SolutionsProofResourcesAbout✦ Book a meeting

Privacy Policy

BlueHero B.V. ("BlueHero", "we", "us") helps employers retain new hires through automated WhatsApp check-ins during the first 90 days of employment. This privacy policy explains how we collect, use and share personal data when you visit https://www.bluehero.io (the "Site") and when we provide the BlueHero platform to our customers.

1. Who we are

BlueHero B.V.

Saturnusstraat 95, 2516 AG The Hague, the Netherlands

Email: hello@bluehero.io

Chamber of Commerce (KvK) number: 98006657

We have not appointed a data protection officer (DPO); for privacy-related questions, please use the email address above.

2. Our two roles under the GDPR

For the Site, our marketing and our customer relationships, we act as controller. Part A of this policy describes that processing. For the personal data of employees processed through the BlueHero platform (such as WhatsApp check-ins), we act as processor on behalf of the employer; in that case, the employer is the controller. Part B describes that processing.

Part A: Site visitors and business contacts

3. What personal data we collect

Data you provide to us. When you join the waitlist, request a demo, or otherwise contact us through a form on the Site, we collect your name, company name, work email address, optionally the number of employees in your organisation, and any other information you share in the form or in subsequent correspondence. The forms on the Site are processed through Webflow, the platform the Site runs on.

Data collected automatically ("Device Data"). When you visit the Site, we automatically collect certain information about your device and your use of the Site: your IP address, browser type and version, time zone, the pages you view, the website or search term that referred you to the Site, and date and time stamps of your visit. We collect this data using cookies, log files and similar technologies (see section 5).

4. How we use this data

We use the data described in Part A for the following purposes, each with the corresponding legal basis under the GDPR:

  • Handling your waitlist sign-up or demo request, scheduling demos and answering your questions. Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR).
  • Entering into and performing agreements with our customers, including invoicing and record-keeping. Legal basis: performance of a contract and compliance with legal (tax) obligations.
  • Sending product updates and marketing communications about BlueHero. Legal basis: our legitimate interest in keeping existing business contacts informed, or your consent. You can unsubscribe from every message.
  • Analysing and improving the Site and our services using Google Analytics and PostHog, for example to understand how visitors use the Site. Legal basis: your consent (via the cookie banner).
  • Measuring and improving our marketing campaigns through advertising platforms, including LinkedIn and Google Ads, for example through conversion measurement and retargeting. Legal basis: your consent (via the cookie banner). You can also opt out of personalised advertising through your LinkedIn ad settings and your Google ad settings.
  • Identifying organisations that visit the Site using Snitcher. Snitcher uses, among other things, your IP address and a cookie to determine which company a visitor belongs to. This provides us with company-level information for our B2B marketing and sales; we do not build profiles of individual consumers with it. Legal basis: our legitimate interest in reaching business audiences. You have the right to object (see section 11).
  • Securing the Site and preventing abuse and fraud, based on data such as IP addresses and log files. Legal basis: our legitimate interest in providing a secure service.

5. Cookies and similar technologies

The Site uses the following categories of cookies and similar technologies:

  • Functional cookies required for the Site and its forms to work properly (set through Webflow and Cloudflare).
  • Analytics cookies from Google Analytics and PostHog, which we use to generate statistics about the use of the Site.
  • Advertising cookies and pixels from LinkedIn and Google Ads for campaign measurement and retargeting.
  • A Snitcher cookie used to identify visiting organisations, as described in section 4.

We only set analytics cookies, advertising cookies and the Snitcher cookie after you have given consent through the cookie banner, where the law requires this. You can also refuse or delete cookies through your browser settings; some parts of the Site may then work less well. General information about cookies is available at allaboutcookies.org. Google offers a separate opt-out for Google Analytics at tools.google.com/dlpage/gaoptout.

Do Not Track: a "Do Not Track" signal from your browser does not currently change how we collect data.

6. Who we share personal data with

We do not sell personal data. We share personal data with service providers that help us operate the Site and deliver our services:

We may also disclose personal data to comply with applicable laws and regulations, to respond to a lawful request from a competent authority, or to otherwise protect our rights.

7. Transfers outside the European Economic Area

Data processed through the BlueHero platform is hosted within the EU. Some of our service providers (including Webflow, Cloudflare, Google, Meta, PostHog, Supabase and LinkedIn) may process personal data in the United States. We base such transfers on the adequacy decision for the EU-US Data Privacy Framework and, where necessary, on the European Commission's Standard Contractual Clauses.

Part B: employees of our customers (the BlueHero platform)

8. Processing through the BlueHero platform

On behalf of employers (our customers), we process personal data of their employees to run automated WhatsApp check-ins during the first period of employment. This concerns data such as: name, phone number, role, start date and team or location details as provided by the employer; the content of the check-ins and the employee's responses; and the signals about potential attrition risks that the platform derives from them and reports to HR.

For this processing, the employer is the controller and we are the processor. The employer determines the purposes and the legal basis and informs its employees about the use of BlueHero. We enter into a data processing agreement with every customer. We use this data solely to provide the service and not for our own purposes. To deliver the service we use sub-processors, including Meta Platforms (WhatsApp Business Platform) for message delivery and Supabase for database hosting, with storage within the EU; an up-to-date list of sub-processors is included in or available through the data processing agreement.

If you are an employee of an organisation that uses BlueHero and you want to exercise your rights or have questions about this processing, please contact your employer; we support employers in handling such requests. You are of course also welcome to contact us directly at hello@bluehero.io; where needed, we will forward your request to your employer.

The signals generated by the platform are intended to support HR. Decisions with legal effects for employees are not made solely by automated means by the platform.

General

9. Retention periods

  • Waitlist, demo and contact data: for as long as needed for the purpose for which you provided it, and no longer than 12 months after our last contact, unless a customer relationship is established or you ask us to delete it earlier.
  • Customer and invoicing data: for the duration of the agreement and thereafter for as long as statutory retention periods require (seven years for administrative records under Dutch law).
  • Analytics and advertising data: in accordance with the retention periods we have configured in Google Analytics (maximum 14 months), PostHog and the advertising platforms.
  • Platform data (Part B): in accordance with the data processing agreement; after the agreement ends, this data is deleted or returned to the customer.

10. Security

We take appropriate technical and organisational measures to protect personal data against loss and unlawful processing, including: encrypted connections (SSL/TLS); encryption and access controls in Supabase; security and DDoS protection through Cloudflare; storage of platform data within the EU; and access to personal data restricted to authorised staff.

11. Your rights

Under the GDPR, you have the right to access the personal data we process about you, and the right to have it rectified, completed or erased. You also have the right to restriction of processing, the right to data portability, the right to object to processing based on our legitimate interests (including direct marketing and the identification of visiting organisations), and the right to withdraw consent you have previously given.

You can exercise these rights by emailing hello@bluehero.io. We respond within one month and may ask you to verify your identity before acting on a request. If you are not satisfied with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or with the supervisory authority in your own EU member state.

12. Minors

The Site and our services are not directed at persons under the age of 16. We do not knowingly collect personal data from minors.

13. Changes

We may update this privacy policy from time to time, for example due to changes in our services or in laws and regulations. The current version is always available on the Site. In the event of significant changes, we will actively inform our customers.

14. Contact

If you have questions about this privacy policy or about how we handle personal data, or if you want to file a complaint, please email hello@bluehero.io or write to:

BlueHero B.V.

Saturnusstraat 95

2516 AG The Hague

The Netherlands