Privacy Statement Treams B.V.

Last updated: 01-09-2026

At Treams, we take the protection of personal data seriously. This Privacy Statement explains
how Treams B.V. (“Treams”, “we”, “us” or “our”) processes personal data when you use our
services, interact with us, or when an organisation such as your employer uses the Treams
platform.

‍
This Privacy Statement does not cover the use of cookies and similar technologies on our
website. Please see our separate Cookie Statement for more information about those
technologies.

1. Who is responsible for your personal data?

Depending on the circumstances, Treams may process personal data either as a data processor
on behalf of one of our customers or as a data controller for its own purposes.

‍
1.1 Treams as a data processor

Organisations use the Treams platform to support activities relating to their employees and
organisation, such as employee development, performance management, goals, feedback and
one-to-one meetings.
Where your employer or another organisation determines why and how personal data is
processed through the Treams platform, that organisation is the data controller. Treams
processes the personal data on its behalf as a data processor.
The organisation using Treams is responsible for determining the purposes and legal bases for
these processing activities and for informing you about them. Treams processes such personal
data in accordance with its agreement with the organisation and its documented instructions.

1.2 Treams as a data controller

Treams also processes certain personal data for its own business purposes. For example, this
may occur when you:

For these processing activities, Treams is the data controller.

create or administer an account;
request information about our services;
contact our sales or support teams;
enter into a commercial relationship with us;
visit or interact with our website;
receive communications from us;
interact with us in connection with billing or administration; or
interact with our services where Treams independently determines the purposes and means
of the processing.

2. Personal data processed through the Treams platform

When your employer or another organisation uses the Treams platform, Treams may process
personal data provided by that organisation or generated through your use of the platform.
Depending on how the organisation has configured and uses Treams, this may include:

Profile and employment information, such as your name, email address, employee number,
job title, position, team, start and end date, profile picture, banner, username and other
account information.
Employee development and performance information, such as competencies, goals,
certifications, training and development information, performance reviews, feedback,
meeting notes, one-to-one meeting information and other information relating to
professional development or performance.
Depending on how your employer uses the platform, this may also include salary or
remuneration information.
Technical and usage information, such as IP address, login and account information,
technical logs and information about your interaction with the platform.
Support information, such as information contained in support requests, chats, emails or
other communications with Treams.
The exact categories of personal data depend on how the organisation using Treams has
configured and uses the platform.

3. Microsoft Teams and Microsoft Outlook integrations

Treams provides integrations with Microsoft Teams and Microsoft Outlook that allow customers
to connect their Microsoft environment to their Treams workspace.
The integrations are intended as companion functionality to the Treams platform.

3.1 Information processed through the Microsoft integrations

When a customer enables a Microsoft integration, Treams may process information required to
establish and maintain the connection and to provide the selected functionality.
Depending on the integration, this may include:
• the user's Microsoft account identifier and email address;
• information required to identify or match Microsoft users with Treams users;
• information about Microsoft users involved in a selected Teams conversation where this is
necessary to identify the relevant Treams users;
• the content of a Microsoft Teams message that a user explicitly chooses to save;
• information associated with that selected Teams message that is required to provide the
integration;
• the content of an Outlook email that a user explicitly chooses to save;
• information associated with that selected Outlook email that is required to provide the
integration;
• authentication and authorisation information;
• administration and consent information; and
• technical information required to operate, secure and troubleshoot the integration.

the user's Microsoft account identifier and email address;
information required to identify or match Microsoft users with Treams users;
information about Microsoft users involved in a selected Teams conversation where this is
necessary to identify the relevant Treams users;
the content of a Microsoft Teams message that a user explicitly chooses to save;
information associated with that selected Teams message that is required to provide the
integration;
the content of an Outlook email that a user explicitly chooses to save;
information associated with that selected Outlook email that is required to provide the
information associated with that selected Outlook email that is require
to provide the integration;
authentication and authorisation information;
administration and consent information; and
technical information required to operate, secure and troubleshoot the integration.

