, and we do not make decisions with legal or similarly significant effects about you based solely on automated processing.
7. Who we share data with
We share personal data only with:
- service providers that process it on our behalf, listed in clause 8;
- our professional advisers, such as accountants and lawyers, under confidentiality;
- authorities, where the law requires it;
- a buyer or successor of our business, under equivalent protection.
We do not sell personal data.
8. Service providers and international transfers
| Provider | Purpose | Location |
|---|---|---|
| HighLevel Inc. (LeadConnector) | CRM, messaging, automation | United States |
| Twilio Inc. | SMS and voice delivery | United States |
| Google LLC (Workspace) | Email, documents, file storage | United States / EU |
| Google Ireland Limited / Google LLC (Google Analytics 4) | Website analytics, only with your consent | United States / EU |
| Anthropic PBC | AI-assisted drafting and analysis | United States |
| Read AI, Inc. | Meeting recording and transcription | United States |
| Railway Corporation | Platform hosting | United States |
| Cloudflare, Inc. (R2) | Platform file storage | United States / global |
| Stripe, Inc. | Payment processing | United States / EU |
Some of these providers process data outside the European Economic Area. For those transfers we rely on an adequacy decision, such as the EU-US Data Privacy Framework for certified recipients, or on the EU Standard Contractual Clauses.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have data erased, where there is no ground for us to keep it;
- restrict processing in certain cases;
- receive your data in a portable format, where processing is based on consent or contract;
- object to processing based on legitimate interest, including outreach, which we will then stop;
- withdraw consent at any time, without affecting earlier processing.
Send requests to hello@kevlex.digital. We respond within one month. We may ask you to confirm your identity first.
You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl, or with the authority in your own country.
10. How long we keep data
| Data | Retention |
|---|---|
| Invoices and financial records | 7 years, as required by Dutch tax law |
| Client contact and engagement records | Duration of the Agreement plus 2 years |
| Enquiries that do not lead to an Agreement | 2 years after last contact |
| Prospective client data | 2 years after last contact, or until you object |
| Meeting recordings and transcripts | Duration of the engagement plus 1 year |
| Portal and Platform accounts | Duration of the Agreement; data deleted or returned within 30 days after it ends |
| Website analytics (Google Analytics 4) | 14 months |
11. Cookies
Our website uses cookies that are strictly necessary to run it. We use Google Analytics 4 to understand how visitors use the site. Its cookies are placed only with your consent, given through the cookie banner. Without consent, Google Analytics does not set cookies on your device. You can change or withdraw your consent at any time through the banner or your browser settings.
12. Security
We protect personal data with appropriate technical and organisational measures, including access control, encryption in transit, multi-factor authentication on administrative accounts and least-privilege access. If a data breach is likely to put your rights at risk, we will notify the authorities and, where required, you.
13. Changes to this policy
We may update this Privacy Policy by posting a new version with a new "Last updated" date. Material changes will be highlighted on our website or communicated to clients by email.
14. Contact
Kevlex Management B.V.
Sisalbaan 5a, 2352 AZ Leiderdorp, The Netherlands
hello@kevlex.digital