Privacy & security

Your data stays yours.

Your way of selling is company knowledge, and your workspaces hold data about people. SalesDNA treats both as what they are: yours. You are the controller, we are the processor. Below you find exactly how that is arranged.

Status 3 October 2026 · applies to the SalesDNA platform

This is a translation. In case of differences, the Dutch version prevails.

In short

You decide, we process. Your organization is the controller. Sales Legends Group (SalesDNA) is the processor and acts only on your instructions. A data processing agreement under Article 28 GDPR comes with every subscription.
Data in the EU. Database and server functions run in the Ireland region (eu-west-1). Every organization is separated, enforced in the database.
Encrypted and shielded. Encryption in transit and at rest. Permissions per role and team are enforced in the database, not only on screen.
AI without names. Known names and email addresses are removed before anything goes to AI. Nothing about candidates goes to AI. AI never changes anything without your confirmation.
Fixed retention periods. For every type of personal data it is set how long it stays. A daily task cleans up.
Everything with you, always. One export package with all your content, versions, documents, notes, templates and the audit log. After cancellation 30 days read-only, then permanent deletion.
Data breach? You hear it right away. We report a breach without undue delay, so you can notify the Dutch Data Protection Authority within 72 hours.

This page is about the platform. What the website salesdna.nl does with data you enter in a form is set out in the privacy statement of the website and the cookie policy.

Who is responsible for what

In SalesDNA you capture your method and work with data about candidates, new colleagues, sales reps and customers. Your organization decides which data that is, what it is for and how long it stays. That makes you the controller within the meaning of Article 4(7) GDPR.

Sales Legends Group, the company behind SalesDNA, processes that data only to make the platform work for you. We are the processor (Article 4(8) GDPR). We do not use your data for our own purposes, not for marketing and not to train models. The agreements on this are in the data processing agreement under Article 28 GDPR, which comes with every subscription and which you can review in advance.

For your own account and the data of your users, such as name, email address and login details, we are the processor on behalf of your organization. For invoicing and customer contact we are the controller ourselves; that is covered by the privacy statement.

Security

How it is technically arranged.

LocationIn the EUDatabase and server functions run in the Ireland region (eu-west-1).
EncryptionIn transit and at restAll connections run over TLS. The database, files and backups are encrypted at rest.
SeparationSeparated per organizationEvery organization sees only its own data. That is enforced in the database itself, not only in the application.
AccessPermissions per role and teamOwner, sales manager, HR administrator and organization administrator each have their own permissions, also in the database. A sales manager with a team sees only the people of that team. See who can do what.
Personal dataKept apartCandidates, scorecards, onboarding tracks, conversation notes, coaching tracks and handovers are there only for the owner, sales manager and HR. Never visible when the SalesDNA team watches along.
LoginPassword and two-factor authenticationStrong passwords, checked against known data breaches. Two-factor authentication with an app on your phone and recovery codes, mandatory for the owner.
Audit logWho did what, whenChanges, confirmations, exports and revoked links are in an audit log you can view yourself and that is part of the export.
LinksWithout an account, secureLinks for team, candidates and customers are stored only in encrypted form in the database, not in an intermediate cache, not indexed by search engines and always revocable. Who gets which link.
CleanupDaily cleanup taskA daily task deletes what has reached its retention period. Not on request, but automatically.

Fixed retention periods · a daily task cleans up

28 daysRejected candidates, after the vacancy is closed.
1 yearReserve candidates, only with their consent.
12 monthsTranscripts of meetings and notes of conversations.
2 yearsConversation notes, including those from coaching conversations.
1 yearOnboarding data, handovers and watch-along rounds.
2 yearsPulse answers, win/loss and customer feedback, without the customer's name or time.
1 monthNames of pulse recipients, after the round.
30 daysRead-only after cancellation, then permanently deleted.

Sub-processors and transfers

We use a limited number of parties to make the platform work. We have a data processing agreement with each of them. If a sub-processor is added, you hear about it in advance and can object, as the data processing agreement provides.

Sub-processor	What for	Where	Safeguard
Hosting and database	Storage of your SalesDNA, documents, notes and backups; the server functions of the platform.	EU, Ireland region (eu-west-1)	Data processing agreement; data does not leave the EU.
Anthropic (Claude)	The AI model behind suggestions, the note-taker, coaching questions and analyses. The SalesDNA team can choose a different model per customer or per AI type.	United States	Data processing agreement with the standard contractual clauses of the European Commission (Article 46 GDPR). Known names and email addresses are removed before anything goes to AI. Candidate data never goes to AI.
Email service	Invitations, recovery codes, notifications and links without an account.	EU, or with standard contractual clauses	Data processing agreement; only the email address and the content of the message.

The current list with names and locations of the sub-processors is available on request and with the data processing agreement.

Agreements on AI

AI suggests. You decide.

In SalesDNA, AI is an assistant that makes suggestions, asks questions and gives signals. You write and you confirm. AI answers in the language of your organization.

