Privacy notice — sign-in service

Obeya Insights Consulting Team

1. Who we are

Five Forward Group B.V., trading as Obeya Insights, IJsselburcht 3, 6825 BS Arnhem, the Netherlands (Chamber of Commerce no. 42143676), is the controller for the processing described in this notice. For questions or requests about your data, write to info@obeya-insights.nl.

2. What this notice covers

This notice covers the sign-in service of the Obeya Insights Consulting Team at my.obeya-insights.com: being invited, signing in, connecting Claude, and the records we keep about access. It does not cover what you or your clients put into an Obeya. That content is processed on behalf of the firm that holds the licence, under its agreement with us; questions about that content go to that firm first.

3. What we process, and why

1. Your email address. To check that you were invited, to send you the invitation and your sign-in links, and to sign you in. On the invitation list your address is stored encrypted. While a sign-in link is valid (at most 15 minutes), your address is stored with it unencrypted, so that we can complete your sign-in.
2. Your IP address. To limit repeated sign-in attempts. It is used for this purpose for at most a few minutes. Our hosting provider also processes your IP address to deliver and protect the service; we do not store it in our own logs.
3. A pseudonymous identifier. After you sign in, we identify you by a code derived from your email address, not by the address itself. When you connect Claude, Claude receives only this code and the licence identifier, never your email address or name.
4. A record that you were shown the AI notice. The code from point 3, with the date and version of the notice. We keep it to be able to show that we informed you that you are working with an AI system (Article 50 of the EU AI Act). We also keep a separate record, at the sign-in screen, so that the notice is not shown to you again every time.
5. What you open in the portal. Which Obeyas and pages you open, and when. The holder of the licence you work under can see this record, with your name as it appears on the invitation list. Our support team can see it when the licence holder asks for help.
6. If you hold the licence: your name and email address in our licence administration, so that we can manage the licence, and, stored encrypted, the email address of the licence owner, so that we can notice and confirm a change of owner.

We use cookies only where needed for signing in: a cookie that ties a sign-in link to your browser (24 hours) and a session cookie (see section 5). These are strictly necessary for the service you ask for, so we do not ask for consent. We do not track whether you open or click our emails.

4. Legal basis

Where you hold the licence yourself, we process your data because it is necessary to perform our agreement with you (Article 6(1)(b) GDPR). Where you were invited by a licence holder, and for the records in points 2, 4 and 5 in all cases, we rely on our legitimate interests: providing the service to the licence holder you work with, securing the portal, and being able to demonstrate compliance (Article 6(1)(f) GDPR). You may object to processing based on legitimate interests; see section 8.

5. How long we keep it

When a period ends, the data is removed automatically, except where this table says otherwise.

6. Who processes it on our behalf

• Vercel — hosting of the sign-in service; computing takes place in the Frankfurt region.
• Upstash — the data store for invitations, sign-in links, sessions and the records in points 3 to 5; located in the Frankfurt region.
• Twilio (SendGrid) — sends the invitation and sign-in emails.
• Notion — our licence administration (licence holders only).
• Microsoft (Azure, West Europe) — the workspace, where the access record and the AI-notice record are kept under the pseudonymous identifier only.

These providers act on our instructions. Some of them are established in the United States. Where data may be transferred outside the European Economic Area, we rely on the European Commission's standard contractual clauses and, where the provider is certified, on the EU-US Data Privacy Framework.

7. What we do not do

We do not sell your data, we do not use it for advertising, and we do not make decisions about you that are based solely on automated processing.

8. Your rights

You can ask us for access to your data, for correction or erasure, for restriction of processing, or for a copy in a portable format, and you can object to processing based on legitimate interests. Write to info@obeya-insights.nl. We will answer within one month. If you are not satisfied with our answer, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or with the supervisory authority in the country where you live or work.

9. Changes

When this notice changes, the version number changes and a line is added below. Earlier versions remain available.

Changelog

• 1.0 — 28 September 2026 · First version. Replaces the sentence on the email step that referred to a notice “before general availability”.