Treams does not use the Microsoft integrations to continuously scan or retrieve Microsoft
Teams conversations, Teams chat history or Outlook mailboxes.
Content from Microsoft Teams or Microsoft Outlook is transferred to Treams only when an
authorised user explicitly chooses to save the relevant item using the integration.

3.2 Connecting a Microsoft environment

Before the integrations can be used, an authorised administrator of the customer's Treams
workspace must enable the relevant integration.
Where approval from a Microsoft administrator is required, an authorised Microsoft
administrator is redirected to Microsoft's administrator consent process to grant the
permissions necessary for the integration.
Once the connection has been successfully established, the customer's Microsoft tenant is
associated with the relevant Treams workspace.
This association allows Treams to identify the correct Treams workspace when authorised
requests are received from that Microsoft environment.

3.3 Treams for Microsoft Teams

The Treams integration for Microsoft Teams allows a user to save a selected Microsoft Teams
message as a note in Treams.
When the user selects the Treams action, Treams may use information such as:
• the customer's Microsoft tenant information;
• the user's Microsoft account information; and
• relevant user email addresses or identifiers
to determine the applicable Treams workspace and match relevant Microsoft users with Treams
users. The selected message is transferred to Treams only after the user explicitly chooses to
save it.

Once saved, the content becomes regular customer content within the Treams platform and is
subject to the same access controls, retention periods and other safeguards that apply to other
content within the customer's Treams workspace.
Treams does not continuously retrieve or scan Microsoft Teams conversations or chat history.

3.4 Treams for Microsoft Outlook

The Treams integration for Microsoft Outlook allows a user to save content from the currently
opened Outlook email as a note in Treams.
The integration authenticates the user and identifies the relevant Treams workspace.
When the user explicitly chooses to save an email, the integration accesses the currently opened
item and transfers the information required to create the Treams note.
Treams does not continuously scan the user's mailbox and does not retrieve unrelated emails or
mailbox history

3.5 Microsoft permissions

The integrations use Microsoft authentication and authorisation services and, where necessary,
Microsoft Graph to provide their functionality.
Permissions granted through Microsoft are used only to:
• provide the requested integration functionality;
• authenticate and authorise users;
• secure the integration;
• maintain the integration; and
• provide technical support where necessary.

Treams does not use Microsoft permissions to access Microsoft content for unrelated purposes.
Customers can manage the availability and deployment of the integrations within their
Microsoft environment using Microsoft's administrative functionality.

3.6 Microsoft as a separate service provider

Microsoft Teams, Microsoft Outlook, Microsoft 365, Microsoft Entra ID and related Microsoft
services are provided by Microsoft. Microsoft may process personal data independently when
providing its own products and services. Such processing is governed by Microsoft's applicable
terms and privacy documentation.

4. Why is personal data processed through the Treams platform?

Where Treams acts as a processor, the organisation using Treams determines the purposes for
which employee personal data is processed.

These purposes may include employee and organisational administration, employee
development, goal setting, performance management, feedback, training, certification,
meetings and other HR-related activities supported by the Treams platform.
The organisation using Treams is responsible for determining the appropriate legal basis for
each processing activity.

Where sensitive personal data is processed, the organisation must also determine whether the
additional legal requirements that apply to this type of information have been met.
The commercial agreement between Treams and the organisation does not automatically
provide the legal basis for all processing of employee personal data.

The appropriate legal basis must be determined for each processing activity, taking into account
the purpose of the processing and the relationship between the organisation and the individual
concerned.

5. Personal data Treams processes as a controller

Where Treams determines the purposes and means of processing, we may process the following
categories of personal data.