AI does

Write suggestions from your documents and your confirmed building blocks, with the source
Ask follow-up questions when there is too little for a good suggestion
Suggest activities per phase, which you confirm or reject one by one
Build a job profile and job ad text, draft an interview guide and suggest parts for an onboarding program
Suggest questions for a coaching conversation, from the learning point and what happened since last time
As note-taker, turn a transcript into a summary, action items, signals and trends; give coaching tips for conversations
Summarize answers from the pulse survey, onboarding feedback, watch along and customer feedback into suggestions in panel 2
Turn what comes back in several meetings or conversations into additions for the building blocks they are about
Compare your teams with each other, without changing anything

AI does not

Change anything without your confirmation. There is no button to accept everything at once
Invent facts about your organization or copy sentences from the examples
Process people's names: for meeting transcripts, conversation notes, coaching conversations, onboarding feedback, customer feedback and the final review, the names SalesDNA knows and email addresses are removed before anything goes to AI, and nothing about candidates goes to AI. For names SalesDNA does not know, such as a customer's, AI is instructed not to mention any names
Assess or rank candidates or employees: you give the scores yourself, without a total score, and you decide whether a learning point is done
Measure figures or KPIs: you set the norms yourself
Follow instructions hidden in an uploaded document

Tested before releaseEvery AI type is tested against a fixed evaluation set, including documents with a hidden instruction.
Claude by Anthropic by defaultThe SalesDNA team can choose a different model per customer or per AI type. Anthropic is a sub-processor, with standard contractual clauses.
AI bundle per monthPer organization. When it runs out, the automatic analyses stop and you can still ask Dex yourself.

Rights of data subjects: how you handle them

A candidate, colleague or customer can ask your organization for access, correction or deletion. You answer that request; SalesDNA makes sure you can carry it out, without our involvement.

Access. Owner, sales manager and HR administrator see per person everything recorded about him or her: scorecard, onboarding track, coaching track, handover or notes.
Correction. Every recorded text can be edited. Versions remain visible in the audit log.
Deletion. You delete a candidate, track or note right away. In addition, the daily cleanup task deletes everything that has reached its retention period.
Export. At any time you export one package with all your content, versions, documents, notes, templates and the audit log.
Need help? If something does not work in the platform, we help within the terms of the data processing agreement, so you can answer within the statutory month.

Data breaches

If we discover a personal data breach, we report it without undue delay to the contact person of your organization, with what we know about the nature, scope, data involved and measures taken. That way you can assess it and notify the Dutch Data Protection Authority within 72 hours (Article 33 GDPR). We cooperate with the investigation and with notifying data subjects if that is needed.

Continuity and leaving

If you cancel, your environment stays read-only for 30 days. In that period you export everything. After that we delete your data permanently. You receive a confirmation.

Accessibility

SalesDNA is tested against WCAG 2.1 level AA. The platform can be operated with the keyboard alone, in Dutch or English, and on tablet and phone.

Documents for your DPO

Your data protection officer or security officer receives on request via info@saleslegends.nl:

the data processing agreement under Article 28 GDPR, including the standard contractual clauses for transfers;
the current list of sub-processors with name, location, purpose and safeguard;
the overview of retention periods per data type, as above;
a description of the export format, so you know in advance what you get back.

You hear from us within one working day. SalesDNA is not certified under ISO 27001 or SOC 2. What we do is on this page and in these documents.

Questions about privacy and security

What you want to know about your data.

Who is the controller and who is the processor?

Your organization is the controller: you decide which data is in SalesDNA and what for. Sales Legends Group (SalesDNA) is the processor and acts only on your instructions. The agreements are in the data processing agreement under Article 28 GDPR that comes with every subscription.

Which AI model do you use and what goes to it?

By default, AI runs on Claude by Anthropic. The SalesDNA team can choose a different model per customer or per AI type. Known names and email addresses are removed before anything goes to AI, and nothing about candidates goes to AI. Anthropic is a sub-processor, with the standard contractual clauses of the European Commission. Every AI type is tested against a fixed evaluation set before release.

Can the SalesDNA team see our personal data?

Candidates, scorecards, onboarding tracks, conversation notes, coaching tracks and handovers are there only for the owner, sales manager and HR. They are never visible when the SalesDNA team watches along.

How is login secured?

With a strong password, checked against known data breaches, and two-factor authentication with an app on your phone, with recovery codes. For the owner, two-factor authentication is mandatory.

How long do you keep data about people?

Rejected candidates 28 days after the vacancy is closed, reserve candidates with consent one year. Transcripts and conversation notes twelve months, conversation reports two years. Onboarding data, handovers and watch-along rounds one year. Pulse answers, win/loss and customer feedback two years; names of pulse recipients are removed one month after the round. A daily task cleans up.

What happens in case of a data breach?

We report it without undue delay to the contact person of your organization, with what we know about the nature, scope and measures. That way you can notify the Dutch Data Protection Authority within 72 hours. We cooperate with the investigation and follow-up.

What is in the data export and what happens after cancellation?

One package with all your content, versions, documents, notes, templates and the audit log. After cancellation everything is read-only for 30 days, so you can export. After that everything is permanently deleted.

Are you certified?

No. SalesDNA has no ISO 27001 or SOC 2 certification. The measures on this page and the documents for your DPO describe what we do; your DPO can review them.

Demo · 30 minutes · online

Build the first building layer of your SalesDNA. Together, in 30 minutes.

You tell us how you sell, we capture it in building layer 1. After that you know whether SalesDNA fits your organization.

Pick a time Take the quick scan first

No preparation needed
Data in the EU
Confirmation within one working day

You pick a timeRight in the form, in two steps.
We confirm by emailWith two short questions about your team and your current playbook.
Together we build building layer 1Your promise and ambition, captured in SalesDNA.