Privacy statement
Phatfour builds and sells electric fatbikes. To do that we process personal data: of customers, of dealers, of people who call or email us, and of applicants. This statement sets out exactly what we do and why. Wherever we use artificial intelligence, we say so explicitly.
01. Who we are
Phatfour B.V. is the controller for the data described in this statement.
- Company
- Phatfour B.V.
- Address
- Bouwerij 81, 1185 XW Amstelveen, the Netherlands
- Chamber of Commerce
- 73120146
- VAT number
- NL859362887B01
- Privacy questions
- support@phatfour.com
- General
- info@phatfour.com
We have not appointed a data protection officer. For an organisation of our size and nature that is not required. Privacy questions arrive at the address above and are handled by the management.
02. Whose data we process
We distinguish five groups. Not everything in this statement applies to everyone; each part says which group it concerns.
| Group | Where the contact begins |
|---|---|
| Customers | An order in the webshop, at a dealer, or a bike you register |
| Callers and emailers | Contact with our customer service, also without having bought anything |
| Dealers | Staff of the sales points we work with |
| Website visitors | Anyone visiting phatfour.com or the dealer portal |
| Applicants | Responses to vacancies and open applications |
Data about our own employees falls outside this statement; a separate staff policy applies to that.
03. What we use data for
Every purpose rests on a legal basis from article 6 of the GDPR. Without a basis we process nothing.
| Purpose | Data | Legal basis |
|---|---|---|
| Order and delivery | Name, address, email, phone number, order details, frame number | Performance of the contract |
| Payment | Payment details, transaction status. We never see full card numbers ourselves | Performance of the contract |
| Warranty and repair | Frame number, proof of purchase, photos of damage, conversation history | Contract and legal obligation |
| Customer service | Contact details, the content of your message or call, ticket history | Legitimate interest: helping customers |
| Bike registration and theft | Frame number, owner, and location data from a tracker where fitted | Contract and legitimate interest |
| Invoicing and bookkeeping | Name and address details, invoice lines, VAT data | Legal obligation |
| Newsletter | Email address, open and click behaviour | Consent |
| Advertising and analytics | Website behaviour, device and cookie data | Consent |
| Applications | CV, motivation, contact details | Steps prior to a contract |
We do not sell your data, and we do not use it to build profiles on which decisions about you are made.
04. Telephony and AI
When you call us, you first speak to a voice assistant that runs on artificial intelligence. That is not a member of staff.
What happens during the call
The assistant converts what you say into text and uses a language model to understand your question, recognise you as an existing customer, and either transfer you or create a ticket. For that, your phone number, what you tell us and the data we already hold about you are processed.
At the start of the call you hear that you are speaking to a digital assistant. You can always ask for a person.
Recordings
Every call with the assistant is kept as an audio recording and as a text version. You hear this at the start of the call too. The recording helps us handle your question properly and improve our service.
If the assistant transfers you to a colleague, that follow-on call is recorded as well. That recording is automatically converted to text and summarised, and the summary is added as an internal note to your ticket. That way a colleague you speak to later does not have to ask you everything again.
The recording of your call with the assistant stays with our telephony provider for at most 14 days, after which it disappears automatically. The recording of a transferred call we keep for 90 days and then delete. What remains is the text summary on your ticket.
You can object to being recorded. Say so at the start of the call and we will write your question down instead.
Who processes the recordings
For speech recognition and summarising we engage external parties. The audio goes to OpenAI to be converted into text, and the text goes to Anthropic for the summary. Both parties process the data solely on our instructions and do not use it to train their own models. See sections 07 and 08.
No decisions made by a machine
The assistant makes no decisions with legal effect. It answers questions, gathers information and creates tickets. Decisions about warranty, returns or goodwill are always made by a person.
If contact runs through WhatsApp, we process your phone number and the content of your messages in order to handle your question. We only send a WhatsApp message back if you contacted us yourself or gave permission for that.
05. Automated analysis of messages
To get incoming emails and tickets to the right colleague, we have them sorted automatically by topic and, for a repair question, by the part that appears to be broken.
Before a language model is involved, we strip the directly identifying details out of the text. Names, email addresses, phone numbers, addresses, IBANs and tracking numbers are replaced by a placeholder such as [NAME]. That step runs on our own server and does not leave our infrastructure. Only the processed text goes to the language model.
We are honest that this is pseudonymisation and not anonymisation: the text of your message itself does travel along, and internally we can trace the replacements back. We therefore treat this as processing of personal data, and handle it as such.
