PRIVACY POLICY
Last updated September 25, 2026
This Privacy Policy explains how Equip Financial Technology B.V. collects and uses personal data in connection with our website at https://withequip.com and the Equip platform at https://platform.withequip.com, including where you access the platform through your adviser at https://[youradvisor].withequip.com (together, the “Services”).
1. Who we are
Equip Financial Technology B.V. (“Equip”, “we”, “us” or “our”) operates the Services. We are registered with the Dutch Chamber of Commerce (Kamer van Koophandel) under number 86747606. Our registered office is Elandsstraat 169H, 1016 RZ Amsterdam, the Netherlands.
If you have a question about this Privacy Policy or how we handle your personal data, contact us at support@withequip.com.
2. Who is responsible for your personal data
Equip is made available to you through your employer. Your employer may offer it directly or through its pension adviser. Where an adviser is involved, the Platform may carry the adviser’s name, logo and colours, but the software is built and operated by Equip.
Who is responsible for your personal data depends on the processing involved:
Account setup data provided by your employer or adviser. Your employer or adviser may provide us with your name, work email address, employer and, where relevant, pension scheme so that your account can be created and maintained. Where we process this data only on their instructions, your employer or adviser is the controller and Equip acts as processor. Their privacy notice explains why they provide this data to us and the legal basis they rely on.
Data you provide or connect yourself. For personal data you provide directly through the Services, or choose to connect to the Platform, Equip generally determines how and why it is processed and acts as controller. This includes profile information, financial data you connect through Invers or Ockto, documents you upload, your interactions with Penny, Platform usage information and security data.
Sessions with a financial expert. The expert may be engaged by Equip or by your employer or adviser, depending on the arrangement under which the Services are provided. Where an expert is engaged by your adviser, the adviser is responsible for the advice relationship and its privacy notice applies to that relationship. Equip continues to be responsible for processing for which we determine the purposes and means, and may also process information on behalf of the adviser where agreed.
If you are unsure who is responsible for a particular use of your data, contact us and we will help direct your request to the appropriate party.
3. What personal data we collect and where it comes from
Most personal data we process comes directly from you. We may also receive limited account setup information from your employer or adviser and, where you choose to connect external sources, financial information from those sources.
Account and profile information
your name, work email address, employer and, where relevant, pension scheme;
your date of birth, whether you have a partner and other information you choose to add to your profile;
your account, login and authentication information.
Financial information
bank balances and transaction details you choose to connect through Invers B.V.;
source data you choose to share through Ockto B.V. from sources such as UWV, the Belastingdienst, MijnOverheid and Mijnpensioenoverzicht;
financial information and documents you upload yourself, such as a pension overview;
information generated from your financial data, such as financial insights and calculations.
Communications and use of the Services
messages and other information you exchange through the Platform;
information you provide to Penny, our AI assistant;
answers to questionnaires, self-service tools, surveys and feedback;
session notes and, where you have agreed to transcription, transcripts of 1:1 video sessions;
support communications and complaints;
technical and usage information such as IP address, operating system, device information and information about how you use the Platform. Where used for security purposes, this may include approximate location derived from technical information such as your IP address.
4. What you have to provide and what is optional
We need your name and email address to provide you with access to the Platform. Certain additional information, such as your date of birth or income, may be needed for particular financial calculations or tools to work.
Other features are optional. For example, you can choose whether to connect a bank account, use Ockto, upload documents, have an eligible session transcribed or use Penny. If you do not provide information needed for an optional feature, that feature may not work, but this does not by itself prevent you from using other available parts of the Platform.
5. Connecting financial data
Bank accounts through Invers
If you choose to connect a bank account, the connection is facilitated by Invers B.V. Invers B.V. is licensed by De Nederlandsche Bank under the Payment Services Directive (PSD2). PSD2 mandates that a bank is obligated to grant access to your payment account to a third party, provided you give consent. You give permission through the relevant bank environment. We receive bank balance and transaction information made available through that connection, including transaction date, amount and category information. Invers may enrich transaction data, for example by assigning categories.
You can withdraw the relevant permission at any time. The connection and permission process is also subject to Invers’ own terms and privacy notice.
Source data through Ockto
If you choose to use Ockto, you select and approve the information that is shared with us from relevant official sources. You authenticate through the Ockto process. We do not receive or store your citizen service number (BSN) from Ockto.
If you prefer not to use Ockto, you may be able to obtain relevant documents yourself and upload them to the Platform.
6. How and why we use your personal data
We only process personal data where we have a lawful basis to do so. Below we summarise our principal purposes and the legal basis for each.
Create and manage your account where you contract directly with us
Legal basis: performance of our agreement with you (e.g. the Terms of Service governing your access and use of the Services).
Provide the Platform, tools, insights and Penny
Legal basis: performance of our agreement with you (e.g. the Terms of Service governing your access and use of the Services).
Process documents and financial information you provide in order to use requested Platform features
Legal basis: performance of our agreement with you (e.g. the Terms of Service governing your access and use of the Services).
