Privacy statement
This English text is a translation for your convenience. The Dutch version is legally binding.
Last updated on 14 November 2026.
What you enter in the app is stored encrypted on your own device. We cannot read it. Below is exactly which data we do process, why and for how long.
Who we are
Scotis is a trade name of J.W.J. Bussers (sole proprietorship), registered with the Dutch Chamber of Commerce (KvK) under number 42206476, VAT ID NL003395727B29, based in Delft. We are responsible for the processing described in this statement. Send questions or requests to [email protected].
Your financial data
- Everything you enter or import in the app (amounts, accounts, transactions, investments, pension) is stored on your own device. It is encrypted with AES-256, a strong and widely used encryption standard, using a key derived from your password.
- If you use sync, we store an encrypted copy. We cannot open it, because only your devices have the key.
- For a few Pro features, our server receives limited data: which investments your app requests prices for and, for push notifications, the name of the position and your price threshold. We never receive amounts or quantities. See the table below.
- Scotis does not use a bank connection and never asks for the login details of your bank or broker.
- Because we do not know your password, we cannot recover it either. When you first set up the app, it creates a recovery code on your device. With it, you choose a new password yourself. That code never reaches us.
- After three incorrect attempts (password or recovery code), you have to wait a moment. The waiting time gets longer with each subsequent error. This makes guessing harder.
Which data we process
| What | Why | Legal basis | How long |
|---|---|---|---|
| Founding list: your email address and the time you signed up and confirmed | Keeping you informed about the founding offer and news about Scotis Pro | Consent | If you do not confirm your sign-up, we delete your email address after 7 days. After confirmation, we keep it until you unsubscribe. |
| Jaarruimte reminder: your email address, the language of the page and the time you signed up and confirmed | Reminding you once by email of the 31 December 2026 deadline for your jaarruimte | Consent | If you do not confirm your sign-up, we delete your email address after 7 days. After confirmation we delete it as soon as the reminder has been sent, and on 7 January 2027 at the latest. |
| Sync (Pro): an encrypted file with a version number and timestamp, and 7 daily encrypted copies | Keeping your data in step between your own devices and with your partner | Contract | Until you choose Stop sync and delete in the app, or ask us to delete your account. |
| Pro account: email address, password stored in encrypted form (hash), licence, payment status and the device on which you are logged in | Providing your subscription and preventing misuse | Contract | For as long as your subscription runs. After that, we keep only what the law requires for our accounts, for up to 7 years. |
| Prices via Scotis: the name, ISIN (the unique code of a share or fund) or coin symbol of an investment your app requests, a hashed form of the IP address to limit the number of requests per day, and with Pro the number of requests per licence | Providing prices, logos and company figures without you needing your own price key, and preventing misuse | Contract | We keep prices per ISIN or coin for at most one day, separately from who requested them. The counters expire after two days. |
| Push notifications (Pro, only if you turn them on): the address at which your browser receives notifications and, per notification, the ISIN or coin, your price threshold and the name of the position | Sending you an alert when a price threshold is reached, on a large daily move or on an ex-dividend date, even when the app is closed | Contract | Until you turn off notifications. If you do not use them for 90 days, they expire automatically. |
| Visitor count: one ping per browser per day, containing only "new or returning" and the type of source (for example Instagram or a search engine) | Knowing how many people use the site and the app, and through which channel | Legitimate interest | We keep the daily counts for 13 months. |
| Partner link (scotis.nl/?ref=name): the name of the link in your own browser and, per link, a count of clicks and new subscriptions | Seeing which partnerships bring in new users | Legitimate interest | The name stays in your browser for 60 days. We keep the counts for as long as the partnership runs. |
| Instagram giveaway: your Instagram name if you take part | Drawing lots, sending the winners a message and naming the winners in our story | Contract (the giveaway terms) | Until 3 months after the draw. |
| Login codes by email | Logging in securely on a new device | Contract | The code expires after 10 minutes. |
| Technical data when you visit the site (IP address, browser) | Keeping the website secure and available | Legitimate interest | We do not store this data ourselves. Our hosting provider Cloudflare processes it briefly to detect attacks. |
For the visitor count and the partner link, we use no cookies, no identifier and no IP address.
The legal basis is the legal reason on which we are allowed to process data. Consent: you chose it yourself. Contract: it is necessary to provide what you purchase from us. Legitimate interest: we have a good reason and keep the consequences for you as small as possible; you may object to this.
Parties we use
- Cloudflare (United States): hosting of the website and the server, storage of the founding list and the encrypted sync files (in the EU), and visitor statistics without cookies.
- Resend (United States): sending confirmation and login emails.
- Paddle (United Kingdom): payment for Pro. Paddle is officially the seller (Merchant of Record) and processes your payment details in accordance with Paddle's own privacy statement. We do not see any card or account numbers.
- Eulerpool (Singapore): our supplier of prices, crypto prices, exchange rates (the European Central Bank’s reference rates), logos and company figures. Our server fetches this data; Eulerpool only sees the ISINs and coin symbols our server requests, never who requests them or what you own.
- SEC (United States, the US securities regulator): when you view a US company, your app fetches its official annual and quarterly reports there. Like any website, the SEC sees your device’s IP address and which company you request, but nothing of your data.
- Your browser’s push services (such as those of Apple, Google or Mozilla): deliver an empty notification to your device. Your app then retrieves the text from our server itself.
For the United Kingdom, the European Commission has decided that the protection of personal data there is adequate. With the US parties, the European Commission’s standard contractual clauses apply, or they fall under the EU-US Data Privacy Framework. To Eulerpool in Singapore we only send ISINs and coin symbols, no personal data.
No AI on your data
Scotis does not use artificial intelligence (AI) to analyse your financial data or to make decisions about you. Transactions are categorised with fixed rules, on your own device. We do not use your data to train AI models. Your financial data is also encrypted, so the parties we work with cannot read it either.
No advertising tracking
The website and the app use no tracking cookies, no advertising networks and no analytics tools that follow you across other websites. In your browser, we only store whether you have visited the site before (for the visitor count) and, if you came via a partner link, the name of that link. We never sell data.
Which law applies
The processing of your personal data is governed by the General Data Protection Regulation (GDPR, in Dutch: AVG). Scotis is the data controller: we decide why and how the data in this statement is processed.
We do not make decisions about you that are based solely on automated processing. You are not obliged to give us data: the free app works without an account. For a Pro account, we do need your email address.
Your rights
Under the GDPR, you have these rights:
- Access: you may ask which data we hold about you.
- Rectification: if the data is incorrect, we correct it.
- Erasure: you may ask us to delete your data, including your Pro account.
- Restriction: you may ask us to temporarily suspend the use of your data.
- Portability: you may receive your data in a commonly used file format. You export your data in the app yourself via Settings.
- Objection: you may object to processing based on legitimate interest.
- Withdrawing consent: you can withdraw your consent for the founding list at any time by emailing us.
Send a request to [email protected]. We respond within one month. If you do not agree with how we handle your data, you can lodge a complaint with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority).
Security
Data is sent encrypted (https) and stored encrypted. We only store passwords as a hash: an encrypted form from which the password cannot be retrieved. If we discover a data breach that affects you, we report it as required by law.
Changes
If we change this statement, we will post the new version here with the date at the top. We will tell you about important changes at least 30 days in advance, by email or in the app.