Last updated: 19 October 2026.
RiskResolve B.V., located at Dorpsstraat 1, 5261 CJ Vught, is responsible for the processing of personal data as described in this privacy policy.
This policy applies to visitors to www.riskresolve.com, to anyone who sends us a request, to users of the application at app.riskresolve.com and to contact persons at our clients. We process the data that our clients record in their files on behalf of those clients. Section 3 explains how that works.
1. Contact details
You can reach RiskResolve B.V. via the website https://www.riskresolve.com, by post at Dorpsstraat 1, 5261 CJ Vught, by phone on +31 85 080 66 22 and by email at contact@riskresolve.com. RiskResolve B.V. is registered with the Dutch Chamber of Commerce (KvK) under number 96041013.
For all questions and requests about privacy, your point of contact is contact@riskresolve.com.
The data protection officer of RiskResolve B.V. is Thomas van Zadelhoff, who can be reached at contact@riskresolve.com.
2. Personal data we process
Which data we process depends on how you come into contact with us.
If you visit the website
The website does not place cookies, does not use an analytics service and does not keep a profile of you. The website is hosted by Vercel. To display a page, the website’s server receives your IP address, your browser type and the page you request. Our cookie policy says more about this.
If you send us a request
Through the form on the website, we receive your name, your email address, the name of your organisation, the language and the page on which you filled in the form, and the time it was sent. We store your request in RiskResolve’s own database. To limit misuse, the website uses your IP address to count the number of submissions per 15 minutes. That IP address is held only in the server’s working memory and is not stored in a database. If storing your request fails, the website records the submission in its error log, so that your request is not lost.
If you use the application
For users of the application, we process name, email address, phone number if you enter one, password, language preference, role and permissions within the organisation, and the two-factor authentication data. If you log in with Google or Microsoft, we receive your name, your email address and an identifier of your account with that party.
The application keeps an activity log. It records, among other things, logging in and out, failed login attempts, changes, exports, downloads and the viewing of files, each time with IP address and browser. If a RiskResolve employee accesses your environment to help you, that is recorded too.
If your organisation is a client
For the subscription and invoicing, we process the details of your organisation and of the contact persons for the contract and the invoices. You pay in Stripe’s secure payment environment.
If you appear in a file of one of our clients
Our clients are institutions that are subject to the Dutch Anti-Money Laundering and Anti-Terrorist Financing Act (Wwft), such as accounting firms and tax advisers. They use RiskResolve for the client due diligence that the Wwft requires of them. For this, they record data about their clients, representatives and ultimate beneficial owners (UBOs).
This includes name, date of birth, nationality, address, contact details, roles in a company, identity documents and other documents, and the answers to questionnaires. Identification numbers, the citizen service number (BSN) and document numbers are stored with separate encryption.
The application also records the outcome of checks for sanctions, politically exposed persons (PEPs), adverse media coverage and insolvency, and the resulting risk score. Media coverage may contain information about suspected criminal offences, such as fraud or money laundering.
If your firm asks you to verify your identity, you upload an identity document and take a selfie with Stripe Identity. Stripe compares the selfie with the photo on the identity document. If you sign a document in the client portal, we record your typed name, the time, your IP address and your browser as evidence of the signature.
3. Our role regarding data in files
For the data in files, the client that creates the file is the controller. That client decides which data goes into the file, for what purpose and how long it is kept. RiskResolve processes this data as a processor on behalf of that client.
If you appear in a file and want to access, correct or delete your data, send your request to the organisation that asked you for your data. If your request reaches us, we forward it to that organisation.
4. Purposes and legal bases
We only process personal data for the purposes below, each with a legal basis from Article 6 of the General Data Protection Regulation (GDPR).
- Responding to your request through the form on the website. The legal basis is your consent, which you give when you submit the form. You can withdraw that consent at any time via contact@riskresolve.com. If you then ask for a quotation, the legal basis is the preparation of an agreement.
- Providing the application, with accounts, login and two-factor authentication. The legal basis is the performance of the agreement with your organisation, and our legitimate interest and that of your organisation in a well-secured service.
- Processing payments and keeping our accounts. The legal basis is the performance of the agreement and the legal obligation to keep accounts.
- Keeping the activity log. The legal basis is our legitimate interest and that of our clients in being able to demonstrate who did what, including to a supervisory authority.
- Detecting and fixing errors in the application, using error reports sent to the Sentry service. The legal basis is our legitimate interest in a working service. The application removes names, email addresses, dates of birth and identification numbers from error reports before they are sent.
- Informing you about changes to our services. The legal basis is the performance of the agreement with your organisation.
For the data in files, the client determines the purpose and the legal basis. For Wwft client due diligence, this is usually the legal obligation that the Wwft imposes on the client.
5. Automated decision-making and AI
RiskResolve does not make decisions based on automated processing about matters that may have significant consequences for individuals.
The application calculates a risk score for each file using a fixed rule. Using AI models from Anthropic, it assesses news articles, carries out in-depth research into a person or company on request, and writes a proposed rationale for the risk. An employee of the client makes the decision about a client.
