Privacy Policy

Contact Information

• Business Name: Sophron^®
• Chamber of Commerce (KvK) number: 97127841
• Website: sophron.eu
• Email: contact@sophron.eu
• Address: De Klencke 95B, Amsterdam, 1083 HH, NL

Changes to This Privacy Policy

This Privacy Policy may be amended by us from time to time. We therefore advise you to regularly review this Privacy Policy for any changes. The amended privacy policy will be published on the Site, stating the date on which the changes take effect. In the event of substantial or significant changes that may significantly affect one or more data subjects, we will endeavor to inform these data subjects directly.

Personal Data We Collect

We collect personal information about you from various sources, including directly from you, through your use of the Site, and from third parties such as Cloudflare and Firebase.

Information You Provide Directly:

• Name, address, phone number, and email address
• CV Data, submitted highest form of current or past education, study program, study type, and interests
• Account details (username, password, security questions)
• Order details (billing/shipping info, payment confirmation)
• Customer support interactions
• Skills, interests, and career preferences
• Event participation history relevant to recruitment opportunities

Information We Collect Automatically (Usage Data):

We use cookies, pixels, and similar technologies to collect:

• IP address
• Device and browser type
• Interaction data (pages visited, clicks, time on site)

Use of Personal Data

We use your personal data for the following purposes and on the following legal basis:

• Order Fulfillment and Account Management
  Purpose: Processing payments, shipping orders, and managing your account.
  Legal Basis: Performance of a contract (Art. 6(1)(b) GDPR).
• Connecting with Employers/Partners
  Purpose: Sharing your professional profile with participating companies and generating anonymous statistical overviews using AI tools regarding event participants.
  Legal Basis: Your explicit consent (Art. 6(1)(a) GDPR). You can withdraw this consent at any time.
• Marketing and Newsletters
  Purpose: Sending you updates and promotional offers.
  Legal Basis: Your consent (Art. 6(1)(a) GDPR) or our legitimate interest for existing customers (Art. 6(1)(f) GDPR).
• Security and Fraud Prevention
  Purpose: Detecting and preventing unauthorized access or fraudulent transactions.
  Legal Basis: Legitimate interests (Art. 6(1)(f) GDPR).
• Improve our Services:
  Purpose: analyze usage and customer behavior to optimize user experience
  Legal Basis: Legitimate interests (Art. 6(1)(f) GDPR).

We do not carry out fully automated decision-making about individuals within the meaning of Article 22 GDPR. Final decisions regarding candidate selection are always made by participating companies.

We use automated data processing methods, including AI-based tools, for the following purposes:

• Recruitment and Profile Structuring: Your CV and submitted information may be analyzed to extract and structure relevant data (such as skills, education, and experience). This may involve profiling within the meaning of Article 4(4) GDPR. The structured data may be used by participating companies to search, filter, and identify candidates for relevant opportunities. This processing may influence how candidates are presented or matched, but does not independently determine outcomes. As part of this, we may generate ratings or scores using automated, AI-based methods that indicate how a profile aligns with typical role requirements. Where these ratings are shared with participating companies, they serve only as non-binding guidelines and are never used as a final ranking or as the sole basis for selection or any decision. All selection decisions are made by the participating companies through their own human review.
• Aggregated Statistical Insights: We use automated analysis methods to generate aggregated statistical insights (e.g. distributions of skills, educational backgrounds, or interests). These insights do not identify individuals and are used for analytical and improvement purposes.

Automated tools support, but do not replace, human decision-making. Participating companies are able to review, interpret, and, where necessary, override automated outputs, and human involvement is ensured throughout the recruitment process. As our processing does not result in decisions based solely on automated processing that produce legal or similarly significant effects, Article 22 GDPR does not apply.

Cookies and Tracking Technologies

We use:

• Functional Cookies: necessary for site operation
• Analytical Cookies: help us understand how users interact with the site
• Marketing Cookies: tailor ads and content

You can disable cookies via your browser. For more on cookies used by Cloudflare, visit: https://www.cloudflare.com/cookie-policy/. For more on cookies used by Firebase, visit: https://policies.google.com/technologies/cookies

Mobile Application (iOS)

The following additional terms apply when you use our iOS App. The App uses the same member account and back-end services (including Firebase) described elsewhere in this Privacy Policy.

Push Notifications

If you grant permission, the App registers a device push token with the Apple Push Notification service (APNs) and Google Firebase Cloud Messaging so that we can send you notifications such as event reminders and updates relevant to your membership. We process this token solely to deliver notifications to your device. You can turn notifications off at any time in your device settings (Settings → Notifications), after which we can no longer send notifications to that device.

Apple Wallet

The App can generate a digital member pass that you may choose to add to Apple Wallet. The pass contains your membership details and a QR code used for event entry. The pass is generated for you and stored on your device and, if you add it, in Apple Wallet; we do not receive additional location or device data from your use of the pass.

Apple as a Third Party

The App is distributed via the Apple App Store. Apple Inc. acts as an independent party and may collect information in connection with your download and use of the App (for example, App Store account and purchase data, and diagnostic, crash, and performance data where you have enabled sharing). This processing is governed by Apple's own privacy policy, available at https://www.apple.com/legal/privacy/. Push notifications are also routed through the Apple Push Notification service as described above.

Cookies and Identifiers in the App

The App does not use browser cookies. In their place, it uses on-device storage and mobile identifiers (such as the push token described above and identifiers used by our service providers, including Firebase) to keep you signed in, remember your preferences, and operate core features. The "Cookies and Tracking Technologies" section above applies to the Site; this section governs the equivalent technologies in the App.

