Privacy Statement

Version 2.0 — 23 September 2026

1. Introduction

Databeamer is a secure communication and collaboration platform provided by Full Join B.V. ("Full Join", "we", "us" or "our").

With Databeamer, organizations and individuals can, among other things, securely collaborate within private workspaces, store and share files, communicate via Chat and Mail, keep notes and reports, and make use of Transfers, Requests and Forms.

Databeamer has been developed with privacy, information security and European data sovereignty as key principles. An important part of this is that protected customer content is encrypted client-side before it reaches our server infrastructure. Full Join does not hold sufficient key material to independently decrypt such protected customer content into plaintext.

This Privacy Statement describes which personal data Full Join processes, for which purposes we do so, with whom data may be shared, and what rights you have.

This statement applies to:

Databeamer's public website;
the Databeamer application;
the use of Databeamer by consumers, organizations, employees and other users;
recipients without a Databeamer account to whom information is sent, or from whom information is requested, via Databeamer;
contact with Full Join, for example via our website;
our business and contractual relationships.

For the use of cookies and similar technologies, please refer to our separate Cookie Policy.

Where Full Join processes personal data on behalf of an organization using Databeamer, that organization is the controller and Full Join processes the data as processor on behalf of that organization. The related arrangements are set out in the Data Processing Agreement.

2. Who are we?

Databeamer is provided by:

Full Join B.V.
Philitelaan 57, unit 404B
5617 AK Eindhoven, the Netherlands
Chamber of Commerce (KvK) number: 71160620
Telephone: 040 209 4163
Email: hello@databeamer.io

For questions about privacy or about the processing of personal data, you can contact us via compliance@databeamer.io.

3. Our website and the Databeamer application

3.1 The public website

Our public website is intended to provide information about Databeamer and our services.

During normal visits to the public website, we do not collect data for advertising purposes and we do not use tracking cookies to follow visitors across different websites.

For anonymized web statistics, we use Plausible Analytics. Plausible is configured on our website in such a way that no tracking cookies or comparable persistent identifiers are used for this purpose.

The website also provides contact options through which you can send a secure request directly to Full Join. More about this is set out in §4 and §8.

The use of cookies and similar technologies on the public website and within the Databeamer application is further described in our separate Cookie Policy.

3.2 The Databeamer application

The Databeamer application is a secure environment that requires an account and multi-factor authentication.

Within the application, users can, among other things, make use of:

Drive;
Chat;
Mail;
Notes and Reports;
Workspaces;
Transfers;
Requests;
Forms;
access and user management;
audit and security functions.

Which personal data is processed depends on the functionality used and on the data that users themselves enter into Databeamer.

For authentication, session management, security and certain user preferences, the application uses necessary and functional cookies and storage on your device. Both are described in the Cookie Policy.

4. Which personal data may we process?

Which personal data we process depends on how you interact with Full Join or Databeamer.

4.1 Account and identification data

When creating and using a Databeamer account, we may process, among other things:

name;
email address;
username or similar account details;
account status;
organization details;
data necessary for authentication and account security.

Passwords, PINs, recovery phrases and cryptographic key material are not processed by Full Join as ordinary account data. These are not accessible to us and therefore cannot be used by us to gain access to protected customer content.

4.2 Contact details

Where you contact us, for example via a contact form, we may process data such as:

name;
email address;
phone number;
organization;
role;
the content of your message or request;
any other data you provide yourself.

Our contact forms are implemented as secure Requests within the Databeamer application. As a result, the content of such a request is not handled as an unsecured form message sent via ordinary email.

4.3 Data of employees, contracted personnel and interns

In connection with our own business operations, we may process personal data of employees, contracted personnel and contractors, interns, job applicants, and other individuals with whom we enter into an employment, internship or collaboration relationship.

This may include, among other things, contact details, contract details, job or role information, administrative data, access data, and data necessary for information security and personnel administration.

4.4 Contract and invoicing data

For paid services, we may process data necessary for entering into and performing agreements, invoicing, payments, financial administration and tax obligations.

This may relate, for example, to name, organization, billing address, payment information and transaction data.

4.5 Workspace and access data

Where workspaces are used, personal data related to collaboration and access management may be processed, such as:

the workspace to which a user has access;
the workspace name;
user and role data;
invitations;
access rights and changes thereto;
organizational relationships within a workspace.