For AI, we use Anthropic under Anthropic’s standard commercial terms, without additional arrangements.
For in-depth research into a person, the name, year of birth, place of residence, country, nationality and linked companies are sent to the model. The full date of birth and the street address are not sent.
6. Retention periods
RiskResolve B.V. does not keep your personal data for longer than necessary. The retention period is linked to achieving the purposes.
- The client keeps data in files for as long as it needs it. The Wwft requires the client to keep the client due diligence data for five years after the end of the business relationship (Article 33(3) Wwft). The application does not delete files automatically. A deleted file is first marked as deleted.
- The activity log is not cleaned up automatically during the subscription, because it is the record that the Wwft requires of the client.
- When the contract with a client ends, we delete that client’s data, including the files and the activity log, within 90 days or return it. We do not do so if the client asks otherwise or the law requires otherwise.
- We keep a request sent through the form on the website for up to two years after the last contact.
- We keep your account data for as long as your organisation’s subscription runs.
- We keep invoicing data for seven years, because of the tax retention obligation (Article 52(4) General State Taxes Act (Algemene wet inzake rijksbelastingen)).
- A session in the application expires after 120 minutes. Messages that the application delivers via webhooks are deleted after thirty days.
7. Sharing personal data with third parties
RiskResolve B.V. only shares data with third parties if this is necessary for the performance of our agreement with you or to comply with a legal obligation.
For the application and the website, we work with sub-processors. These are parties that carry out part of the processing on our behalf, such as hosting, email, error reporting, payments, identity verification, AI and search. The list of sub-processors shows which parties these are, with their service, country and the legal basis for transfer.
View the list of sub-processors.
The application also consults public registers, such as the Trade Register of the Dutch Chamber of Commerce, the Central Insolvency Register and the Central Register of Guardianship and Administration (CCBR) of the Dutch judiciary (Rechtspraak). For this, the name of the person or company is sent to that register.
8. Transfers outside the European Economic Area
The application runs in a data centre in Germany, within the EU. Some of our sub-processors are based in the United States. As a result, personal data may be transferred to the United States when we use Anthropic (AI), Amazon Web Services (email), Sentry (error reporting), Vercel (the website), Stripe (payments and identity verification), Google (login, search and images of addresses), Microsoft (login), Brave (searching news sources) and Tavily (search for in-depth research).
Transfers outside the EEA are only permitted on a legal basis from Chapter V of the GDPR. For the United States, this is the European Commission’s adequacy decision of 10 July 2023 for the EU-US Data Privacy Framework, where the recipient is certified under that framework, or the European Commission’s standard contractual clauses. The list of sub-processors shows which basis applies to each party.
For the search queries sent to Brave and Tavily, we cannot currently identify such a basis. Brave excludes search queries from its data processing terms, and Tavily’s terms contain no standard contractual clauses. The list of sub-processors explains for each party what is sent and what its terms say.
9. Cookies
The website does not place cookies and does not use an analytics service. The application uses functional cookies to keep you logged in, to secure the service and to remember a few settings. We do not use tracking or marketing cookies.
Read the cookie policy.
10. Social media
Our website contains links to our pages on LinkedIn and Instagram. These are ordinary links. No LinkedIn or Instagram code runs on our website, and neither places cookies through our website. If you click through, the terms and privacy policy of that party apply.
11. Minors
RiskResolve B.V. does not intend to collect data about website visitors under the age of 16 without the consent of their parents or guardian. We cannot check whether a visitor is over 16. If you are convinced that we have collected data about a minor without that consent, please contact us at contact@riskresolve.com. We will then delete this information.
12. Accessing, correcting or deleting your data
You have the right to access, correct or delete your personal data, and to have its processing restricted. You also have the right to withdraw any consent you have given for the data processing or to object to the processing of your personal data by RiskResolve B.V., and you have the right to data portability. This means that, at your request, we can send the personal data we hold in a computer file to you or to another organisation you name.
You can send a request for access, correction, deletion, restriction or transfer of your personal data, or a request to withdraw your consent or to object to the processing, to contact@riskresolve.com. That address also reaches our data protection officer.
To be sure that the request comes from you, we may ask you to prove your identity. If you send a copy of your identity document for this, make your photo, your document number, your citizen service number and the machine-readable zone at the bottom (MRZ) unreadable. We respond to your request as quickly as possible, and in any case within four weeks.
You can lodge a complaint with the national supervisory authority, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). You can do so via the website of the Dutch Data Protection Authority.
13. How we protect personal data
RiskResolve B.V. takes the protection of your data seriously and takes appropriate measures to prevent misuse, loss, unauthorised access, unwanted disclosure and unauthorised modification.
For example, the application runs in a data centre in Germany and its storage is encrypted. Two-factor authentication is switched on by default for every user of the application. If you do not set up an authenticator app, you receive a code by email each time you log in. Each user has one active session at a time. Sensitive fields, such as identification numbers, the citizen service number and document numbers, are stored with separate encryption.
If you feel that your data is not properly secured or there are signs of misuse, please contact us on +31 85 080 66 22 or at contact@riskresolve.com.