Privacy statement

1.General information and definitions

Adminio is a platform for complaints, disputes and objections committees, in sectors such as housing, healthcare, education and sport. In this privacy statement we call it the platform. adminiolex.com is our English website. adminio.nl is our Dutch website.

In this privacy statement we use the following terms:

• GDPR: the General Data Protection Regulation (Regulation (EU) 2016/679).
• Personal data: any information relating to an identified or identifiable natural person.
• Processing: any operation performed on personal data, such as collecting, recording, storing, consulting, using, disclosing and erasing it.
• Data subject: the person to whom the personal data relates.
• Controller: the party that determines the purposes and means of the processing.
• Processor: a party that processes personal data on behalf of the controller. A sub-processor is a party that the processor engages for that purpose.
• Organisation: the organisation that uses the platform, such as a complaints committee, a housing association or a healthcare provider.
• Data breach: a breach of security that leads to personal data being lost, altered or disclosed to the wrong people.

2.Our role: controller and processor

Adminio has two roles under the GDPR. Which role applies determines whom you should contact with a question or request.

• Controller: For the data we process for our own purposes, Adminio is the controller. This covers our websites, including the contact form on adminiolex.com, marketing, managing customer accounts, invoicing and applications for jobs at Adminio. This privacy statement is primarily about that processing.
• Processor: For the content in the platform, the organisation that uses it is the controller, for example a complaints committee or a housing association. This includes complaint files, attachments, hearing details, case files, documents and written submissions. The organisation determines the purpose, the legal basis and the retention period. Adminio processes that data on its behalf as a processor, under a data processing agreement with the organisation (Article 28 GDPR).

If your question concerns data in a complaint, case file or case, please contact the organisation handling your complaint or case first. We help that organisation to deal with it.

3.What personal data we process

The data we process depends on your relationship with us.

The platform is not intended for special categories of personal data. Such data may still appear in it, for example health data in an attachment to a complaint. The organisation is then responsible for relying on a valid exception under Article 9 GDPR.

4.The website and the contact form

This section explains what happens when you visit adminiolex.com or use the contact form on it.

• Visiting the website: Your browser sends technical data, such as your IP address, browser type and the page requested, to our hosting provider, Framer. This is needed to show you the website. Framer’s built-in page analytics gives us aggregated statistics about visits, such as page views and the websites visitors came from. It does not use cookies. We do not use any other analytics tool on adminiolex.com. The cookie policy on this website explains the details.
• Nothing stored in your browser: adminiolex.com does not use cookies, does not store anything in your browser and does not set an analytics identifier. That is why it does not show a cookie banner.
• What the form asks for: Your name, organisation and email address (required), and, if you wish, your phone number, your role and your message. The form also records which type of organisation you selected and the page on our website you came from.
• What happens next: Your request is sent to our email processing service, which forwards it by email to info@adminio.nl. You also receive a confirmation by email. Both messages are sent through our email delivery provider, Resend (section 8).
• Preventing misuse: To prevent misuse, our email processing service briefly uses your IP address to limit the number of requests sent within a short period. It is not stored with your request.
• If sending fails: The form then offers to open your own email app or to copy your message. Your message then reaches us as an ordinary email.
• Purpose and legal basis: Answering your question and, if you wish, arranging a conversation. Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) or our legitimate interest in responding to enquiries (Article 6(1)(f) GDPR).
• Retention: We keep your request and the related correspondence for as long as needed to deal with it and any follow-up (section 11).

5.Purposes and legal bases

This section covers the processing for which Adminio is the controller. For content in the platform, the organisation determines the legal basis (section 2).