This data is necessary to determine who has access to which parts of Databeamer.

4.6 Technical and security data

To enable Databeamer to function securely and reliably, we may process technical and security-related data, such as:

IP address;
date and time of login or other relevant events;
browser and device characteristics;
session data;
authentication and security events;
error and system information;
information about attempts at unauthorized access.

This data is used, among other things, for security, error analysis, fraud prevention, incident investigation, and the proper functioning of the service.

4.7 Usage and audit data

Databeamer records data on relevant events within the service, for example for security, access control, audit, incident investigation, workspace management, and demonstrating relevant system and user actions.

Audit data may relate to access, changes to rights, actions performed, timestamps, the resource involved, and security events. The exact data recorded depends on the functionality used.

Part of the audit data is cryptographically signed by your own device. This makes it possible to subsequently establish that an action was performed by the holder of the relevant key material and that the record has not since been altered.

Retention. Audit data is retained for as long as necessary for security, management, incident investigation, accountability, and statutory or contractual obligations. This data persists after the underlying content has been deleted or after an account has been deleted, in anonymized form where possible. An audit trail that disappears along with the content has no evidentiary value.

Access and export. Users can view the audit trail of their own account. Organizations can view and export the audit data of their own organization and workspaces. The retention periods are set out in Chapter 13 of the Data Processing Agreement.

4.8 Content that users process themselves

Users may process personal data via Databeamer in, for example:

files and documents in Drive;
Chat;
Mail;
Notes and Reports;
Transfers;
Requests and Forms;
other content stored or exchanged within a workspace.

For this content, the user or the organization managing the workspace determines which personal data is processed.

Protected customer content is encrypted client-side before being transmitted to our infrastructure. Full Join does not hold sufficient key material to independently decrypt this protected content into plaintext.

Not all operational metadata surrounding this content is encrypted. Depending on the functionality, data about users, access rights, statuses, labels or other operational information may be needed for the service to function.

4.9 Data for identity verification

Full Join may verify the identity of a user or an organization and display the outcome as a Verification Mark next to the name of that user or organization.

Organizations with which we conclude an agreement are eligible for this. Persons working for such an organization may be granted a Verification Mark at the request of that organization's administrator. The mark is withdrawn as soon as the individual leaves the organization.

Where you or your organization apply for or are granted a Verification Mark, we process:

the identity data that we verify, such as name, organization name and email address; this is the data already contained in the profile;
the request from your organization's administrator and the justification provided with it;
an internal record of the assessment: which Full Join employee carried out the verification, at what time, and on what basis;
the fact that a Verification Mark has been granted, has expired, or has been withdrawn, with the date.

During identity verification, we do not view identity documents and therefore do not retain any copies of them. We do not record a document number or a national identification number.

The Verification Mark itself is visible to users who are already permitted to view your profile. The underlying assessment — i.e., which employee carried out the verification and on what basis — is not visible to other users and is not included in profiles or other public displays.

What the Verification Mark does and does not mean legally is set out in Chapter 4 of the General Terms and Conditions.

4.10 Data of recipients without a Databeamer account

With Transfers, Requests, Forms and Mail, users can share information with, and request information from, individuals who do not have a Databeamer account.

Regarding such recipients, we process:

the email address provided by the sender;
the status of the transmission, for example whether it has been opened, withdrawn or expired, and the time thereof;
events relating to access verification, for example the sending and use of a one-time code by email;
proof of receipt for downloaded files;
where the recipient chooses to do so, a secure key on their own device that allows them to regain access later without having to receive a new code each time, together with the time of the last verification;
technical and security data as described in §4.6.

Who is responsible? The sender determines who receives information and what information is shared. Where the sender is an organization that uses Databeamer, that organization is the controller and we are the processor. Questions about the content of a transmission, about why you received it, or about the deletion of your data from that transmission, are therefore best directed to the sender.

We process the data referred to in this section solely to deliver and secure the transmission, and to be able to subsequently demonstrate what happened to it.

Duration. A transmission exists for as long as the sender has configured it to. When a transmission expires or is withdrawn, the corresponding key material is destroyed and the access links are invalidated. The events relating to the transmission remain in the audit trail, as described in §4.7.

Confidentiality. For transmissions secured with a sender password, Full Join cannot decrypt the content. For the more accessible mode with email verification, a technical path exists through which the key can be unlocked, solely following your verification and solely on a per-access basis. Both modes are described in §4.5 of the Security Policy; the sender chooses which is used.