Purpose: Customer and account administration
Personal data: Name, business contact details, organisation, position, account information and communications
Legal basis: Performance of a contract and/or legitimate interests
information and communications

Purpose: Providing customer support
Personal data: Contact details, support communications, account information and relevant technical information
Legal basis: Performance of a contract and/or legitimate interests

Purpose: Sales and responding to enquiries
Personal data: Name, business contact details, organisation, position and communications
Legal basis: Legitimate interests and, where applicable, consen

Purpose: Marketing
Personal data: Name, contact details, organisation, position and communication preferences
Legal basis: Consent and/or legitimate interests, depending on the communication

Purpose: Billing and financial administration
Personal data: Contact, customer, contractual, invoice and payment information
Legal basis: Performance of a contract and compliance with legal obligations

Purpose: Security and fraud prevention
Personal data: Account information, IP addresses, technical information, access and security logs
Legal basis: Legitimate interests and, where applicable, compliance with legal obligations

Purpose: Development and improvement of our services
Personal data: Technical information, usage information, feedback and other relevant service information
Legal basis: Performance of a contract and/or legitimate interests

Purpose: Compliance with legal obligations and establishment or defence of legal claims
Personal data: Relevant customer, account, communication, transaction and other personal data
Legal basis: Compliance with legal obligations

Where we rely on our legitimate interests, those interests may include operating and securing
our services, providing effective customer support, maintaining and improving our products,
managing our business relationships, promoting our services in a business context, preventing
misuse and protecting our legal and commercial interests.

Where required, we balance these interests against the interests, rights and freedoms of the
individuals concerned.

6. Sensitive personal data

The Treams platform is not intended to require the processing of special categories of personal
data as a standard part of its functionality.
Sensitive personal data includes, for example, information about:
• health;
• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade union membership;
• genetic or biometric information used for identification; or
• a person's sex life or sexual orientation.

However, depending on how an organisation or user uses free-text fields, meeting notes or
similar functionality, users may enter information that is considered sensitive personal data.
Where an organisation uses Treams to process this type of information, that organisation is
responsible for determining whether the processing is permitted under applicable data
protection law and for providing Treams with appropriate instructions.
Users should avoid entering sensitive personal data unless this is necessary, permitted by
applicable law and in accordance with the organisation's policies.

7. AI-supported functionality

Certain Treams features may use artificial intelligence to assist users with activities such as goal
setting, professional development, preparing or structuring conversations, feedback and one-to-
one or evaluation processes.

AI-generated output is intended to provide support and recommendations. It does not replace
human professional or managerial judgement.
Treams' AI functionality is not intended to autonomously make decisions concerning matters
such as an employee's performance rating, salary, promotion, role, allocation of tasks or
termination of employment. Such decisions remain under human control.
Where personal data is processed using AI functionality on behalf of an organisation, that
organisation remains responsible for determining the purpose and legal basis of the relevant
processing. Treams processes the personal data in accordance with the agreed service and the
organisation's instructions.

This reflects the current description of Treams' AI functionality, under which AI output is
advisory and decisions concerning matters such as appraisal, salary, promotion and dismissal
remain with human managers.

8. Automated decision-making

Treams does not make decisions based solely on automated processing that produce legal
effects concerning an individual or otherwise significantly affect that individual.
Where AI or other automated functionality is used to support users, the output is advisory and
relevant decisions remain subject to human judgement and control.

9. Who receives personal data?

We only disclose personal data where this is necessary for the relevant processing purpose, to
provide and secure our services, to comply with legal obligations or where another lawful basis
for the disclosure exists.

Depending on the processing activity, recipients may include:

the organisation that uses the Treams platform and authorised users within that
organisation;
hosting and cloud infrastructure providers;
IT, security and software service providers;
customer support and communication providers;
analytics and service-improvement providers;
CRM, sales and marketing service providers;
financial, accounting and payment service providers;
professional advisers; and
public authorities where disclosure is required by law.

Where a third-party processes personal data on our behalf, we enter into appropriate
contractual arrangements as required by the GDPR.
Where Treams processes personal data on behalf of a customer, we may use subprocessors in
accordance with our agreement with that customer and applicable data protection
requirements, see also https://treams.com/nl/subprocessors.

10. International transfers

Some of our service providers may process personal data in, or access personal data from,
countries outside the European Economic Area.
Where personal data is transferred outside the European Economic Area, we ensure that the
transfer is made in accordance with applicable data protection law.