Connect bank accounts through Invers and collect source data through Ockto where the relevant connection depends on your permission
Legal basis: consent, which you can withdraw at any time.
Transcribe a 1:1 video session where transcription is offered
Legal basis: consent, given before transcription starts. You can decline transcription.
Keep the Platform and accounts secure and prevent fraud and abuse
Legal basis: our legitimate interests in protecting users, our systems and the integrity of the Services.
Analyse use of the Platform and improve our Services
Legal basis: our legitimate interests in improving the accuracy, usefulness, security and performance of the Services.
Send service and product updates about Equip
Legal basis: our legitimate interests in keeping users informed, subject to applicable direct-marketing rules. You can opt out of marketing communications.
Confirm your identity when you contact us
Legal basis: our legitimate interests in protecting your account and preventing unauthorised access.
Handle complaints, requests and disputes
Legal basis: our legitimate interests in resolving issues properly and, where applicable, compliance with legal obligations.
Review sessions and communications for quality, monitoring and staff training
Legal basis: our legitimate interests in maintaining service quality and our standard of care, subject to any consent required for the underlying recording or transcription.
Provide aggregated organisational insights to employers
Legal basis: our legitimate interests in helping employers understand use and usefulness of the service, using information designed not to identify individual users.
Where we rely on legitimate interests, we balance those interests against your rights and interests. You may object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing that took place before you withdrew your consent.
For account setup data that we process only on behalf of your employer or adviser, the relevant controller determines the legal basis for that processing.
7. Special categories of personal data
Some personal data receives additional protection under data protection law, including data revealing health, religion or philosophical beliefs, political opinions, trade union membership, racial or ethnic origin, or information concerning a person’s sex life or sexual orientation.
Where we process special categories of personal data, we do so only where an applicable legal condition permits it. In the circumstances described below, we generally rely on your explicit consent where such data may arise as part of an optional data connection.
Bank transactions. Transaction data can sometimes reveal sensitive information, for example through payments to healthcare providers, religious organisations, political organisations or trade unions. Where required, we ask for your explicit consent before processing such information through a connected bank account.
Ockto source data. Source data may in some circumstances reveal sensitive information. Where required, we ask for your explicit consent before processing such information through the Ockto connection.
Penny and financial expert sessions. Penny and our financial expert workflows are not designed to collect special categories of personal data, and we ask you not to provide such information unless it is necessary. If you provide sensitive information, we will handle it in accordance with applicable data protection law and apply appropriate safeguards.
You can withdraw an explicit consent at any time. We do not use special category data to make solely automated decisions about you that produce legal effects or similarly significantly affect you, and we do not provide such data to your employer as identifiable information.
8. Use of AI
We use artificial intelligence (“AI”) in the Platform, including Penny, our digital AI assistant, to help you navigate financial topics, prepare for sessions with a financial expert and answer your questions.
Penny processes information you provide through the Platform together with relevant account and financial information to generate responses and provide requested functionality.
Penny may provide general information and guidance tailored to information you provide. It does not recommend or select specific financial products, enter into or arrange transactions on your behalf, or provide financial advice (advies) or intermediary services (bemiddelen) within the meaning of the Dutch Financial Supervision Act (Wet op het financieel toezicht).
We make it clear when you are interacting with Penny or another AI feature rather than a person.
Conversations with Penny are not used to train the underlying AI models. We may use conversations for quality review, security, staff training and service improvement where permitted by applicable law. This is different from training the underlying AI models.
Where appropriate, you may also discuss your situation with a human financial expert through the Services.
What we share with AI systems
When you use Penny or related AI functionality, we share only information needed to provide that functionality. Depending on the feature, this may include:
financial data you have added to the Platform, such as income, savings, expenses and pension information;
relevant messages from financial experts;
outcomes of self-service questionnaires and tools;
limited profile information, such as your first name, date of birth, whether you have a partner and relevant life events or selected topics.
Information used by the AI functionality is linked through an internally assigned Equip user ID. We do not intentionally provide identifiers such as your last name, email address or employer details to the AI models where they are not needed for the functionality.
We use AI infrastructure and service providers to support these features. Where those providers process personal data on our behalf, they are subject to appropriate contractual and security requirements.
Automated decision-making
We do not use Penny or other AI features to make solely automated decisions about you that produce legal effects or similarly significantly affect you. Penny and our insights tools provide information and guidance; they do not determine whether you can access a financial product, service or benefit.
9. Who we share personal data with
We only share personal data where necessary for the purposes described in this Privacy Policy or where the law permits or requires us to do so. Recipients may include:
our personnel and contractors who need access to perform their role;
a financial expert you have interacted with and, where that expert is engaged by your adviser, the relevant adviser to the extent necessary for that advice relationship and the agreed service;
service providers supporting hosting, authentication, communications, scheduling and video meetings, analytics, financial data connectivity, customer support and other Platform operations;
providers currently used in connection with the Services may include Amazon Web Services (AWS), Auth0, Cal.com, Calendly, Finrust, Invers, Meeting BaaS, Microsoft 365, Mixpanel, Ockto, Retool, SendGrid, Strapi, Typeform and WebinarGeek, subject to change as our Services evolve;
public authorities, regulators, courts or other parties where disclosure is required by law or is necessary to establish, exercise or defend legal claims;
another party where you have asked us or expressly authorised us to share information with them.
