Privacy and Cookie Policy

Consolidated Multibrand of Publitas.com B.V.

Effective Date: 17 July 2025

1. Introduction

Welcome to Publitas Holding B.V. This Privacy and Cookie Policy applies to all entities and platforms operated under Publitas Holding B.V., including Publitas.com B.V., WePublish B.V., OnlinePublisher B.V., and the platforms Folders.nl, PromoButler, and Spott.ai (hereafter referred to as “Publitas Holding,” “we,” “our,” or “us”).

We are committed to processing personal data in compliance with applicable global privacy laws, including but not limited to the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), Brazil’s General Data Protection Law (LGPD), China’s Personal Information Protection Law (PIPL), Singapore’s Personal Data Protection Act (PDPA), and Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). This policy explains how we collect, use, disclose, and protect your personal data across all our platforms.

If you have any questions or concerns, please contact us at privacy@publitas.com.

2. Who We Are

This Privacy and Cookie Policy applies to the processing of personal data across all websites and SaaS solutions operated by, or directly/indirectly part of, Publitas.com B.V., via Publitas.com Holding B.V.
This includes, but is not limited to, the following domains and platforms:

• Publitas – digital catalogs and interactive content solutions
• WePublish – advertising and media solutions
• OnlinePublisher – digital publishing and marketing automation solutions
• Folders – digital flyer distribution and engagement
• Promozilla – digital flyer distribution and user engagement
• PromoButler – promotional distribution and online deals
• Spott – interactive content and AI-powered media tools

Publitas.com B.V. is the primary operating entity of all platforms listed above and any other affiliated SaaS services. All services belong to or are operated by Publitas.com B.V., directly or through its parent company, Publitas.com Holding B.V.

While this policy provides a unified privacy framework, specific features—such as newsletter sign-ups, tracking preferences, or consent requests—may differ slightly between platforms. These differences will be communicated during interaction via cookie banners, sign-up forms, or in-app consent notices.

We also collaborate with select third-party partners, such as media groups and publishers, to offer co-branded or hosted experiences. In such cases, services may be embedded in or served from our partners’ infrastructure, including those in other countries. Depending on the nature of the collaboration, data may be processed under joint responsibility or with clearly defined roles as independent controllers. Such arrangements are governed by contractual agreements to ensure compliance with all applicable data protection laws, including the GDPR. Data is only shared when necessary for service delivery, analytics, or co-branded marketing initiatives.

If you have questions about data processing under this policy or want to clarify which party is responsible for a specific feature or platform, please contact us at privacy@publitas.com.

3. Data Processing Roles and Responsibilities

Publitas Holding may act as a data controller or processor depending on the service. For some platforms, such as Folders.nl, our role may shift depending on the service provided:

• Basic PDF Publication Only:
  • What we do: The client provides a finished PDF, and we publish it on folders.nl.
  • Processor activities: None or minimal. Folders.nl may still collect usage data, but unless that data is linked or made available to the client, we are likely the controller of that usage data.
  • Processor status: Folders.nl is not a processor in this case. (Exception: if we deliver access to raw analytics tied to that specific PDF, that element could shift into processor territory.)
• Enhanced Publication (e.g., searchable folder, tagging, analytics):
  • What we do: Enable search inside the PDF, add tags or metadata, and provide client-specific analytics.
  • Processor activities: Process behavioral data (e.g., which pages were viewed, clicks, time spent), process any data necessary to tag or enrich the folder under client instructions.
  • Processor status: Folders.nl acts as a processor for those elements. The client controls how that data is used and instructs us to process it.
• Folders Created via Publitas Tool:
  • What we do: The client uses the Publitas tool to create the folder. Folders.nl hosts it and may enrich it with tracking, analytics, search, etc.
  • Processor activities: Same as for Publitas clients: user interaction tracking, tagging, searchability, and hosting.
  • Processor status: We are a processor here, just like standard Publitas clients. The client is the controller, and all processing is under their instruction.

For other platforms, similar distinctions apply based on the service provided and the data processed.

4. What Personal Data We Collect & Why

We collect and process different types of personal data depending on how you interact with our platforms.

• Information You Provide to Us
  • Personal Identification Data: Name, email address, phone number, and postal address.
  • Account Credentials: Login information such as username and password.
  • Communication Data: Any information you provide in messages or emails.
  • Preferences and Interests: Based on your interactions with our platforms.
• Information We Collect Automatically
  • IP Address & Device Information: Device type, browser type, OS version.
  • Usage Data: Pages visited, interaction behavior, referral sources.
  • Location Data: Derived from IP address or explicit device permissions.

5. Children’s Data and Sensitive Data

Our services are not intended for children under 16, and we do not knowingly collect personal data from children. If we discover that we have inadvertently collected personal data from a child, we will delete such data as soon as possible.

We do not process special categories of personal data (such as health data, biometric data, or data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership) unless such data is explicitly provided by a user for a specific purpose and with explicit consent. In such cases, we apply additional safeguards and process the data strictly following applicable laws.