Sharing of Personal Data

We may share your personal data with:

We may also share personal data with trusted third parties to help organize and facilitate events related to our services or community.

We also do not use or disclose sensitive personal information without your consent.

Event Photography and Videography

We may photograph, film, or otherwise record events organized or hosted by Sophron^® or by the clubs we operate.

These recordings may include attendees and may be used for purposes such as:

• Social media content
• Website publications
• Event recaps and promotional materials
• Sponsor and partner reporting
• Community and marketing communications

Our legal basis for this processing is our legitimate interest in promoting and documenting our events (Article 6(1)(f) GDPR). Where required by law, we will request your consent before using images or recordings.

If you do not wish to appear in photographs or videos, please notify event staff upon arrival or contact us before the event at contact@sophron.eu. We will make reasonable efforts to accommodate your request.

For images that focus specifically on an individual attendee, we may request additional consent before publication.

Children's Privacy

Our services are not intended for children under 16. We do not knowingly collect data from minors.

Data Retention

We do not retain your personal data longer than is necessary for the purposes for which it is processed. If you have placed an order with us or made a reservation, we will generally retain your personal data for up to two years after your reservation. We may retain transaction data for seven years if this is necessary to comply with our tax obligations. In addition, we may retain personal data that is necessary in the context of legal proceedings, complaints, and disputes for longer if this is necessary to protect our interests.

Brokerage Connections

If you take part in the Sophron^® Quant Program or a trading competition, you can choose to link your own brokerage paper account to your Sophron^® account. This is optional.

What we receive and keep. When you link an account, your brokerage provider gives us an access token for it. We keep that token, the email address of your Sophron^® account, the last four digits of the account number, its status and currency, the permissions you granted, the date you linked it and the strategy you say it runs. You can link more than one paper account, one for each strategy. We never see or store your brokerage password: you sign in on your provider's own site.

What we use it for. About every half hour we read each linked account's balance, daily results, positions and orders, and work out the results of the strategy it runs: return, profit and loss, risk figures and number of trades. Members of the Quant Program see those results on its Performance page, next to the strategy, its project and the names of the people on it, and they may appear on competition leaderboards. Your holdings are shown only to you and to the Sophron^® team. We place no orders.

Where it is kept. With our hosting provider Cloudflare, one record per linked account, and one record of the results we read. Both are encrypted so that only our server can read them.

How long. Until you disconnect, and at the latest 12 months after your access to the program ends.

How to revoke. Press "Disconnect" on sophron.eu/connect/alpaca: we delete the stored record and the token. You can also revoke Sophron^® in your brokerage account's settings at any time; the token then stops working.

Legal basis. Your consent, given when you link your account (Art. 6(1)(a) GDPR), which you can withdraw at any time as described above.

Security of Your Data

We take appropriate technical and organizational measures to secure your data and prevent unauthorized access, misuse, or disclosure.

• TLS/HTTPS Encryption: All Firebase Functions use automatic HTTPS/TLS encryption. Data in transit is encrypted by default.
• Access Control: Data access functions use token-based authentication with expiration and origin verification. Other functions use API keys or service tokens.
• Data Encryption at Rest: Firestore and Cloud Storage automatically encrypt all data at rest. Data is stored in EU region for GDPR compliance.
• Logging & Monitoring: Security events and access attempts are logged via Firebase Logger.

Your Privacy Rights

Under privacy legislation, you have a number of rights with regard to your personal data and its processing.

• Right of access. This is the right to ask us whether we hold any personal data about you and to access it.
• Right to rectification. You can ask us to change any personal data that is incorrect or incomplete.
• Right to be forgotten. In some cases, you have the right to have your personal data deleted by us, for example when your personal data is no longer necessary for the purposes for which we obtained it
• Right to restriction. This is the right to have less personal data processed or to temporarily stop processing. You can request this, for example, if you believe that your personal data is incorrect.
• Right to data portability. When we process your personal data on the basis of an agreement or consent, you have the right to data portability. This is the right to receive your personal data from us so that you can forward this data to another party.
• Right to object. You may object to the processing of your personal data.
• Withdrawal of your consent. If you have given us consent to process your personal data, you may withdraw that consent at any time. This withdrawal does not affect the processing of your personal data before you withdrew your consent.

To exercise your rights:

To exercise your rights, please contact us via the email address associated with your account. We may request additional information to verify your identity, but we will only request a copy of your ID if we cannot verify your identity through other, less intrusive means.

Email contact@sophron.eu.

If you have any complaints about how we handle your personal data, please contact us using the contact details in this Privacy Policy. We will be happy to help you find a solution. If that does not work, you can always submit a complaint to the Dutch Data Protection Authority. You can contact the Dutch Data Protection Authority using the following contact details: Dutch Data Protection Authority, PO Box 93374, 2509 AJ The Hague, telephone 088 - 1805 250, website: https://autoriteitpersoonsgegevens.nl.

International Transfers

While we prioritize hosting your data within the European Economic Area (EEA), we use third-party service providers (such as Cloudflare and Firebase) that may process data in countries outside the EEA, including Canada and the United States.

When we transfer data to these countries, we ensure appropriate safeguards are in place, such as:

• Relying on the EU Commission's adequacy decision for third countries.
• Implementing EU-approved Standard Contractual Clauses into contracts to protect your data.

You may request a copy of these safeguards by contacting us.

Third-Party Links

Our Site may contain links to third-party sites. We are not responsible for the privacy practices of these sites. Please review their policies separately.

Questions or concerns? Contact us at contact@sophron.eu or at the address provided above.