Privacy Statement & Data Protection

Kroonz processes your personal data because you use our services and/or because you provide it to us yourself (or, with your consent, through your linked bank). Below is an overview of the personal data we process:

• First and last name: If linked to your Google account or the name on your bank account.
• Email address & account ID: Received through Google Single Sign-On to recognise your account securely.
• Bank account number (IBAN) & financial transaction data: Including account balance, amounts, dates, counterparties and transaction descriptions (only if you actively link your bank through GoCardless).
• Budget and app data: Data you enter yourself, such as savings goals, categories and budget limits.
• IP address & technical session data: Needed for security, fraud prevention and recognising your session.

Kroonz processes your personal data only for the following specified purposes and their legal bases under the GDPR:

• Creating an account and signing in securely: To give you access to the app through Google Single Sign-On, without us having to store passwords (Legal basis: performance of the contract).
• Fetching bank transactions and showing budget overviews: Automatically loading and categorising your income and spending through our PSD2 partner GoCardless (Legal basis: explicit consent).
• Security and fraud prevention: Technically protecting our app and databases against misuse and unauthorised access (Legal basis: legitimate interest).
• Support and communication: To contact you about support questions or important changes to the service (Legal basis: performance of the contract).

Kroonz keeps your personal data no longer than strictly necessary for the purposes it was collected for. We use the following retention periods:

• Account & budget data (incl. encrypted transactions)

  Retention period

  As long as the account is active (or after 12 months of inactivity)

  Explanation & deletion procedure

  When you delete your account (or after 12 months of complete inactivity, following a reminder), deleted from the active database right away and from backups within 30 days at most.

• Bank link tokens (GoCardless PSD2)

  Retention period

  90 to 180 days at most

  Explanation & deletion procedure

  Expire automatically according to the statutory PSD2 period, or immediately when you revoke the link yourself in the app.

• Technical server logs (IP address & session data)

  Retention period

  30 days at most

  Explanation & deletion procedure

  Short-term storage for security checks, troubleshooting and preventing misuse.

• Invoice & payment data (if on a paid subscription)

  Retention period

  7 years (statutory)

  Explanation & deletion procedure

  Only administrative invoice data, to meet the tax record-keeping obligation of the Dutch Tax Administration (Belastingdienst).

Kroonz never sells your data to third parties. We share your personal data only with service providers when this is necessary for the app to work, to perform the contract, or with your explicit consent (such as for the bank link). With companies that process your data on our behalf, we sign a data processing agreement to ensure the same level of security and confidentiality. Below is the full overview of these parties:

• Bank link (PSD2 / AISP)

  Name & jurisdiction

  GoCardless, European Union (EEA)

  Purpose of processing

  Securely fetching bank account and transaction data with your explicit consent.

  Which data

  IBAN, account holder name, balance, transaction history and IP address.

• Authentication (Single Sign-On)

  Name & jurisdiction

  Google Ireland Limited, EU / US (Data Privacy Framework)

  Purpose of processing

  Signing in to your Kroonz account securely through Google OAuth, without storing passwords.

  Which data

  Email address, name and unique Google user ID.

• Database & cloud hosting

  Name & jurisdiction

  [Hostingpartij invullen], servers in the European Union

  Purpose of processing

  Storing the database securely and encrypted, and running the Kroonz backend.

  Which data

  Encrypted account, budget and transaction data, IP address.

You have the right to view, correct or delete your personal data. You also have the right to withdraw your consent to data processing (such as the GoCardless bank link) at any time, to object to the processing, and the right to data portability.

• Do it yourself in the app: You can delete your bank link and your entire Kroonz account yourself at any time through the settings in the app.
• Send a request by email: Send a request to info@kroonz.com or jelle@kroonz.com from the Google email address you use to sign in to Kroonz (so we can verify your identity securely without you having to send a copy of your ID). We respond within four weeks at the latest.
• Right to complain to the regulator: You can always file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

Kroonz takes appropriate technical and organisational measures to prevent misuse, loss and unauthorised access. If you suspect misuse, contact us directly at info@kroonz.com.