Privacy Notice

Effective and last updated: 23 August 2026

Controller and scope

E.S.P. Consultancy B.V. (“ESP”, “we”, “us” or “our”) is the controller of personal data processed through the website on which this notice appears and through related PackYourCash business enquiries. ESP is registered with the Dutch Chamber of Commerce under number 30169199 and has its main establishment at Rietwerfplantsoen 16, 4273 CH Hank, the Netherlands. PackYourCash is a product name and is not a separate controller.

This notice covers website visitors, enquiry submitters and business contacts acting for customers, prospective customers, suppliers, integration partners and other professional organisations. Privacy questions and requests may be sent to info@cashrobotics.eu with “Privacy” in the subject line, or to our postal address.

Data, purposes and legal bases

Activity	Personal data	Purpose	Legal basis
Website delivery and security	IP address, timestamp, requested URL, response, referrer, browser/device data, user agent, security events and identifiers	Deliver and secure the website, diagnose faults and prevent misuse	Legitimate interests in secure, reliable digital services (GDPR 6(1)(f))
Business enquiries	Name, business email, optional telephone, company/role, message, attachments and correspondence	Respond, assess requirements, arrange demonstrations and prepare a non-binding quotation	Requested pre-contract steps where 6(1)(b) applies; otherwise legitimate interests in B2B enquiries (6(1)(f))
Turnstile abuse prevention	IP address, browser/device, TLS and interaction/security signals, site key, page origin and challenge result	Distinguish legitimate users from automated abuse	Legitimate interests in preventing spam, fraud and attacks (6(1)(f))
Business relationships	Professional contact data, employer, role, source, interests, meetings and relationship history	Develop and administer customer, prospect, supplier and partner relationships	Legitimate interests in B2B relationship management (6(1)(f)); contract steps where applicable
Contracts, projects and support	Contact, delivery, installation, access, billing, payment, support, machine and compliance records	Perform contracts, deliver and support products, administer projects and handle claims	Contract where the individual is a party (6(1)(b)); legal obligations (6(1)(c)); legitimate interests (6(1)(f))
Legal and privacy requests	Identity/contact details, request, verification information, correspondence and outcome	Comply with law, protect rights and demonstrate accountability	Legal obligation (6(1)(c)); legitimate interests in claims and accountability (6(1)(f))
Permitted marketing	Business contact, subscription or customer status, preference, evidence and suppression record	Send requested or otherwise lawful B2B communications and respect opt-outs	Consent where required (6(1)(a)); other bases only where electronic-marketing law permits

Legitimate interests

Where we rely on legitimate interests, those interests are operating a secure and functional B2B website, answering genuine enquiries, managing professional relationships, improving services and protecting legal rights. We assess necessity and balance these interests against the individual’s rights and reasonable expectations. You may object as explained below.

Required information

Fields marked as required are needed to identify and answer the request. A telephone number is optional. Without required information, we may be unable to respond, prepare a quotation or take requested pre-contract steps. Do not send passwords, payment-card details, national identification numbers, special-category personal data, trade secrets or export-controlled information through the general form. Ask us for an approved secure transfer route.

Cloudflare Turnstile

We use Cloudflare Turnstile to protect the contact form against automated abuse. Cloudflare may process network, browser, device and interaction/security signals, including IP address, user agent, TLS-related signals, site key, page origin and challenge result. Turnstile is not intended to receive the content entered in our form. Our legal basis is our legitimate interest in preventing spam, fraud and attacks. If the check prevents a legitimate enquiry, email info@cashrobotics.eu.

Sources

We normally obtain personal data from you or the organisation you represent. We may also receive professional contact data from colleagues, customers, business partners, trade fairs or public professional sources. Where GDPR Article 14 applies, we provide the additional required information within the applicable period, normally within one month, at first communication or before first disclosure, whichever occurs first.

Recipients

Access is limited to people who need the data for their work. Depending on the activity, recipients may include:

authorised ESP personnel and professional advisers;
website hosting, content-delivery, security, IT administration and backup providers;
Cloudflare and relevant affiliates for Turnstile and related security services;
email, collaboration, quotation, customer-relationship, support and document-management providers used for the relevant process;
delivery, installation, integration and service partners where necessary and appropriately governed; and
public authorities, courts, insurers and counterparties where disclosure is legally required or necessary to protect rights.

International transfers

Some service providers may process data outside the European Economic Area. Where this occurs, we rely on an applicable European Commission adequacy decision or another lawful safeguard, such as the European Commission Standard Contractual Clauses, together with supplementary measures where required. Where a provider is validly certified under the EU–US Data Privacy Framework for the relevant data, we may rely on that adequacy decision. You may request information about the applicable safeguard, subject to appropriate redactions.

Retention

We retain personal data only for the relevant purpose, legal obligations and legitimate claims. Our standard periods are:

Category	Standard retention
Routine website and security logs	30 days, unless a security event or legal hold requires restricted longer retention
Enquiries that do not become a customer relationship	24 months after the last substantive contact
Customer, project and active business contacts	For the relationship and 24 months afterwards, subject to longer contract, service, warranty or claim records
Contracts, invoices and basic tax records	7 years, or longer where a specific statutory rule requires it
Marketing consent evidence and suppression records	While communications continue and up to 5 years afterwards where needed to demonstrate compliance and preserve the opt-out
Privacy requests and complaints	5 years after closure where needed for accountability or claims
Backups	Overwritten through a rolling cycle within 90 days, except isolated legal or security holds

Your rights

Subject to the GDPR conditions, you may request access, correction, erasure, restriction and portability, withdraw consent and object to processing based on legitimate interests. You have an unconditional right to object to direct marketing at any time. Send a request to info@cashrobotics.eu with “Privacy” in the subject line. We normally respond within one month and may extend by up to two further months for a complex or numerous request, explaining the extension within the first month. We may request proportionate information to verify identity or authority.

Automated decisions

We do not use the website to make decisions based solely on automated processing that produce legal or similarly significant effects. Turnstile performs an automated security assessment, but it does not decide whether ESP will enter into a business relationship.

Security

We use risk-appropriate technical and organisational measures designed to protect personal data. No internet transmission or storage system is completely secure. Use an approved secure transfer method for confidential technical files or sensitive information.

Complaints

Please contact us first at info@cashrobotics.eu so we can address the concern. You may also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). Complaint information.

Changes

We update this notice when our processing or legal obligations materially change. The current version is published with its effective date. Where required, we provide