If you have questions and cannot reach the sender, please contact us via compliance@databeamer.io.

5. Client-side encryption and zero-knowledge architecture

Databeamer uses client-side end-to-end encryption for protected customer content. Encryption takes place on the user's side, before protected content is transmitted to the Databeamer infrastructure. The key material needed to access that content is split across multiple components. Full Join does not hold sufficient key material to independently decrypt protected customer content.

The full description of this architecture, including what is and is not visible to the server and the modes for delivery to recipients without an account, is set out in Chapter 4 of the Security Policy.

For this Privacy Statement, it is particularly relevant that this architecture does not mean that no personal data whatsoever is available at server level. Certain account, access, technical and operational data is needed for the service to function, be secured, and be managed.

We therefore distinguish, in this Privacy Statement, between:

protected customer content, which is encrypted client-side;
operational and technical (meta)data, which is necessary for the functioning and security of Databeamer.

6. What do we not have access to?

Due to Databeamer's technical architecture, Full Join has no access to the plaintext of protected, client-side encrypted customer content.

We are therefore unable to:

read this content;
search it;
analyze its substance;
use it for advertising purposes;
use it for profiling;
use it for training AI models.

This does not change the fact that Full Join needs certain personal data and operational data in order to provide accounts, access rights, security, invoicing and the operation of Databeamer.

7. Personal data we receive from other sources

In certain situations, we receive personal data not directly from the data subject. This may happen, for example, where:

an organization invites a user to Databeamer;
an administrator adds a user to a workspace;
an administrator requests a Verification Mark for one of its users;
a business customer provides contact details for contractual or administrative purposes;
a user is invited by another user to collaborate;
a user provides a recipient without a Databeamer account for a Transfer, Request, Form or Mail;
we receive data from service providers that carry out certain administrative or technical services on our behalf.

We use such data only to the extent necessary for the relevant purpose and within the applicable legal framework.

8. Why do we process personal data?

8.1 Providing and managing Databeamer

We process personal data to make Databeamer available and to enable its various functionalities to work, including:

creating and managing accounts;
authentication;
access management;
managing workspaces;
inviting and managing users;
providing Drive, Chat, Mail, Notes and Reports, Transfers, Requests and Forms;
carrying out relevant user and system actions.

8.2 Handling contact and support requests

Where you contact us, we use the data provided to handle your question or request, to contact you, to provide support, to answer technical or administrative questions, and, where necessary, to follow up on your request.

Contact forms on our website are implemented as secure Requests within Databeamer.

8.3 Performing agreements

We process personal data to perform agreements with customers, users, suppliers, employees, contractors and other involved parties. This includes, among other things, providing the agreed services, account and access management, contract management, administration, invoicing, and communication regarding the services.

8.4 Personnel, internship and collaboration relationships

For employees, contracted personnel and interns, we process personal data necessary for entering into and performing the relevant agreement, personnel and collaboration administration, access and authorization management, information security, internal communication, and statutory administrative obligations.

8.5 Security and fraud prevention

We process technical, account and security data to secure Databeamer against, among other things, unauthorized access, misuse of accounts, attacks on our infrastructure, fraud, misuse of functionalities, and other security incidents.

8.6 Monitoring, audit and incident investigation

Relevant system and user events are recorded to investigate security incidents, make access and changes auditable, monitor the reliability of the service, carry out audits, and support statutory or contractual obligations relating to information security.

8.7 Improvement and maintenance of the service

We may use technical and anonymized or otherwise suitable operational data to detect errors, monitor performance and stability, improve the reliability of Databeamer, develop security measures, and investigate technical issues.

We do not have access to the plaintext of protected customer content and therefore do not use it for this purpose.

8.8 Statutory obligations

We may process personal data where necessary to comply with statutory obligations, for example in the areas of administration and tax, information security, fraud prevention, legal proceedings, and requests from competent government authorities.

8.9 Protection of our rights and interests

We may process personal data where necessary to pursue our legitimate interests, for example to protect our systems, prevent misuse, establish and defend legal claims, enforce agreements, and protect the safety and integrity of our services.

Where we rely on legitimate interest, we carry out a balancing of interests as required by applicable privacy legislation.