• Entering into and performing contracts: Entering into and performing contracts for the platform, including managing customer accounts. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• Providing the platform: Providing the platform to the organisation, with the features that come with it, including the AI features (section 6). Legal basis: performance of the contract with the organisation (point (b)). For personal data in the content, the organisation determines the legal basis.
• Security and improvement: Securing and improving our websites and the platform, and preventing misuse, for example with a check against automated sign-ups. Legal basis: legitimate interest (point (f)).
• Website analytics: Measuring how our websites are used, so that we can improve them. On adminiolex.com we only use our hosting provider’s cookieless page statistics, which we see in aggregated form. Legal basis: legitimate interest (point (f)). If one of our websites uses analytics storage in your browser, we ask for your consent first (point (a)).
• Contact and support: Staying in touch with you and providing support, for example after a message through the contact form. Legal basis: performance of a contract or legitimate interest (point (b) or (f)).
• Relationships: Making and maintaining contact with potential customers and other contacts. Legal basis: legitimate interest (point (f)).
• Administration: Internal business operations and administration, including invoicing. Legal basis: legal obligation (point (c)) and legitimate interest (point (f)).
• Marketing: Marketing, such as email and social media. Legal basis: consent (point (a)) or legitimate interest (point (f)).
• Our rights: Establishing, exercising and defending our legal rights. Legal basis: legitimate interest (point (f)).
• Applications: Assessing and handling job applications to Adminio. Legal basis: steps taken before entering into a contract (point (b)), and consent if we keep your data for longer (point (a)).
• Legal obligations: Complying with legal obligations, such as tax record-keeping requirements. Legal basis: legal obligation (point (c)).

Where we rely on legitimate interest, we weigh that interest against your privacy. You have the right to object (section 14).

6.AI in the platform

The platform includes features that use language models. Examples are summarising a case file, preparing a draft, anonymising a decision, transcribing a recording, reading scanned documents and finding similar rulings and legislation.

• Legal basis: For users with an Adminio account, the AI features are part of the service we provide under the contract with the organisation. They do not rely on the user’s consent. For personal data in the content, the organisation determines the legal basis.
• Suggestions: What an AI feature produces is a suggestion that a person reviews. The AI features do not take decisions about you that have legal effects (Article 22 GDPR).
• Which services: For an AI feature, we send the text needed and, where necessary, an image, document or recording to a provider of AI language models or speech-to-text (section 8). The language models come from Mistral AI, OpenAI, Anthropic and Google. Some of these providers process data outside the EU (section 9).
• Searching by meaning: To search by meaning, for example for similar rulings, texts are converted into series of numbers (embeddings). For this, too, we use a model from a provider of AI language models.
• Within the EU: If an organisation wants all processing to remain within the EU, we set this up on request.

The complaint form for complainants

A complainant who submits a complaint through the complaint form has no contract with Adminio. If the committee has switched on the clarifying questions, the form therefore asks the complainant for explicit consent before the description and attachments are analysed automatically. This analysis drafts a few clarifying questions and points to documents that may support the complaint. Depending on the committee’s settings, this takes place within or outside the EU.

If you do not give consent, you can still submit your complaint as normal. We record with the complaint whether and when you gave consent. The committee is the controller for this data. To withdraw your consent, please contact the committee. This does not affect any analysis that has already taken place. What the committee itself then does with AI features in Adminio falls under its own legal basis and its own privacy statement.

7.How we obtain personal data

• From you: For example when you fill in a form, create an account, submit a complaint, contact us or apply for a job.
• From the organisation: For example when the organisation invites you, creates an account for you or adds data to a case file.
• From others involved in a complaint or case: For example when another party or the committee adds documents.
• Through your use: For example your IP address and logs of your use of the websites and the platform.
• From public sources: For example published decisions and public registers.

In principle, you are not obliged to give us any data. Where this is a legal or contractual requirement, or necessary to enter into a contract, we will tell you so and explain what happens if you do not provide the data.

8.Who we share personal data with

We share personal data only where necessary, and only with parties bound by confidentiality and appropriate security. With parties that process personal data on our behalf, we make agreements about that processing. We use sub-processors for the following services:

The full list of sub-processors is set out in the data processing agreement with the organisation. You can also request it from info@adminio.nl.

If an organisation connects its own online meeting account, we create meetings on its behalf, for example for a hearing. That data then ends up in the organisation’s own environment.

We also share personal data with competent authorities, such as regulators, the police and the judicial authorities, where the law requires us to. We may use data in anonymised form for statistics. In the event of a merger or acquisition, we may transfer data to the party involved. We will then make sure that party complies with this privacy statement.

