ParkDossier privacy statement

1. Who is responsible?

The controller is the park (the operator) where you are an owner, staff member or adviser. The park decides what your data in ParkDossier are used for and created your account.

ParkDossier is provided by Zanaro B.V. (trading as Made by Early), Henri Dunantlaan 25, 3434 CJ Nieuwegein, the Netherlands, Chamber of Commerce (KvK) 99115344. Zanaro B.V. processes the data on behalf of the park, as a processor. Only for a few tasks of its own does Zanaro B.V. decide itself what data are used for; these are listed in section 5b.

Please address questions about your data to your park first. For questions about how the platform or the app works: support@madebyearly.com.

2. Which data?

Depending on your role and what the park records, this concerns:

• Account data: name, email address, phone number, role, park, language preference, sign-in data (password and PIN stored as an irreversible hash; only a temporary starting password and starting PIN that the park has created when setting up your account are stored encrypted, so that the park can pass them on to you).
• Purchase and ownership: plot and home, purchase agreement and related documents, instalments and payments, construction progress, and details of the financing.
• Identity (when signing the purchase agreement): date of birth, type and number of your identity document, a copy of it, and your signature.
• Rental (only if the park rents out your home): bookings per home, monthly statements, your bank account number (stored encrypted).
• Communication: messages in the portal, reports with any photos, and email that the park receives or sends about your file and links to your file.
• Technical data: IP address for sign-in attempts and error reports, device name and type, app version, and for the app a push token and a random installation ID.

3. For what purpose?

The park uses the data to carry out the purchase, construction, management and rental of your home and to communicate with you; to comply with legal obligations such as the tax retention obligation; and to secure the portal (preventing misuse, tracing errors).

There is no advertising and no data are sold. ParkDossier does not use third-party analytics or tracking services.

You only use the AI features (the owners' assistant, the staff P.A. and voice input) after you have given your consent; you can withdraw it under Profile. The owners' assistant only uses general documents of the park and those of your own home, never data of other owners. The staff of your park can see your questions to the assistant and the answers; they are also added to the park's knowledge base, which staff consult through the P.A.; names are generally removed, but at some parks only bank account numbers are. E-mail between you and the park is also processed by the AI service on the park's instructions, even if you do not use the assistant yourself (see section 5). You can report an AI answer: the question, the answer and the reason are then stored and reviewed by the ParkDossier administrator.

4. The app

Signing in with Face ID or fingerprint happens entirely on your device: ParkDossier does not receive any biometric data. The device only stores a device key that can only be used after your biometric confirmation; your password and PIN are never stored on the device. You can switch this on and off in Profile and sign out a device under My devices.

Push notifications are delivered via Apple (iPhone) or Google (Android). A notification only contains a short text such as ‘New message’, without amounts or names. You choose for each type whether you want to receive it.

The camera and your photos are only used when you upload a photo or file yourself.

5. Which other companies work with your data?

To make ParkDossier work, Made by Early (Zanaro B.V.) uses services from other companies, for example for storage, sending e-mail and the AI assistant. Most of these companies work on our instructions: they only receive the data they need for their task and may not use it for anything else. Where that is different, it says so. Some companies are based outside Europe; for those, it says which arrangement ensures that your data is protected there. The terms used are explained at the bottom.

If a park has its own account with a service and Made by Early only connects that account to ParkDossier, it says "the park's account". That service then works on the park's instructions.

If Made by Early wants to add or replace a service, parks are notified at least 14 days in advance and can object. This list is then updated; the date at the top shows the latest version.

