Privacy policy
Alleo Privacy Policy
Version: 4.0
Effective Date: 1st of March 2026
Introduction
At Alleo, we value your privacy. In this privacy statement, we explain what personal data we collect, for what purposes, on what legal grounds, and how we handle it.
Who are we?
We are Alleo B.V., located at Omval 300, 1096 HP Amsterdam (“Alleo”). Alleo is the data controller for the processing activities described in this privacy statement.
If you have questions about the processing of your personal data, or if you want to make a deletion request, you can send an email to privacy@alleo.nl.
The Alleo platform
Alleo offers, among other things, a platform where users can view and purchase discounts and offers from partners after creating a personal account. These offers are provided by partners; Alleo facilitates the platform and the purchase process. Alleo also offers products and services directly through the platform that a user can purchase directly from Alleo, such as vouchers. To provide, manage, and secure the platform for these purposes, Alleo processes personal data of users as data controller.
This privacy statement does not apply to the personal data that Alleo processes in the context of the platform through which employees can flexibilise their employment benefits. Alleo carries out those processing activities as a processor on behalf of the employer (the data controller). The privacy policy of the relevant employer applies to those processing activities.
What personal data do we process?
Alleo may process the following personal data about you:
Your contact details (name, email address, and/or phone number) if you sign up for the Alleo newsletter on our website, request a demo of our platform, or fill out our contact form. We may also process your contact details if you share them with us at an event;
Account data if you use the discount platform (see above), including your name and login credentials;
Your name, email address, and (optionally) payment information if you choose a benefit offered directly by Alleo through the platform, such as a voucher for a specific product or service;
Your personal data (as listed on your CV), cover letter, educational background, and information about your work experience if you apply to us.
For what purposes do we process personal data?
We process personal data for the following purposes:
Answering questions submitted via contact forms. We process your data in this case on the basis of our legitimate interest;
Sending commercial information about our services (marketing). We process your data in this case based on the consent you have provided;
Offering and managing the Alleo discount platform, including the creation and management of user accounts, displaying offers, and facilitating purchases from partners. This processing is necessary for the performance of the agreement between you and Alleo;
Delivering vouchers or other benefits that we offer directly via our platform, and processing payments to redeem the benefit. We process your data in this case to fulfill an agreement;
Assessing applicants for suitability for a position at Alleo. We process your data in this case based on our legitimate interest in processing applications, and (optionally) based on your consent if you agree to allow us to retain your data longer after the process; and
Ensuring the security, availability, and proper functioning of our website and systems, based on our legitimate interest.
For processing activities based on legitimate interest, we have conducted a balancing test in which we have weighed our interest against your privacy interest. Where necessary, we take additional safeguards to protect your privacy.
Where and how long do we process your personal data?
All your personal data is processed within the EU, more specifically in the Netherlands and Ireland. We do not retain your data longer than necessary, and per category:
Contact details: Maximum 1 year after the last contact moment;
Data for delivering and paying for a benefit from us: 7 years to comply with our administrative obligations;
Application data: Maximum 4 weeks after the end of the application procedure, unless you give consent to retain these longer (for example, for future vacancies); and
Technical log and security data: maximum 6 months, unless a longer retention period is necessary for security or incident investigations.
What processors do we use?
We use the services of third parties (processors) that process personal data on our behalf, such as:
A cloud hosting provider to host and remotely provide the personal data we process. That hosting provider is Amazon Web Services (AWS), and they are a processor on our behalf. The servers of AWS where your personal data is stored are located within the EU (Ireland or the Netherlands);
A service provider for email communication;
A CRM platform provider for storing your contact details;
A service provider for processing payments made via our platform.
When you purchase an offer from a Partner via the discount platform, Alleo shares the personal data necessary for the execution of that purchase with the relevant Partner. That Partner is an independent data controller for the further processing of your personal data.
What are your rights?
You always have the right to:
Access your data;
Rectification, portability, or deletion of your data;
Restriction or objection to the use of your data;
Withdrawal of consent if you have given it.
Feel free to email us at privacy@alleo.nl if you wish to exercise your rights. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) if you disagree with the way we process your personal data.
In conclusion
We take appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or alteration. Alleo holds an ISO 27001 certification, which means we operate in accordance with internationally recognized standards for information security.
We may adjust this privacy statement, for example, if something changes in the law or how we work. In the event of an adjustment, we will place a new version of the privacy statement on the website and update the document date. Check our website occasionally to see if anything has changed.