6. Third-Party Data Sharing

We may use third-party service providers for analytics, advertising, and security:

• Analytics & Tracking: We use trusted analytics providers to understand how users interact with our platforms. These services help us improve our offerings and user experience.
• Security & Performance: We rely on industry-leading security and performance providers to protect our platforms and ensure fast, reliable access.
• Marketing & Advertising: Depending on the product or service, we may use tools such as Facebook Pixel, LinkedIn Insights, and Google Ads to measure the effectiveness of our campaigns and deliver relevant content to users. Using these tools is always subject to user consent where required by law.
• Internal and External Tools: We use various internal and external tools to support our business processes, including project management, email communication, payment processing, and collaboration platforms. These tools may process personal data as necessary for their intended purposes and are selected for their strong security and data protection standards.

We do not sell personal data to third parties.

7. Subprocessor Notifications

We may engage trusted subprocessors to assist in providing our services. Our Data Processing Agreement (DPA) manages subprocessor notifications, including details about the types of processing and the safeguards in place. For more information about our subprocessors and how we manage them, please refer to the DPA or contact us at privacy@publitas.com.

8. Legal Basis for Processing 

Under GDPR, we process personal data based on:

• Consent (e.g., when subscribing to newsletters or accepting cookies).
• Contractual Necessity (e.g., account management).
• Legitimate Interests (e.g., analytics and fraud prevention, where permitted).
• Legal Compliance (e.g., fulfilling regulatory obligations).

9. Your Rights & Choices

As a data subject, you have the following rights:

• Access & Rectification: Request a copy of your data or correct inaccuracies.
• Erasure (Right to be Forgotten): Request deletion of your data.
• Data Portability: Request your data in a structured format.
• Objection & Restriction: Limit processing in some instances.
• Withdraw Consent: Change cookie preferences or unsubscribe from emails.

To exercise these rights, contact privacy@publitas.com.

10. Data Transfers & Storage

Primary storage locations: Ireland and the Netherlands. All personal data is stored within the European Economic Area (EEA) whenever possible. In limited cases, data may be transferred outside the EEA only to subprocessors that offer an equivalent or higher level of protection, and only when such transfers are governed by the most current and valid safeguards approved under GDPR Article 46, including the use of Standard Contractual Clauses (SCCs) or the EU-U.S. Data Privacy Framework, where applicable.

These subprocessors are carefully selected based on their security standards and certifications, often exceeding those available within the EEA. We ensure that such providers are contractually bound to uphold strong security, confidentiality, and data protection standards in line with the obligations of this policy and the applicable law.

11. Data Breach Notification

In the event of a personal data breach, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. If the breach is likely to result in a high risk to individuals’ rights and freedoms, we will notify the affected individuals without undue delay. All data breach notifications will include information about the nature of the breach, the categories and approximate number of individuals concerned, the likely consequences, and the measures taken or proposed to address the breach.

12. Contact for Data Protection Authority

If you have concerns about our use of your personal data, you may contact the relevant data protection authority. For users in the Netherlands, the supervisory authority is:

Autoriteit Persoonsgegevens (Dutch Data Protection Authority)
Postbus 93374
2509 AJ DEN HAAG
The Netherlands
Phone: +31 70 888 85 00
Email: info@autoriteitpersoonsgegevens.nl
Web form: https://autoriteitpersoonsgegevens.nl/nl/meldingsformulier-klachten

You may contact your local data protection authority for users in other EU Member States.

13. What about cookies?

Cookies are small text files that websites store on your device to remember your preferences, enhance site functionality, and provide insights into how users interact with the platform. We use first-party and third-party cookies. We use cookies and similar technologies to improve user experience, analyze website traffic, and support marketing activities. By using our websites and services, you consent to the placement of cookies following this policy.

We use a consent management tool to obtain valid consent where required, such as for EU/EEA visitors under the ePrivacy Directive. You’ll find a complete list of all cookies at the end of this policy.

14. Managing Cookie Preferences 

You can manage your cookie preferences using:

• Browser Settings
• Consent Management Tool
• Opt-out Links (Google Ads, Facebook Ads)

To withdraw consent, use the consent management tool on our website.

15. Retention Periods

Any data is only stored for as long as legally necessary to provide the service. Analytics data, for example, is typically retained in anonymized form for up to 26 months, and account-level data is retained for the duration of your service, plus up to 12 months for security or auditing purposes, unless earlier deletion is requested.

16. DPA Access

If you act as a business customer or data controller under applicable laws and require a Data Processing Agreement (DPA) that you have not yet agreed to by signing up to our services, please contact us at privacy@publitas.com.

17. Other Important Information

• Policy Updates: We may update this policy periodically.
• Automated Content Personalization: Under the Digital Services Act (DSA), we inform users that we may use automated content personalization or recommendation algorithms for marketing and targeting purposes. These may rely on cookie-based profiles or user preferences as explicitly provided. No fully automated decision-making with legal or similarly significant effects is in place.
• User Rights: We respect users’ rights to access, correction, objection, deletion, portability, and restriction of processing. You may lodge a complaint with your local data protection authority if you reside in the EU.
• Consent Management: We do not apply dark patterns or misleading user interface flows when requesting consent. All cookie banners and opt-in mechanisms are designed to meet the transparency and fairness standards under the GDPR and ePrivacy Directive.
• Support: If you require a DPA for your business activities or need support with data portability or opt-out procedures, contact privacy@publitas.com.
• For any inquiries, contact privacy@publitas.com.

 

Types of Cookies we use

 

Manage cookie preferences

Cookie Settings