• Storage: Hetzner Online GmbH — What does it do? This is where ParkDossier runs: the servers, the database, the documents and the backups. What do they receive? All data in ParkDossier. Where? Germany (EU).
• AI services: OpenAI (contracting party OpenAI Ireland Ltd.; processing by OpenAI OpCo, LLC) — What does it do? Answers questions put to the assistant for owners and the P.A. for staff, and works for the park's knowledge base. It also sorts and summarises e-mails that you send to or receive from the park, so that the park can reply faster. The latter happens on the park's instructions, even if you do not use the assistant yourself; names in the e-mail are not removed. Feedback you send to Made by Early is also processed this way (see "What Made by Early processes itself"). What do they receive? Your question and the documents from your file that are needed for the answer, texts from the knowledge base, and the content of e-mails between you and the park. Where? United States, under the European Commission's model clauses (standard contractual clauses).
• AI services: Deepgram, Inc. — What does it do? Converts speech into written text in the P.A. This is for park staff only. What do they receive? The recording. It is converted immediately and not stored. With every request, ParkDossier asks Deepgram not to use the recording to train its models. Where? The recording is processed in the EU. Deepgram is based in the United States; for access from the United States, the European Commission's model clauses (standard contractual clauses) apply.
• AI services: Anthropic (contracting party Anthropic Ireland Ltd.; processing by Anthropic, PBC) — What does it do? Reads your identity document in the purchase wizard, so you do not have to type in your name, date of birth and document details yourself. What do they receive? The photo of your identity document. Only the details needed are returned; the Dutch citizen service number (BSN) is not read. Where? United States, under the European Commission's model clauses (standard contractual clauses).
• Signing, invoices and payments: Signhost (Entrust Netherlands B.V.) — What does it do? Digital signing of purchase agreements and other documents. What do they receive? The document, your name, e-mail address and phone number (for the text message code). Where? EU.
• Signing, invoices and payments: Moneybird B.V. — What does it do? Invoices and payments, for parks that choose to use it. This is usually the park's account. What do they receive? Name, address, e-mail address and invoice lines. Where? EU.
• Signing, invoices and payments: Stripe (Stripe Payments Europe, Ltd., Ireland) — What does it do? Payments at reception, for parks that use it. The park's account. Stripe also uses some data for its own purposes, such as fraud prevention. What do they receive? The guest's e-mail address, the amount and the description. Where? The contracting party is in Ireland (EU). Processing may take place at Stripe, LLC in the United States, which participates in the EU–US arrangements (Data Privacy Framework).
• E-mail and push notifications: Microsoft (Microsoft 365) — What does it do? Sending and receiving e-mail, for parks that use Microsoft 365. This is usually the park's account. What do they receive? The content, addresses and attachments of e-mails. Where? The contracting party is Microsoft Ireland Operations Ltd. (Ireland, EU). Microsoft may also process data in the United States; Microsoft Corporation participates in the EU–US arrangements (Data Privacy Framework), and the European Commission's model clauses (standard contractual clauses) also apply.
• E-mail and push notifications: Hostinger (Hostinger International Ltd.) — What does it do? Sending and receiving e-mail from Made by Early, such as system messages. What do they receive? The content and addresses of e-mails. Where? The contracting party is based in Cyprus (EU). For services that Hostinger itself uses outside the EU, the European Commission's model clauses (standard contractual clauses) apply.
• E-mail and push notifications: Apple Inc. — What does it do? Delivers push notifications on an iPhone and in Safari. What do they receive? A push token (a code for your device) and the short text of the notification. Where? United States, under the European Commission's model clauses (standard contractual clauses).
• E-mail and push notifications: Google LLC (Firebase Cloud Messaging) — What does it do? Delivers push notifications on Android and in Chrome. What do they receive? A push token and the short text of the notification. Where? United States, participating in the EU–US arrangements (Data Privacy Framework).

5a. Other recipients

These parties receive data through ParkDossier but do not work on Made by Early's instructions. They use the data under their own responsibility.

• Google (address completion) — What happens? When you type your address in the purchase wizard, the characters you type are sent to Google, which suggests a complete address. Google uses those characters under its own terms. Where? United States, under the European Commission's model clauses (standard contractual clauses); Google LLC also participates in the EU–US arrangements (Data Privacy Framework).
• The park's sales agent (for parks that have the sale handled by Recradroom: Recradroom) — What happens? The park can instruct Made by Early to pass the details you enter in the purchase wizard, including the copy of your identity document, to the company that handles the sale of your home. That company uses them for that purpose and for its legal duty to verify and keep a record of buyers' identities. Where? Germany (EU).
• The notary handling the transfer of ownership, if the park has set this up.

5b. What Made by Early processes itself

For a few things, Made by Early (Zanaro B.V.) decides itself what data is used for:

• contact and invoicing details of parks;
• questions you send to support@madebyearly.com;
• reports of illegal content and complaints about ParkDossier;
• feedback you send to Made by Early in ParkDossier. Made by Early uses it to improve ParkDossier, including with OpenAI's AI service. Details in your feedback are not removed automatically, so please do not include any information about yourself or others that is not needed.

Made by Early does this because it has a legitimate interest in providing a good and secure service, and for invoices and reports because the law requires it. Invoices are kept for seven years (Dutch tax retention obligation); everything else for as long as needed to deal with it. You can object and exercise your other rights via support@madebyearly.com.

5c. What do these terms mean?

• EU / EEA: the European Union, plus Norway, Iceland and Liechtenstein. The same data protection law (GDPR) applies there.
• European Commission's model clauses (standard contractual clauses): a contract with fixed terms, set by the European Commission, in which a company outside the EU promises to protect your data just as well.
• EU–US arrangements (Data Privacy Framework): US companies that join protect data under rules the European Commission considers adequate. If this framework lapses, the model clauses apply.
• Working on instructions (processor, sub-processor): the company only uses the data for the task it is given.
• Own responsibility (independent controller): the company decides itself what it uses the data for and must comply with data protection law itself.

6. How long?

Data are kept for as long as necessary for the relationship with the park and after that for as long as the law requires; purchase agreements and invoices are subject to a seven-year tax retention obligation.

Technically: a one-time sign-in link expires after 60 seconds and is deleted after one day; a sign-in session expires after 30 days; the app's device key expires after 180 days without use or when the device is signed out; a push token is deleted on sign-out or as soon as Apple or Google report that it is no longer valid.

7. Security

All connections are encrypted (HTTPS). In the portal, data of different parks are separated in the database; in the purchase wizard this separation is done in the application. You only see data of your own park and your own role. Passwords, PINs and app keys are stored as an irreversible hash (except a temporary starting password, see section 2), bank account numbers encrypted.

8. Your rights

You can request access to, correction, deletion, restriction or transfer of your data, and you can object. Please contact your park for this. You can also request deletion of your account via parkdossier.nl → account-verwijderen or in the app under Profile. The park handles a request within one month.

If you disagree with how your data are handled, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or with the supervisory authority in your country of residence.

9. Cookies

ParkDossier only uses cookies that are needed for the portal to work: to keep you signed in, to recognise your device for the PIN, and to remember your language and view. There are no advertising or analytics cookies.

10. Changes

This statement may be updated if the processing changes. The date at the top shows the latest version.