Privacy Policy

Last updated on November 2, 2026

This is an English translation of our Dutch Privacy Policy (Privacyverklaring). It is provided for convenience only; in case of any difference in meaning, the Dutch version prevails.

---

Article 1. Introduction and Scope

We process only the personal data that is necessary to provide our services, and we handle it with care. This privacy policy explains what data we process, why we do so, with whom we share data, and what rights you have.

This policy applies to visitors to our website, (prospective) customers, contact persons of business customers, and other persons with whom we are in contact. We process personal data in two roles:

• Controller: for data that we need ourselves to run our business, such as contact, contract, and billing data.
• Processor: for data that customers store or have managed through our hosting and management services (see Article 5). In that case, the customer is the controller, and our arrangements are set out in a data processing agreement.

We comply with the General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act.

---

Article 2. Who We Are

Matreon IT is a web hosting and MSP (managed service provider) company and is the controller for the processing operations described in this policy.

Email for privacy questions: [email protected]

---

Article 3. What Personal Data We Process

We process only data that you provide to us yourself or that is generated through your use of our services.

• Contact and identity data: name, job title, company name, email address, phone number, and address.
• Account and contract data: username, selected services, domain names, contract term, and service arrangements.
• Financial data: billing address, VAT number, payment status, and payment history. Payment details such as card or account numbers are processed by our payment processors and are not stored by us.
• Communication data: emails, support tickets, chat messages, and phone notes about your questions or outages.
• Technical data: IP address, time of access, log files from servers and network equipment, and data about the device or browser you use to access our website or customer portal.
• Management data (MSP): user accounts, device data, and security alerts from systems that we manage for customers.

We do not process special categories of personal data (such as health data or criminal records data), nor do we ask for it. If a customer itself stores such data on our systems, we process it as a processor on behalf of that customer.

---

Article 4. Purposes and Legal Bases

We use your data only for the purposes listed below, and only where there is a legal basis for doing so.

Where we rely on a legitimate interest, we have weighed that interest against your privacy. You can always object (see Article 11). Data is not used for automated decision-making or profiling that produces legal effects.

---

Article 5. Our Role as Processor

For the data that customers store on our hosting and management platforms, we are the processor and the customer is the controller. This applies, for example, to the customer's websites, mailboxes, databases, backups, and managed workstations.

In that role, we:

• process this data only on the basis of the customer's written instructions, as set out in a data processing agreement;
• do not use it for our own purposes;
• take appropriate security measures and ensure that our employees are bound by confidentiality;
• engage sub-processors only with the customer's permission and impose the same obligations on them;
• notify the customer of a personal data breach without undue delay;
• assist the customer with data subject requests and with deleting or returning data at the end of the agreement.

If you are a data subject with respect to data that one of our customers processes on our systems, it is best to send your request directly to that customer. We forward any such requests we receive.

---

Article 6. Cookies and Analytics

Our website uses only strictly necessary cookies and no tracking cookies. We do not use Google Analytics or any other analytics services, or advertising or social media trackers that follow your behavior across websites.

Strictly necessary cookies are needed for the website or customer portal to work, for example to keep you logged in, secure your session, or remember your language preference. Under the Dutch Telecommunications Act, no consent is required for these cookies. That is why we do not display a cookie banner.

You can always delete or block cookies through your browser settings. Some parts of our customer portal may then no longer work.

---

Article 7. Sharing with Third Parties

We never sell your data. We share it only with parties we need in order to provide our services, or when required by law.

• Transaction processors: payments are handled by external payment service providers (Mollie, paypal). They receive the data needed to carry out the payment and to check it for fraud. For the payment data itself, they are independent controllers and apply their own privacy policies.
• Administration and accounting: an external accounting firm or accounting software (SnelStart) processes invoice and customer data to handle our bookkeeping and tax filings. We have entered into a data processing agreement with this party (or these parties).
• Other suppliers: parties we engage for, for example, data centers, email delivery, support systems, monitoring, or backups. They process data only on our behalf and under a data processing agreement.
• Government and regulators: we disclose data when we are legally required to do so, for example to the Dutch Tax Administration (Belastingdienst) or upon a demand from the police or judicial authorities.

A current list of sub-processors is available on request at [email protected].

---

Article 8. Transfers Outside the EEA

We prefer to process personal data within the European Economic Area (EEA). If a supplier, such as a payment processor or software provider, transfers data to a country outside the EEA, we allow this only with an appropriate safeguard. That safeguard is an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework for participating U.S. companies, or the European Commission's standard contractual clauses with supplementary measures where necessary.

Your hosting and customer data remains at the locations specified in your agreement.

---

Article 9. Retention Periods

We do not retain personal data for longer than necessary for the purpose for which we process it, unless the law requires a longer period.

After that, we delete or anonymize the data.

---

Article 10. Security and Personal Data Breaches

We protect personal data with technical and organizational measures appropriate to the risk. These include:

• encrypted connections (TLS) and encryption of sensitive data where possible;
• need-based access control, strong passwords, and multi-factor authentication;
• logging and monitoring of systems, and regular updates and patches;
• backups and recovery procedures;
• physical security of data centers;
• confidentiality obligations and privacy training for employees.

If we discover a personal data breach, we immediately assess the risks. Where necessary, we report the breach to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours and inform the data subjects. For data that we manage as a processor, we inform the customer without undue delay.

Do you suspect a personal data breach or security issue? Report it immediately to [email protected].

---

Article 11. Your Rights

Under the GDPR, you have the following rights:

• Access: you can request information about which of your personal data we process.
• Rectification: you can have inaccurate or incomplete data corrected.
• Erasure: you can ask us to erase your data, unless we are required to retain it.
• Restriction: you can ask us to temporarily restrict the processing.
• Portability: you can receive your data in a commonly used format or have it transferred.
• Objection: you can object to processing based on legitimate interest, and you can always object to direct marketing.
• Withdrawal of consent: you can withdraw any consent you have given at any time. Processing carried out before the withdrawal remains lawful.

Send your request to [email protected]. To prevent misuse, we may ask you to verify your identity. We will respond within one month. If your request is complex, we may extend that period by up to two months, and we will let you know within the first month. Exercising your rights is free of charge, except in the case of manifestly unfounded or excessive requests.

---

Article 12. Complaints

Do you have a complaint about how we handle your data? Please contact us first at [email protected] so that we can resolve it. You also always have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via autoriteitpersoonsgegevens.nl.

---

Article 13. Changes

We may amend this privacy policy, for example when we introduce new services, change suppliers, or when legislation changes. The current version is always available on our website, along with the date of the last change. In the event of significant changes, we will inform our customers directly.

Last updated: October 13, 2026.

---

Article 14. Contact

If you have questions about this privacy policy or about the processing of your data, you can contact us.