Where a service provider processes personal data on our behalf, we put appropriate data processing agreements and safeguards in place as required by applicable law.
What your employer can see
We do not provide your employer with identifiable information about your personal financial situation, your interactions with Penny or the content of your sessions with financial experts.
We may provide employers with aggregated information about use of the Services, user satisfaction and common themes. We design such reporting so that individual users are not identified and apply aggregation controls intended to reduce the risk that information can be traced back to an individual.
10. International transfers
We aim to process personal data within the European Economic Area (“EEA”) where reasonably possible. Some service providers may, however, process or access personal data from countries outside the EEA.
Where personal data is transferred outside the EEA, we use a transfer mechanism permitted by applicable data protection law, such as an adequacy decision, the European Commission’s Standard Contractual Clauses with supplementary measures if needed, or another lawful safeguard, where required. You can contact us for further information about the safeguards relevant to your personal data.
11. How long we keep personal data
We keep personal data only for as long as necessary for the purposes for which it was collected, including to provide the Services, maintain security, comply with legal obligations and establish or defend legal claims. The period depends on the type of information, the purpose for which we use it and any applicable legal or contractual requirements. Our retention approach per data category is as follows.
Account and profile data
For as long as your account is active and thereafter only for as long as needed for applicable legal, security or dispute-resolution purposes.
Bank transaction data received through Invers
No longer than five years, unless a shorter period applies or you validly request earlier deletion.
Ockto data and documents you upload
For as long as needed to provide the relevant Services and thereafter only where a legal or legitimate retention need applies.
Penny conversations
For as long as needed to provide and support the Services and for applicable security, quality, legal and dispute-resolution purposes.
Session notes and transcripts
For as long as needed for the relevant service, quality/compliance purposes and applicable legal or dispute-resolution requirements. Transcripts are only created where the applicable transcription requirements have been met.
Support and complaint records
For as long as needed to resolve the matter and for any applicable legal or dispute-resolution period.
Security and technical logs
For as long as reasonably necessary for security, fraud prevention, troubleshooting and legal compliance.
Consent and privacy preference records
For as long as needed to demonstrate and manage the relevant consent or preference and meet accountability requirements.
If you ask us to delete personal data, we will do so unless we need to retain some information for a lawful reason. Where we act only as processor for your employer or adviser, retention and deletion are governed by their instructions and applicable law.
12. Cookies and Platform analytics
We use cookies and similar technologies that are necessary to keep the Platform working, including functionality needed to recognise an authenticated session.
We do not use the Services for third-party advertising. We may measure how the Platform is used so that we can understand performance and improve features. Depending on the technology used, analytics may involve technical identifiers or similar storage technologies. Where consent is legally required for a non-essential cookie or similar technology, we will ask for it before using that technology.
We do not provide analytics information to your employer in a form designed to identify you personally.
13. Security
We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Access is restricted to people and service providers who need it for their role.
No system can be guaranteed to be completely secure. If we become aware of a personal data breach, we will assess it and make any notifications required by applicable data protection law.
14. Your rights
Under data protection law, you may have the following rights in relation to personal data for which Equip is the controller:
Right to information – to receive clear information about how your personal data is used.
Right of access – to ask for a copy of personal data we hold about you.
Right to rectification – to ask us to correct inaccurate or incomplete personal data.
Right to erasure – to ask us to delete personal data where the legal requirements for deletion are met.
Right to restriction – to ask us to restrict certain processing in the circumstances provided by law.
Right to data portability – for certain data you provided to us that we process by automated means on the basis of consent or contract, to receive it in a structured, commonly used and machine-readable format and, where technically feasible, have it transmitted to another controller.
Right to object – to object to processing based on legitimate interests. You can object at any time to processing of your personal data for direct marketing.
Right to withdraw consent – where processing is based on consent, to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
Rights relating to automated decision-making – where applicable under data protection law.
To exercise a right in relation to data for which Equip is controller, email support@withequip.com. We may need to verify your identity before acting on a request. We normally respond within one month. Where permitted by law, that period may be extended by up to two further months for complex or numerous requests, in which case we will tell you.
For account setup data that we process only on behalf of your employer or adviser, you should normally direct your request to that controller. If you send the request to us, we will handle it in accordance with our obligations as processor and, where appropriate, pass it to the relevant controller.
15. Complaints
If you have concerns about how we handle your personal data, please contact us first at support@withequip.com so that we can investigate.
You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
16. Changes to this Privacy Policy
We may update this Privacy Policy from time to time, for example if our Services, data practices or legal obligations change. We will publish the current version on our website and update the date at the top of this policy. If a change materially affects how we use your personal data, we will provide additional notice where required or appropriate.
17. Contact us
Equip Financial Technology B.V.
Elandsstraat 169H
1016 RZ Amsterdam
The Netherlands
support@withequip.com