Legal

Privacy notice

Last updated 11 September 2026

Symphonia Labs builds applied AI for private equity, portfolio leadership and boards. That work depends on trust, so this notice is short and specific about what we do with personal data: on this website, in our correspondence with you, and in the engagements we run for clients.

Who is responsible

Symphonia Labs B.V., Ambachtsweg 2, 6541 DB Nijmegen, the Netherlands, is the controller for the processing described here. Questions, requests and complaints go to hi@symphonia-labs.com. We respond to requests about your data within one month; if a request is complex we may need up to two months more and will tell you why.

This website

The site is static: it has no accounts, no login and no server-side code of our own. It is hosted on Vercel and served from European edge locations. Vercel Inc. is a US company; it keeps access logs (IP address, request, browser type) for security and operations under its data processing agreement, which applies the European Commission's standard contractual clauses to any access from outside the EU. We use those logs only to keep the site available and safe. Legal basis: our legitimate interest in running a secure website.

Apart from the consent cookie described below, the site sets no cookies. It remembers your light or dark theme in your browser's local storage, which holds no personal data and never leaves your device.

Analytics, only with your consent

With your consent we use Google Analytics 4 to understand how the site is used: which pages are read, from which country, on which type of device. It sets the cookies _ga and _ga_* for up to two years. Google Ireland Limited processes this data for us; part of it may be processed by Google LLC in the United States under the EU-US Data Privacy Framework. Google Signals, advertising features and Google's data-sharing settings are switched off for this property, so the data serves our statistics only: no advertising and no profiles of visitors.

Google Analytics is not loaded until you allow statistics cookies in the banner. Your choice is stored by Cookiebot (Usercentrics A/S, Denmark) in the cookie CookieConsent for twelve months. You can change or withdraw it at any time via "Cookie settings" in the footer. Legal basis: consent.

When you get in touch

The introduction form asks for your name, work email address, organisation, the perspective you write from and your starting point, which we need to reply, plus optional context; it also records the page and language you wrote from. The submission is delivered to us by Formspark, a Belgian form service that stores data in the EU; it forwards the submission to our mailbox, keeps a copy until we delete it, and logs your IP address for twelve months to filter spam. Email to us runs on Google Workspace (Google Ireland Limited).

We use what you send us to reply and, where a conversation follows, to prepare and run it. We keep introductions and correspondence, including the copy held by Formspark, for as long as the conversation is active and for up to two years afterwards, unless a client engagement or a legal obligation requires longer. We never add you to a mailing list. If we contact you first, we took your business contact details from a public source such as LinkedIn or your organisation's website, or from an introduction, on the basis of our legitimate interest in reaching decision-makers in our market; you can object at any time. Legal basis for correspondence: our legitimate interest in responding to a request you initiated and, once an engagement takes shape, in preparing and performing the contract with your organisation; where you contract with us personally, the steps needed to enter into that contract.

Client engagements

In an engagement we typically process data on behalf of the client: operational data, documents, and the personal data those may contain. We then act as processor under a data processing agreement that fixes purpose, scope, security measures, sub-processors, retention and deletion. The client remains the controller: its privacy notice applies to that data, and a request about it that reaches us goes to the client. Three principles apply throughout:

• EU first. Where we control the infrastructure, data is stored and processed within the European Union. Suppliers outside the EU are used only with the safeguards the GDPR requires and with the client's agreement.
• No training on client data. AI providers we work with are engaged under terms that exclude the use of client data to train or improve their models.
• Minimal by design. We process what an engagement needs and no more, and we delete or return data when it ends, as the agreement specifies.

Where we process data for our own purposes in an engagement, for example the contact details of the people we work with, we do so on the basis of the contract and our legitimate interest in delivering and administering the work.

Who else sees data

For this website and our correspondence, personal data reaches only the suppliers named above, each bound by a data processing agreement or equivalent terms: Vercel (hosting), Google (analytics and email), Cookiebot (consent) and Formspark (form delivery). In client engagements, the sub-processors are those listed in that client's data processing agreement, including AI providers. Vercel and Google are headquartered in the United States; where data leaves the EU, the EU-US Data Privacy Framework or the European Commission's standard contractual clauses apply. We do not sell personal data and we do not share it with third parties for their own marketing. We disclose data to authorities only where the law obliges us to.

Your rights

Under the GDPR you can ask us for access to your personal data, correction, deletion, restriction of processing or a copy in a portable format, and you can object to processing based on our legitimate interest. Where processing rests on consent, you can withdraw it at any time; this does not affect processing that took place before you withdrew. We make no decisions about you by automated means alone. Send requests to hi@symphonia-labs.com. If you are not satisfied with our answer, you can lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

Changes

We update this notice when our processing changes, for example when we add a tool to the website. The date at the top tells you which version you are reading.