Privacy statement
Last updated: 2 September 2026 · version 2.0
1. Who we are
H3 Company B.V. (“H3”, “we”) is a limited liability company based in Amsterdam, the Netherlands (KvK 97964468). We advise organisations on AI adoption, process redesign and new business models, and deliver programmes and hands-on enablement. H3 Company B.V. is the controller for the personal data described in this statement.
Questions about how we handle your data? Email hello@h3.company. We aim to respond within five business days.
2. What data we collect and where it comes from
We collect personal data from several sources:
- Directly from you — when you contact us, book a conversation, complete the AI Horizon Scan, subscribe to Field Notes, sign a proposal or take part in a session or programme.
- Your employer or client organisation — when we receive participant lists for a programme, workshop or engagement.
- Publicly available professional sources — LinkedIn profiles and company websites, used for business-to-business contact with decision-makers.
- Meeting tools — meetings you attend with us may be transcribed to support our work; you are informed beforehand and may opt out (see section 3).
- Our website — statistics and marketing cookies when you visit h3.company and accept them via our cookie banner (see section 9).
The categories of data we typically process are: name, job title, employer, business email address, phone number, your AI Horizon Scan answers and result, and meeting or project content. We do not process special category data (such as health, religion or biometric data) in the normal course of our work, and our services are aimed at organisations, not at children.
Providing your data is voluntary. Without contact details we cannot answer a request, book a conversation or send you your AI Horizon Scan result; nothing else depends on it. Where we obtain your data from a public source or from your employer rather than from you, we tell you at our first contact with you (with a link to this statement), and in any case within one month.
3. Why we process your data and on what legal basis
| Purpose | Legal basis (GDPR) | What this covers |
|---|---|---|
| Responding to your request | Art. 6.1.b — steps at your request, and Art. 6.1.f — our interest in answering enquiries | Contact form, booking a conversation, sending your AI Horizon Scan result |
| Contract execution and delivery | Art. 6.1.b — performance of a contract | Client communication, programme and workshop delivery, project files, invoicing |
| Tax and financial obligations | Art. 6.1.c — legal obligation | Retention of financial records and invoices for 7 years under Dutch tax law |
| Field Notes newsletter | Art. 6.1.a — consent | Sending Field Notes to the address you subscribed with; unsubscribe at any time |
| Business-to-business contact | Art. 6.1.f — legitimate interest: our commercial interest in reaching decision-makers at organisations we can help | Contacting people based on publicly available professional profiles; weighed against your interests, and you can object at any time |
| AI-assisted service delivery | Art. 6.1.f — legitimate interest: delivering efficiently and keeping accurate engagement records | Use of AI tools for preparation, note-taking and internal workflows; no automated decisions are made |
| Meeting transcription | Art. 6.1.a — consent | Participants are informed before any recording begins and may opt out |
| Basic site statistics (no cookies) | Art. 6.1.f — legitimate interest: understanding aggregate site usage | Vercel Web Analytics: aggregated page views and referrers; nothing is stored on your device and you are not identified |
| Website statistics | Art. 6.1.a — consent via cookie banner for the cookies | Google Analytics 4; runs in cookieless mode by default (Google Consent Mode) and sets its cookies only after you accept statistics cookies |
| Website marketing and retargeting | Art. 6.1.a — consent via cookie banner | LinkedIn Insight Tag and Meta Pixel; not loaded until you accept marketing cookies. For this collection LinkedIn and Meta act as (joint) controllers, see section 5 |
| Legal compliance | Art. 6.1.c — legal obligation | Responding to requests from the Dutch Data Protection Authority (AP) or court orders |
4. How long we keep your data
| Category | Retention period | Basis |
|---|---|---|
| Contact and booking information | 12 months after the last meaningful contact | Legitimate interest; follow-up |
| AI Horizon Scan answers and result | 12 months after you receive your result | Delivering and following up on your result |
| Field Notes subscription | Until you unsubscribe | Consent; we keep the minimum needed to honour an unsubscribe |
| Financial records and invoices | 7 years | Dutch tax law (Belastingdienst) |
| Client communications and project files | 2 years after the end of an engagement | Legitimate interest; business continuity |
| Meeting transcripts and notes | 2 years after the end of the engagement (same as project files), or earlier on request | Legitimate interest; engagement record |
| Prospect records that did not become clients | 2 years after last contact | Legitimate interest; deleted on expiry or on request |
| Website statistics (GA4) | 14 months | Consent; GA4 data-retention setting |
| Marketing cookies (LinkedIn, Meta) | See the cookie table in section 9 | Consent; per-provider cookie lifetime |
After the applicable period, data is deleted or anonymised. You may request earlier deletion (see section 8).
5. Who we share your data with
Service providers acting on our behalf (processors). These services process personal data only on our instructions. The table lists each one, its location and the safeguard that protects transfers outside the European Economic Area.
| Service | Purpose | Country | Legal safeguard |
|---|---|---|---|
| Vercel | Website hosting, server-side form handling, cookieless site statistics | US | SCC via Vercel DPA |
| Resend | Delivering site messages and AI Horizon Scan results by email | US | SCC via Resend GDPR terms |
| Cal.com | Scheduling when you book a conversation | US | SCC (data processing terms) |
| Google (Analytics 4, Workspace) | Website statistics (cookieless by default; cookies after consent); email, calendar and files | US | SCC + EU-US Data Privacy Framework (DPF) |
| Anthropic (Claude) | AI assistance for preparation, notes and internal workflows | US | Data Processing Agreement with SCCs; no model training on our data |
| Fireflies.ai | Meeting transcription (with participant consent) | US | SCC (data processing terms) |
| Granola | Meeting notes | US | SCC (data processing terms) |
| Notion | Internal knowledge base and team workspace | US | SCC |
Advertising platforms (independent or joint controllers). If you accept marketing cookies, LinkedIn (Insight Tag) and Meta (Meta Pixel) collect data about your visit for retargeting and campaign measurement. For that collection on our site we are joint controllers with them; they then process the data under their own responsibility and privacy policies: LinkedIn, Meta. Both are US companies relying on SCCs and the EU-US Data Privacy Framework. You can withdraw at any time via the cookie banner, and you can also exercise your rights with them directly.
