Privacy Statement

1. Who is responsible?

ENCAS is a trading name of Lifecycle Innovations Limited, Hong Kong (Companies Registry no. 76545088), Unit 4005, 40/F, Singga Commercial Centre, 144-151 Connaught Road West, Sai Ying Pun, Hong Kong. Privacy questions: [email protected]. For accounts and technical logs on this website, ENCAS is the data controller.

2. Which data do we process?

• Account and authentication data: name, email address, login credentials, sessions and security events (such as sign-in attempts) when you create an account or sign in.
• Technical server logs: IP address, browser or device type, pages requested and timestamps, processed automatically to deliver and secure the site.

We do not place marketing or tracking cookies and run no analytics tools. The only cookies used are functional: keeping your session alive after you sign in.

3. For what purpose and on what legal basis?

• Accounts and access: creating and securing your account (basis: performance of a contract, or your consent upon registration).
• Availability and security of the site: technical logs (basis: legitimate interest — a secure and stable website).

4. Service providers (processors)

• Cloudflare — hosting and delivery of this site, including technical log data for security and availability.
• Clerk — authentication: account data, sessions and security events, solely for signing in.

Processor agreements with these parties have been concluded or will be concluded before they process data. We add new processors to this list.

5. Retention periods

We keep account data for as long as your account exists, and thereafter only where legally required. Technical logs are kept no longer than necessary for security and stability. We keep the full case file for 5 years after closure. We then cut it back to the financial records, which we keep until year 7 (EU archive). We delete recordings and transcripts of uneventful calls after 3 months, unless a dispute or complaint is open. For a refused case we keep company-only data, with a yearly review, and the debtor only as a keyed hash for 5 years after the last match.

6. Your rights

You may ask us for access to, rectification, erasure or restriction of your personal data, as well as data portability or withdrawal of consent given. Write to [email protected]. We respond within the statutory period of four weeks.

If you believe we are not handling your data correctly, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

7. Joint controllers

If we contact you on behalf of a company about an unpaid invoice, ENCAS and the creditor are jointly responsible for your data (art. 26 GDPR). The creditor decides which invoice is followed up and provides your business contact details. ENCAS decides how you are contacted and runs the process, including AI-assisted messages and calls. ENCAS is your contact point for all privacy questions and requests: [email protected]. You can also contact the creditor.

8. AI

Cas is an AI system. Cas's messages are written with AI, and if Cas calls you, you are speaking with an AI voice. We say so at the start of every call. You can always ask for a person or for written contact only. A staff member, not the AI alone, takes decisions on your file. (Art. 50, Regulation (EU) 2024/1689.)

9. Call recording

Phone calls with Cas are recorded. We do this to keep a record of what was agreed (for example a payment arrangement), to check what the AI said, and to handle complaints and disputes properly. Legal basis: legitimate interest (art. 6(1)(f) GDPR). At the start of every call we tell you that the call is recorded. If you don't want that, just say so: we stop recording or switch to written contact. We call you at most 3 times a week. Current policy: we delete recordings and transcripts of uneventful calls after 3 months, unless a dispute or complaint is open.

Notice at the start of each call: "Hello, this is Cas, the AI assistant of ENCAS, calling on behalf of [creditor] about an unpaid invoice from [company]. This call is recorded so we have a record of what we agree. If you'd rather speak to a person, not be recorded, or only be contacted in writing, just say so. More information: encas.ai/privacy."

10. Transfer to Hong Kong

Your data is stored with our host in the EU and encrypted by that host. Every read of a case or a document is logged. The archive of a closed case is closed to Hong Kong by default. There is no adequacy decision for Hong Kong. The chosen safeguard is the European Commission's standard contractual clauses (Decision (EU) 2021/914), module 1. Ask [email protected] for a copy. US service providers are used under the EU-US Data Privacy Framework or standard contractual clauses.

11. Retention

The retention periods and deletion rules are described in section 5 above.