Depending on the country and recipient, we may rely on:

a decision by the European Commission confirming that the destination country provides an
adequate level of data protection; or
appropriate contractual and organisational safeguards, such as the European Commission's
Standard Contractual Clauses, supplemented by additional safeguards where necessary.

You can contact us using the details below if you would like more information about the
safeguards that apply to a particular international transfer.

11. How long do we retain personal data?

We do not retain personal data for longer than necessary for the purposes for which it is
processed, unless a longer retention period is required or permitted by law.

11.1 Where Treams processes data on behalf of a customer

Where Treams processes personal data on behalf of an organisation, that organisation is
responsible for determining the applicable retention periods.

Treams deletes or returns personal data in accordance with:
• the organisation's instructions;
• the applicable agreement; and
• our agreed deletion procedures.

11.2 Where Treams processes data for its own purposes

Where Treams processes personal data for its own purposes, the applicable retention period
depends on why the information is processed.

When determining a retention period, we consider factors such as:
• the duration of our relationship with you or your organisation;
• how long the information is required for the relevant business purpose;
• applicable statutory retention requirements; and
• the need to establish, exercise or defend legal claims.

11.3 Microsoft integration data

Microsoft Teams messages and Outlook email content that users choose to save become regular
customer content within Treams.

They therefore follow the same retention and deletion rules as other customer content stored
in the applicable Treams workspace.

Information used to associate a Microsoft tenant with a Treams workspace is retained for as
long as it is required to provide the integration.

When the integration is disconnected or the applicable customer relationship ends, this
information is removed when it is no longer required, subject to applicable contractual, legal
and technical retention requirements.

12. Security

We implement appropriate technical and organisational measures designed to protect personal
data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or
access.

The measures applied depend on the nature of the processing, the risks involved and the
available technology and include appropriate access controls, technical security measures and
organisational safeguards.

If you believe that personal data processed through Treams is no longer secure, please contact
us at security@treams.nl.

13. Your privacy rights

Subject to the conditions and limitations of the GDPR, you may have the right to:

obtain access to your personal data;
have inaccurate or incomplete personal data corrected;
request deletion of your personal data;
request restriction of processing;
receive certain personal data in a structured, commonly used and machine-readable format
and have that data transmitted to another controller where the right to data portability
applies;
object to processing based on legitimate interests;
withdraw consent at any time where processing is based on consent, without affecting the
lawfulness of processing before withdrawal; and
where applicable, exercise your rights in relation to automated decision-making.

13.1 When your employer is the controller

If your request concerns employee or other personal data that Treams processes on behalf of
your employer or another organisation, please contact that organisation in the first instance.
As the controller, that organisation is responsible for handling your request. Treams will assist
its customers in responding to data subject requests as required by the GDPR.
You may also contact us at security@treams.nl if you are unsure where to direct your request.

13.2 When Treams is the controller

Where Treams is the controller of your personal data, you may exercise your rights directly by
contacting us at security@treams.nl.

We will respond without undue delay and in principle within one month of receiving your
request. Where permitted by the GDPR, this period may be extended by up to two further
months, taking into account the complexity and number of requests. We will inform you if an
extension is required.

We may request additional information where reasonably necessary to verify your identity.

14. Right to lodge a complaint

If you believe that your personal data is being processed in violation of applicable data
protection law, you have the right to lodge a complaint with a competent supervisory authority.

In the Netherlands, the supervisory authority is the Autoriteit Persoonsgegevens:
https://autoriteitpersoonsgegevens.nl/

We encourage you to contact us first at security@treams.nl so that we have an opportunity to
address your concerns.

15. Children

The Treams platform is primarily intended for use in a professional and organisational context
and is not directed at children.

16. Changes to this Privacy Statement

We may update this Privacy Statement from time to time, for example where our services,
processing activities or applicable legal requirements change.
The latest version will be made available through our website or platform. Where appropriate,
we will inform you separately about material changes.

17. Contact details

Treams B.V.
Scherpakkerweg 17a
5616 HP Eindhoven
The Netherlands
+31 40 744 0888
Email for privacy and security matters: security@treams.nl

‍