AKA Label Studio: Privacy Notice

What this means in plain English

AKA Label Studio is a free tool that lets you create food labels from recipe information you provide. To use it, you create an account. We collect your account details, what you do in the tool, and the recipe content you upload. We use that information to run the service, contact you about it, and improve the product.

We do not sell your data. We share it only with the third parties we list in Section 5, and only as needed to run the service.

You have rights under the GDPR (access, correction, deletion, export, and others). Section 7 explains how to exercise them. You can also complain to the Dutch supervisory authority. Full details below.

1. Who we are and what this notice covers

In plain English: The Dutch company behind AKA Label Studio, and what this document is about.

AKA Label Studio (the "Service") is operated by AKA Foods Netherlands BV, a Dutch private limited company (besloten vennootschap) with registered office at Gondel 1, 1186 MJ Amstelveen, the Netherlands ("AKA Foods," "we," "us," or "our"). For the purposes of the EU General Data Protection Regulation ("GDPR"), we are the data controller for the personal data we process about you in connection with the Service.

This Privacy Notice describes how we collect, use, share, and protect personal data when you create an account for, log into, and use the Service. It does not cover:

• Our marketing website at aka-food.com (covered by our Website Privacy Policy at https://aka-food.com/privacy-policy/).
• AKA Studio, our paid R&D platform (covered by the AKA Studio Privacy Notice and the Data Processing Addendum signed at the time of purchase).

2. The personal data we collect and why

In plain English: Five short categories. Read these together with Section 3, which explains the legal basis for each.

2.1 Account data

When you create an account, we collect your name, email address, company name, and your role at that company. If you choose to provide it, we may also collect your phone number. We use this data to set up and maintain your account, authenticate you, and respond to your requests.

2.2 Content you upload

When you generate a label, you provide the Service with recipes, ingredient lists, supplier specifications, yields, weights, claims, and similar product information. Most of this is not personal data in the GDPR sense, but it is your commercially sensitive content. We treat it as confidential. We use it to generate the label you ask for and to provide the Service. We do not sell or rent it to anyone.

2.3 Usage data

We automatically collect technical information when you use the Service: your IP address, browser type and version, device type, the pages and features you use, the labels you generate, time and duration of your sessions, and similar diagnostic data. We use this to operate the Service, monitor for abuse, debug issues, and improve performance.

2.4 Marketing and lead data

When you sign up, we store the email address and company information you provide so our team can contact you about AKA Foods products. We do not pass this data to any external CRM or marketing-automation platform; it lives only in our own database (see Section 5 for our sub-processors). You can opt out of marketing communications at any time via the unsubscribe link in any email.

2.5 Cookies and similar technologies

The Service uses only strictly necessary cookies: session, authentication, and CSRF cookies required to log you in and keep you logged in safely. The Service does not use advertising cookies, third-party tracking pixels, or analytics services that track individual users across websites. Because the Service deploys only strictly necessary cookies, no cookie banner is shown inside the Service. Our marketing website at aka-food.com does use analytics and marketing cookies and presents its own consent banner; cookie usage on the marketing website is covered by the Website Privacy Policy.

3. The legal basis we rely on

In plain English: Under GDPR Article 6, we need a legal reason to process your data. Here are ours, by purpose.

4. How long we keep your data

In plain English: Specific periods by category. We do not keep data "forever just in case."

5. Who we share your data with

In plain English: A short list of the third parties that help us run the Service. We do not sell your data and we do not share it for any other party's own marketing.

We use the following sub-processors, each bound by a written contract that includes GDPR-compliant data protection obligations:

We will update this list when we add or change sub-processors. You can subscribe to notifications of changes by emailing marketing@aka-food.com.

We may also disclose personal data to (a) professional advisers (lawyers, auditors) under confidentiality obligations; (b) public authorities where required by law; and (c) an acquirer in the event of a merger, acquisition, or restructuring of AKA Foods, in which case we will provide notice before any change of control.

6. International transfers of your data

In plain English: Most of your data stays in the EU. Some of it goes to US-based service providers under approved transfer mechanisms.

Our Service runs on infrastructure located in the United States (Google Cloud Platform, us-central1 region) and uses sub-processors that are primarily based in the United States (see Section 5). This means that personal data we collect about you in the European Economic Area (EEA) is transferred to and processed in the United States.