Services your browser calls directly

Some pages load components from other parties directly in your browser. Those parties receive your IP address and technical data from your browser.

• Fonts from an external font service.
• Maps from an open map service. On some administrative pages of the platform, we also load the map software through an external network.
• The address lookup of the Dutch government’s map service. It receives the address you type.
• The check against automated sign-ups when logging in, registering and using the complaint form.

A link to an external map service only opens that service when you click it.

9.Transfers outside the EEA

The platform’s database and stored files are located within the European Economic Area (EEA), in Frankfurt.

Some of our sub-processors are established outside the EEA or process data there, mainly in the United States. This applies, among others, to providers of AI language models. For these transfers, we rely on an adequacy decision of the European Commission where one applies, and otherwise on the European Commission’s standard contractual clauses (Article 46(2)(c) GDPR).

If an organisation wants all processing to remain within the EU, we set this up on request. The full list of sub-processors, with the safeguard for each party, is set out in the data processing agreement and is available on request from info@adminio.nl.

10.How we protect personal data

We take technical and organisational measures to protect personal data. These include:

• Encrypted connections (https) between your browser, our servers and the services we use.
• Role-based access, enforced in the database itself (row-level security), so that you only see what you are authorised to see.
• An additional login step with an authenticator app for Adminio’s administrative tasks.
• Storage of platform data within the EEA, in Frankfurt.
• A check against automated sign-ups.
• Logging and monitoring of errors and security signals.

In the event of a data breach, we inform the organisation concerned without undue delay, as the GDPR requires.

11.How long we keep personal data

We do not keep personal data for longer than necessary for the purpose for which we process it.

We may keep data for longer if the law requires it, if it is needed for legal proceedings, or with your consent.

12.No automated decisions

We do not take decisions with legal effects for you that are based solely on automated processing. What an AI feature produces is a suggestion (section 6).

13.Cookies

adminiolex.com does not use cookies and does not store anything in your browser. It does not set an analytics identifier, and our hosting provider’s page statistics work without cookies. That is why the website does not show a cookie banner. The cookie policy on this website explains the details. In the platform, we only use functional cookies and functional browser storage, for example to keep you logged in and to remember your cookie choice. We do not use third-party analytics or marketing cookies there. For cookies that are not functional, we ask for your consent in advance. You can withdraw it at any time.

14.Your rights

You have the following rights:

• Access: You can request a copy of the personal data we process about you.
• Rectification: You can have incorrect or incomplete data corrected.
• Erasure: You can ask us to erase your data. We are not required to do so in every case.
• Restriction: You can have the processing restricted, for example while the accuracy of the data or the legal basis is in dispute.
• Objection: You can object to processing based on legitimate interest. We will always honour an objection to direct marketing.
• Data portability: You can receive data you have given us in a commonly used format, or have it transferred to another party.
• Withdrawing consent: Where we process data based on your consent, you can withdraw it at any time. This does not affect processing that took place before.
• Complaint: You can lodge a complaint with the supervisory authority in the country where you live or work. In the Netherlands, this is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). Adminio is established in Spain, where the supervisory authority is the Agencia Española de Protección de Datos (AEPD). We would appreciate it if you contacted us first.

If your request concerns data in a complaint, case file or case in the platform, please contact the organisation handling your complaint or case first. That organisation is the controller for this data (section 2).

15.How to exercise your rights

You can exercise your rights free of charge by emailing info@adminio.nl. We may ask you to confirm your identity. We will respond within one month of receiving your request. For complex or numerous requests, this period may be extended by a further two months. We will let you know if that is the case. For requests that are manifestly unfounded or excessive, we may charge a reasonable fee or refuse the request.

16.Changes

We update this privacy statement when our services or the rules change. We will inform you appropriately of significant changes. The current version is published on our websites. This version was last updated on 11 November 2026.

17.Contact

Do you have questions about this privacy statement or about how we handle personal data? Please get in touch.

• Controller: Adminio LEX S.L.
• Postal address: Rotterdam, the Netherlands
• Email: info@adminio.nl
• Website: adminiolex.com