The outcome is a label, not a decision. A member of staff reads your message and deals with it.
06. Cookies and website
Our webshop runs on Shopify and the dealer portal on Odoo. Both place cookies that are necessary to make the site work: remembering your basket, keeping you logged in, storing your language and country choice. No consent is required for these functional cookies, and the site cannot be used without them.
At present we place no analytics or advertising cookies. There are no Google Analytics, Google Tag Manager or Meta tags on the webshop, and no separate tracking script runs. That is also why you see no cookie banner: there is nothing to choose.
If we do start measuring or advertising in future, we will ask for consent beforehand with a cookie banner, and we will amend this statement before those tags go live.
If you click through to our site from an advertisement on Meta or Google, those platforms process data about that click themselves. Their own privacy policy covers that, not ours.
07. Who we share data with
We engage suppliers that process data on our behalf. They may only use it for what we instruct them to do, and we record that in a data processing agreement — with most of these parties that is a standard agreement forming part of their terms.
| Party | What for | Country |
|---|---|---|
| Odoo | Business system: customers, orders, tickets, dealer portal | EU |
| Shopify | Webshop and orders | Canada / US |
| Mollie | Payments | EU |
| Klarna | Pay later | EU |
| Twilio | Telephony and WhatsApp | US |
| Vapi | Voice assistant and call data | US |
| OpenAI | Speech to text | US |
| Anthropic | Summarising and sorting messages | US |
| Microsoft | Business email | EU / US |
| Quicargo | Pallet transport | EU |
| ENRA | Bicycle insurance | EU |
| Tracefy | GPS tracker in the bike | EU |
| Storepoint | Dealer map on the website | US |
| Setmore | Appointments and test rides | US |
| Meta, Google | Advertising and website statistics | US / EU |
Part of our processing runs on our own servers within the EU: the automations that route messages, the service that strips identifying details out of text, and the customer service team's internal tooling. That data does not go to a third party for those steps.
We also share data with our dealers where that is needed to help you: a repair, a warranty claim or a delivery through the sales point near you. And with the tax authorities, our accountant or other bodies where the law obliges us to.
08. Transfers outside the EEA
A number of our suppliers are established in the United States. Data is then processed outside the European Economic Area.
For those transfers we rely on the EU-US Data Privacy Framework where the party is certified under it, and otherwise on the European Commission's standard contractual clauses, supplemented by additional measures such as encryption and limiting the data we send.
09. How long we keep data
We do not keep data longer than necessary. Where the law prescribes a period, we follow it.
| Data | Period | Why |
|---|---|---|
| Invoices and bookkeeping | 7 years | Tax retention obligation |
| Customer and order data | 7 years | Warranty, liability and tax obligation |
| Frame number and bike registration | Life of the bike | Warranty and theft identification |
| Tickets and conversation history | 5 years | Recurring complaints and warranty |
| Recording of your call with the assistant | 14 days | Retention period of our telephony provider |
| Recording of a transferred call | 90 days | Record keeping and quality |
| Text version of calls | With the ticket | Follow-up of your question |
| Newsletter | Until you unsubscribe | Consent |
| Applications | 4 weeks, or 1 year with consent | Recruitment |
| Cookie data | See cookie settings | Consent |
10. Security
- Connections to our websites and systems are encrypted.
- Access to customer data is limited to staff who need it for their work.
- Our own servers are shielded and reachable only over secure connections.
- Identifying details are stripped out of text before a language model is applied to it, as described in section 05.
- In the event of a data breach with a risk to those concerned, we report it to the Dutch Data Protection Authority within 72 hours, and where necessary we inform you directly.
11. Your rights
You have the following rights. You exercise them by emailing support@phatfour.com. We respond within one month.
- Access
- Request which data we hold about you.
- Rectification
- Have incorrect data corrected.
- Erasure
- Have data deleted, in so far as we are not legally required to keep it.
- Restriction
- Have the processing paused, during a dispute for example.
- Objection
- Object to processing based on legitimate interest, including the recording of calls.
- Portability
- Receive your data in a readable file.
- Withdraw consent
- For the newsletter and cookies, at any time, without affecting what happened before.
To prevent us handing data to the wrong person, we may ask you to prove your identity.
12. Complaints
If we cannot resolve it together, you can lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl. We would appreciate it if you tried us first.
13. Changes
We amend this statement when our way of working changes. The current version is always on our website, with the date at the top. For a substantial change, a new purpose or a new category of data for instance, we will inform you actively.