8.10 Identity verification

We verify the identity of users and organizations and display the outcome, in order to counter identity misuse, phishing and deception within Databeamer. Databeamer is used to exchange confidential information; certainty about with whom this happens is essential for that purpose.

We base this processing on our legitimate interest in a reliable platform and on the interest of users in knowing with whom they are sharing information (Article 6(1)(f) GDPR). We have carried out a balancing of interests in this respect.

For identity verification, Full Join acts as an independent controller, even where the data subject is a user of an organization that uses Databeamer. This processing therefore does not fall under the Data Processing Agreement.

9. Artificial intelligence and profiling

Databeamer is not designed to commercially profile users.

Customers' client-side encrypted content is not available to Full Join in plaintext. Full Join therefore does not use this content for training artificial intelligence models. Nor do we use customer content to compile commercial user profiles.

We do not make decisions based on personal data that produce legal effects or similarly significant effects solely through automated decision-making, unless we inform you of this in advance in another manner and a legal basis exists for it.

10. With whom do we share personal data?

We do not share personal data for commercial sale or advertising purposes.

10.1 Service providers and processors

For certain parts of our services, we use specialized service providers. These parties may process personal data only to the extent necessary for the relevant service and on the basis of appropriate arrangements.

Depending on the service, this may relate to hosting and infrastructure, technical support, payment and financial services, security, communication, and administrative services.

The current list of sub-processors we engage for the processing of personal data on behalf of our customers, including their role and processing location, is set out in Chapter 10 of the Data Processing Agreement.

10.2 Plausible Analytics

For limited statistics about the use of our public website, we use Plausible Analytics. The setup and use of this tool are described in §3.1 and in our Cookie Policy.

10.3 Statutory obligations

We may disclose personal data where we are legally required to do so, or where this is necessary in connection with legal proceedings, a lawful request from a government authority, or the protection of our rights, safety or services.

Even then, the technical limitation continues to apply that Full Join does not hold sufficient key material to independently decrypt protected customer content.

11. European data processing

Databeamer has been developed and structured with European data sovereignty as a key principle.

Databeamer's production environment and the customer data stored within it are hosted within the European Union. Our primary hosting environment is located in the Amsterdam region.

For hosting, we use Scaleway, a European cloud provider. Our infrastructure is designed on the principle that customer data is processed and stored within the European Union and that the primary service is not dependent on a US cloud provider or comparable infrastructure outside the European Union.

The ownership and UBO structure of our hosting supplier contains no connection that would give a party outside the European Union control over our infrastructure or over customer data.

For supporting services under which personal data might be processed outside the European Economic Area, we implement the legally required measures and appropriate safeguards.

12. How do we secure personal data?

We implement appropriate technical and organizational measures to protect personal data against, among other things, unauthorized access, loss, destruction, alteration, unauthorized disclosure, and other forms of unlawful processing.

Our security measures include, among other things:

client-side end-to-end encryption of protected customer content;
modern cryptographic techniques;
access management and authorizations;
mandatory multi-factor authentication for all Databeamer user accounts: in addition to the password, a second authentication factor is always required to access the service (an exception applies where the user logs in via SSO; see §6.5 of the Security Policy);
an additional factor before encrypted content becomes accessible on a device;
logging and monitoring of relevant security events;
secure software development, code review and security testing;
vulnerability management;
network and infrastructure security;
backup and recovery measures;
incident management;
security awareness and confidentiality within Full Join.

Our information security management system is established in accordance with ISO/IEC 27001:2022 and the Annex A controls.

More information about our security measures is set out in the Security Policy. This also sets out the arrangements regarding availability, planned maintenance and communication during major disruptions; the contractual aspects of this are set out in Chapter 2 of the General Terms and Conditions.

13. How long do we retain personal data?

We do not retain personal data for longer than necessary for the purpose for which it is processed, unless a longer retention period is legally required or permitted. The retention period differs per type of data and processing activity.

13.1 Account data

Account data is retained for as long as the account is active and for as long as necessary for administration, security, or the performance of the agreement.

Where an account is deleted, a grace period of thirty days applies. After that period, the user's data is permanently deleted and the user profile is anonymized. Deletion may be cancelled within that period. The full description is set out in §13.3 of the Data Processing Agreement.

Certain data may continue to be retained thereafter where necessary for statutory obligations, disputes, security, or administration.

13.2 Content within Databeamer

The retention period for content within Databeamer depends on the relevant functionality and on the settings or arrangements within the workspace. The organization or the user determines these periods itself.