Where we transfer personal data outside the EEA, we rely on one of the following transfer mechanisms, in this order of preference:

• Adequacy decisions issued by the European Commission, where available.
• Participation in the EU-US Data Privacy Framework (DPF), for sub-processors that are certified.
• Standard Contractual Clauses (SCCs) adopted by the European Commission, combined with supplementary technical and organizational measures where required following the Schrems II judgment.

We also apply technical and organizational safeguards including encryption in transit (TLS) and encryption at rest, access controls, and contractual restrictions on our sub-processors.

You can request a copy of the transfer mechanism that applies to a particular processing activity by contacting marketing@aka-food.com.

7. Your rights under the GDPR

In plain English: The full set of rights and how to use them. We will respond within 30 days; we tell you up front when we can't.

As a data subject under the GDPR, you have the following rights:

• Right of access (Article 15). You can ask us to confirm whether we hold personal data about you and, if so, to give you a copy along with details about how we process it.
• Right to rectification (Article 16). You can ask us to correct inaccurate or incomplete personal data about you.
• Right to erasure ("right to be forgotten," Article 17). You can ask us to delete your personal data in certain circumstances.
• Right to restriction (Article 18). You can ask us to stop processing your data in certain circumstances, while we resolve a dispute or verify accuracy.
• Right to data portability (Article 20). Where we process your data on the basis of consent or contract, you can ask us to provide a copy in a structured, commonly used, machine-readable format and (where technically possible) to transmit it to another controller.
• Right to object (Article 21). You can object to processing based on legitimate interest (including profiling) and to direct marketing at any time.
• Right not to be subject to automated decision-making (Article 22). We do not make decisions about you that produce legal effects or similarly significant effects through automated means alone.
• Right to withdraw consent. Where we process your data on the basis of consent, you can withdraw that consent at any time. Withdrawal does not affect processing that took place before withdrawal.

Several of these rights are available directly inside the Service:

• Access your account data via your profile page.
• Correct your name and company via your profile settings.
• Delete your account and all associated data (profile, recipes, custom ingredients, labels) via Settings > Danger Zone; this is a permanent, irreversible deletion.
• Export your generated labels in PNG, SVG, or PDF format directly from each label.

To exercise any other right, or to make any request that the in-product flows do not cover, contact us at marketing@aka-food.com. We will respond within 30 days of receiving a verifiable request. If we cannot meet that deadline (for example because a request is complex), we will tell you why and give you an estimated timeline.

8. Right to lodge a complaint

In plain English: If you think we have got something wrong, talk to us first. If you are still unhappy, you can go to the Dutch regulator.

If you believe we have processed your personal data unlawfully, we encourage you to contact us first at marketing@aka-food.com so that we have an opportunity to resolve the matter.

You also have the right to lodge a complaint with a supervisory authority. In the Netherlands, that is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority), https://autoriteitpersoonsgegevens.nl. You may also lodge a complaint with the supervisory authority in your country of residence within the EEA.

9. Security

In plain English: What we do to keep your data safe. No system is perfect; we are honest about it.

We use technical and organizational measures appropriate to the risk to protect your personal data, including encryption in transit (TLS), encryption at rest for sensitive data, access controls, regular security reviews, and staff training on confidentiality and data protection. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Autoriteit Persoonsgegevens within 72 hours as required by GDPR Article 33 and, where the risk to you is high, we will notify you directly as required by Article 34.

10. Children

In plain English: AKA Label Studio is for businesses, not minors. We do not knowingly process children's data.

AKA Label Studio is intended for use by adults in a professional capacity (food brands, manufacturers, regulatory teams, consultants). The Service is not directed at children. In line with Dutch law, we do not knowingly collect personal data from anyone under the age of 16. If you believe we have collected personal data from a child under 16, please contact us at marketing@aka-food.com and we will take steps to delete it.

11. Changes to this Privacy Notice

In plain English: We update this notice from time to time. We will tell you when something material changes.

We may update this Privacy Notice from time to time to reflect changes in our practices, our sub-processors, the law, or the Service. If we make a material change, we will let you know by email or by a prominent notice in the Service before the change takes effect. We encourage you to review this notice periodically.

12. Contact us

For any question about this Privacy Notice or to exercise any of the rights set out in Section 7, contact us at:

AKA Foods Netherlands BV
Gondel 1
1186 MJ Amstelveen
The Netherlands
Email: marketing@aka-food.com