EO·Atlas
Privacy Policy
This policy explains what personal data SpectraWorks B.V. collects when you use EO-Atlas, why we collect it, how long we keep it, and the rights you have under the General Data Protection Regulation (GDPR) and the Dutch UAVG.
1. Who we are
The controller of your personal data is SpectraWorks B.V., Kapteynstraat 1, 2201 BB Noordwijk, Netherlands (Chamber of Commerce 42018290; VAT NL869313873B01). For full operator identification, see our Legal identification page. You can reach us at info@spectraworks.nl.
We have not appointed a Data Protection Officer, and are not required to. EO-Atlas processes ordinary business-contact and account data; it does not process special categories of personal data.
2. What this policy covers
This policy covers personal data we process through the EO-Atlas website (eo-atlas.org): account creation, claiming a catalogue listing, paid subscriptions, and reports or complaints you send us. You can read most of EO-Atlas without an account and without giving us any personal data.
3. What we collect, why, and on what basis
| Data | Purpose | Lawful basis (GDPR Art 6) |
|---|---|---|
| Email address; sign-in (magic) codes; session records | Create and secure your account; sign you in | (b) contract; (f) legitimate interest in account security |
| Full name, work email, job title, and the details you submit when claiming a listing | Verify your authority to manage a listing and let you edit it | (b) contract; (f) legitimate interest in catalogue integrity |
| When you ask to join the managers of a claimed listing: your email address and any message you add | Pass your request to current managers so they can approve you. If it remains unanswered after 14 days, notify SpectraWorks. | (f) legitimate interest in controlled listing access |
| When you contest who manages a listing: your email address and required reason | Keep your request with SpectraWorks while we check the claim. We do not pass it to current managers when you submit. | (f) legitimate interest in catalogue integrity and fair claim handling |
| Billing details and invoice records (card data is handled by Stripe, not stored by us) | Take payment for, and administer, paid subscriptions | (b) contract; (c) legal obligation to retain tax records |
| IP address, request metadata, and security logs | Keep the service available, prevent abuse and fraud | (f) legitimate interest in security and availability |
| Pages viewed or requested, the linking site, the name of the browser or software, device type and approximate country, which we keep from Cloudflare only as daily and weekly visit totals; and, kept as individual records with no identifier, catalogue listing views and link clicks with their time and linking site, and MCP tool calls with the tool, a short summary of what was asked and the kind of client | Understand how people and AI systems use EO-Atlas | (f) legitimate interest in knowing how the reference is used |
| Reports, complaints, and claim disputes you send us, and our replies | Handle reports of illegal content and claim disputes, and meet our duties under the Digital Services Act | (c) legal obligation; (f) legitimate interest in running the catalogue |
| Your email address, where you opt in to updates | Send you product or service updates you asked for | (a) consent (withdrawable at any time) |
You need to give us account and billing data to open an account and buy a paid plan; without it we cannot provide those features. Opting in to updates is optional, and declining it costs you nothing else.
4. Cookies
At launch EO-Atlas uses only strictly-necessary cookies: your sign-in session, Stripe's fraud-prevention cookies on payment pages, and Cloudflare's security cookies. These do not require consent, and we use no analytics or advertising cookies. The full list is in our Cookie Policy. If that changes, we will update this policy and ask for consent where the law requires it.
We measure how EO-Atlas is used without cookies, with two tools from Cloudflare, which hosts the site. Cloudflare's request records note each page or file our site serves, with the name the browser or software gives itself and whether Cloudflare recognises it as a known bot, such as a search engine or an AI assistant. Cloudflare Web Analytics, a small script on our pages, reports each page view with the linking site, browser, device type and approximate country, and sets no cookies. We read only totals from these, such as how many pages people viewed in a week or how many requests came from AI systems, and we keep those as daily and weekly totals, which cannot tell us who you are. On catalogue entry pages your browser also tells us the page was viewed, the name of the site that linked to it, and when a contact or outbound link is clicked, so that companies can see how their listing is read; these records carry no identifier either. When an AI assistant uses our MCP service, we also record which tool it called, a short summary of what it asked for, and the kind of client, with no identifier.
5. Who we share data with
We do not sell your personal data. We share it with the providers that run parts of the service for us:
- Stripe: payment processing and billing.
- Cloudflare: hosting, content delivery, security, and visit statistics.
- Resend: delivery of transactional email, such as sign-in codes.
Most of these act on our instructions as processors. Some, Stripe in particular, also act as their own controller for part of what they do, such as fraud prevention and meeting their own legal duties as a payment provider. Each is bound by a data-processing agreement; the current list, with what each one does, is on our Sub-processors page. We also disclose data where the law requires it.
6. International transfers
Some providers are based in, or transfer data to, the United States. Where that happens, the transfer relies on the EU-U.S. Data Privacy Framework and, as a fallback, the European Commission's Standard Contractual Clauses. You can ask us for a copy of those safeguards at info@spectraworks.nl.
7. How long we keep it
- Account and listing data: while your account is active. If you ask us to delete it, or after a long period with no sign-in, we delete or anonymise it.
- Billing and invoice records: 7 years, as Dutch tax law requires.
- Reports, complaints, and claim disputes: while we deal with them, and for a reasonable period afterwards in case the matter is reopened.
- Security logs: normally up to 12 months, then deleted or aggregated.
- Visit statistics: Cloudflare keeps its detailed request records for about a month and its Web Analytics records for about six months. We keep daily and weekly totals from those tools, which identify no one. We also keep individual catalogue listing events and MCP tool-call records as described above; automatic deletion of these records is not yet enabled.
8. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict, and port your personal data, and to object to processing based on our legitimate interests. Where we rely on your consent, you can withdraw it at any time without affecting processing already carried out. To exercise any of these rights, email info@spectraworks.nl.
You can also lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
9. Automated decisions
We do not make decisions about you by automated means, and we do not profile you.
10. The catalogue is public
EO-Atlas entries are compiled from public sources, and the catalogue is published openly under a CC-BY 4.0 licence, including as a downloadable copy. Some entries carry limited business-contact details that were already public, such as a company contact named on an official source. Where those details are personal data, our basis for publishing them is our legitimate interest in running an accurate reference (Article 6(1)(f)), and they form part of the public, openly licensed catalogue, not data we share only with our providers. If an entry names you and you want it changed or removed, email info@spectraworks.nl. Once you claim a listing, the data you then provide is handled as set out above.
11. Changes to this policy
We may update this policy as the service changes. The current version, with its date, is always on this page.
Last updated: 9 October 2026