Other recipients. Where necessary we share limited data with our accountant and bookkeeping software, our bank and payment providers, legal advisers, and public authorities (such as the Belastingdienst or the Autoriteit Persoonsgegevens) when the law requires it.
We do not sell your personal data. We do not share your data with other organisations for their own marketing purposes. If we are required by law to disclose data to a public authority, we do so only to the extent legally required.
6. International data transfers
Several of the services above are based in, or route data through, the United States. Where this is the case we rely on the European Commission’s Standard Contractual Clauses (SCCs) and, where the provider is certified, the EU-US Data Privacy Framework (DPF) as the legal mechanism for the transfer. The AI and processing tools we use offer Data Processing Agreements and commit not to use your data to train their models. Data may be processed in the US. You can request a copy of the safeguards we rely on (the SCCs) by emailing hello@h3.company.
7. Automated decision-making and AI tools
We use AI tools (including Claude by Anthropic) to assist with preparation, note summarisation and internal workflow tasks. No automated decisions are made that produce legal or similarly significant effects on individuals. A person at H3 reviews AI-generated output before it is used in client-facing work.
The AI Horizon Scan generates a result from the answers you give. That result is informational: it is not a decision about you and has no legal or similarly significant effect. We do not use profiling or automated scoring of individuals for creditworthiness, employment suitability or any equivalent purpose.
8. Your rights
Under the GDPR you have the following rights regarding your personal data:
- Access — request a copy of the data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — ask us to delete your data where we have no overriding legal obligation to keep it.
- Restriction — ask us to limit how we use your data while a dispute is resolved.
- Data portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interest, including direct marketing. We will stop unless we can demonstrate compelling grounds.
- Withdraw consent — where processing is based on consent (newsletter, meeting transcription, cookies), withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
How to exercise your rights: email hello@h3.company with a clear description of your request. We respond within one month. For complex requests we may extend this by a further two months and will tell you within the first month if so. We do not charge a fee.
If you are not satisfied with our response, you can lodge a complaint with the Dutch Data Protection Authority: autoriteitpersoonsgegevens.nl.
9. Cookies
Our website uses cookies and similar technologies in three categories that you choose via our cookie banner, plus one cookieless measurement that does not depend on your choice (listed below). You can change your cookie preferences at any time: the “Cookies” button in the bottom-left corner of every page reopens the banner, and withdrawing is as easy as accepting.
- Necessary (no consent required) — strictly needed for the site to work, including remembering your cookie choice.
- Statistics (consent required) — Google Analytics 4, to understand how visitors use the site. We use Google Consent Mode v2: by default GA4 runs in cookieless mode — it sets no cookies and does not identify you — and it only stores its _ga cookies once you accept statistics. Withdrawing removes the Google Analytics cookies we set and reloads the page.
- Marketing (consent required) — the LinkedIn Insight Tag and Meta Pixel, used to show relevant content to people who visited h3.company and to measure campaigns. Not loaded until you accept; never placed without prior consent. LinkedIn and Meta are (joint) controllers for this collection, see section 5. Withdrawing removes the Meta cookies we set and reloads the page; cookies that LinkedIn sets on its own domain are managed through your LinkedIn account settings.
- Site statistics without cookies (no consent required, legitimate interest, see section 3) — Vercel Web Analytics counts aggregated page views and referrers. It sets no cookie and stores nothing on your device, and it does not identify you.
| Cookie | Provider | Category | Purpose | Lifetime |
|---|---|---|---|---|
| h3-consent.* (currently v1) | H3 (local storage) | Necessary | Remembers your cookie choice | 12 months, or until you clear it or change your choice |
| — (no cookie) | Vercel Web Analytics | Site statistics | Aggregated page views and referrers; nothing stored on your device | n/a |
| _ga, _ga_* | Google Analytics | Statistics | Distinguishes visitors and sessions | Up to 2 years |
| li_sugr, lidc, bcookie, li_gc, UserMatchHistory, AnalyticsSyncHistory, ln_or | Marketing | Retargeting and ad measurement | 1 day to 1 year | |
| _fbp, _fbc | Meta | Marketing | Retargeting and ad measurement | 90 days |
10. Security
We take appropriate technical and organisational measures to protect your personal data against loss, unauthorised access or disclosure, including access controls, two-factor authentication on key systems, and encryption in transit and at rest where supported by our providers.
In the event of a personal data breach that poses a risk to your rights and freedoms, we notify the Dutch Data Protection Authority within 72 hours and inform affected individuals without undue delay.
11. Changes to this statement
We may update this statement as our services or legal obligations change. The date at the top reflects the most recent version. For material changes affecting existing clients, we notify you directly.
12. Contact
Controller: H3 Company B.V. · KvK: 97964468
Address: Jacob Bontiusplaats 9, 1018 LL Amsterdam, the Netherlands
Email: hello@h3.company · Website: h3.company