Databeamer provides, among other things, a retention period per Request or Form, an expiry date per Transfer, and a retention period upon deletion of a workspace. The full description of these configurable periods is set out in §13.2 of the Data Processing Agreement.

Depending on their rights and the relevant functionality, users and workspace administrators can delete or allow content to expire.

13.3 Technical and security data

Technical, logging and audit data is retained for as long as necessary for security, management, incident investigation, audit purposes, or statutory obligations. See also §4.7 and §13.6 of the Data Processing Agreement.

13.4 Contact and support data

Data from contact and support requests is retained for as long as necessary to handle the request and, where relevant, to manage the subsequent relationship or administration.

13.5 Statutory retention obligations

Where we are legally required to retain data for a certain period, we follow that statutory retention period.

Where Full Join processes personal data on behalf of a customer, the retention instructions of the relevant controller and the arrangements in the applicable Data Processing Agreement apply.

14. Your rights

Depending on the situation, under applicable privacy legislation you have, among other things, the right to:

request access to your personal data;
have inaccurate personal data corrected;
request the erasure of personal data;
request restriction of processing;
object to certain processing;
have your personal data transferred where the right to data portability applies;
withdraw previously given consent where processing is based on consent.

Where Full Join processes personal data on behalf of an organization, a request must be directed to that organization as controller.

14.1 Withdrawing your Verification Mark

The Verification Mark referred to in §4.9 is published by us on the basis of legitimate interest. You may object to this.

If you do not want your Verification Mark to be visible, you may request its withdrawal via the contact form on our website or via compliance@databeamer.io. We will then withdraw the mark.

Please note: withdrawal is final. Should you wish to obtain a Verification Mark again later, this requires a new request via your organization's administrator and a new verification.

14.2 Submitting a request

We may ask for sufficient information to verify your identity before carrying out a request.

You may submit a request via the contact form on our website or via compliance@databeamer.io.

You also have the right to lodge a complaint with the competent supervisory authority. In the Netherlands, this is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). We appreciate it if you first report a complaint to us so that we can resolve it; the complaints procedure is set out in Chapter 21 of the General Terms and Conditions.

15. Special categories of personal data

Databeamer is a general-purpose communication and collaboration platform. As a result, users may themselves process personal data falling within special categories of personal data, for example data concerning health, religion, or other sensitive subjects.

Where an organization uses Databeamer to process such data, that organization is responsible for:

determining the purpose of the processing;
establishing the legal basis;
informing data subjects;
determining appropriate retention periods;
determining which users are granted access.

Full Join processes such content within the Databeamer service in accordance with the instructions of the relevant customer, in its role as processor.

Due to the client-side encryption architecture, Full Join has no access to the plaintext of protected customer content.

16. Personal data breaches and security incidents

We take security incidents seriously.

Where we establish that a security incident has occurred, we assess its nature, scope and possible consequences and take appropriate measures. Our incident process has a fixed priority classification with corresponding response times.

The notification periods are set out in one place, in Chapter 9 of the Data Processing Agreement. In brief:

where Full Join processes personal data on behalf of a customer, we inform that customer without delay and no later than within 24 hours of discovery, so that the customer retains time to comply with its own notification obligations;
where Full Join itself acts as controller, we report a personal data breach to the Dutch Data Protection Authority within 72 hours and inform data subjects where legally required.

17. Changes to this Privacy Statement

We may amend this Privacy Statement where our services, technical architecture, working methods, or statutory obligations change.

For significant changes, we publish the revised version on our website and, where legally required or reasonably appropriate, inform users or customers accordingly.

The version number and date at the top of this document indicate which version applies and when it was last updated.

18. Relationship to other documents

This Privacy Statement should be read in conjunction with:

Where Full Join processes personal data on behalf of a business customer, the arrangements set out in the applicable Data Processing Agreement apply to processing in that capacity.

19. Contact

Do you have questions about this Privacy Statement or about how Full Join processes personal data?

Full Join B.V.
Philitelaan 57, unit 404B
5617 AK Eindhoven, the Netherlands
Chamber of Commerce (KvK) number: 71160620
Telephone: 040 209 4163
Privacy and compliance email: compliance@databeamer.io
General email: hello@databeamer.io

We are happy to help with any questions about privacy, data processing, and the security of Databeamer.