Loop Agency (“we”, “us”, or “our”) is committed to protecting and respecting your privacy.
We process Personal Data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), California Consumer Privacy Act (“CCPA“), and applicable data protection laws. That means among other things that:
We are responsible for certain processing of Personal Data, both as Data Controller and Data Processor on behalf of client companies. This Privacy Statement applies to Personal Data we process in our capacity as Data Controller. When we act as Data Processor, the client’s privacy notice governs the use of Personal Data. In this Privacy Statement we explain which Personal Data we process and for what purposes and means. We recommend our customers and visitors to carefully read this Privacy Statement.
This Privacy Statement was last updated in Jan, 2026.
We act solely as data processor on behalf of our customers as the data controller, meaning our customers determine the purposes and means of the data processing and are ultimately responsible for compliance with all applicable laws and regulations for the protection of the Personal Data. Said data processing is necessary to provide our services in accordance with the obligations towards our customers, which obligations serve as the required legal basis pursuant to Article 6 GDPR. Pursuant to Article 30 GDPR, as data processor we have a record of processing activities in place. This record is part of our information security policy and, like other important privacy documents, we ensure the record of processing activities to be regularly evaluated and updated where necessary.
Without prejudice to the existing contractual arrangements with our customers, we will treat all Personal Data in strict confidence and inform employees and sub-processors involved in the processing of our Personal Data about the confidential nature of Personal Data. We ensure that these employees and sub-processors sign an adequate confidentiality agreement and – where applicable – data processing agreement.
In some cases we may collect Personal Data directly from data subjects when they (register to) use our services, post on our blog, contact our support team, and visit our website. In doing so, we may use the Personal Data we have collected from them for purposes related to our services – including but not limited – to:
The types of Personal Data and categories of Data Subjects processed are as follows:
By using our Services, Data Subjects consent to their Personal Data being collected, held and used in this way and for any other use they authorise. We will only use Personal Data for the purposes described in this Privacy Statement or with express permission of a Data Subject. The Companies guarantee that the processing of Personal Data will be solely based on one of the legal grounds set forth in Article 6 GDPR.
The processing of the Personal Data is necessary for the provision of our Services and/or based on individual permission. We also conduct statistical research with Personal Data. In those events we have a legal interest in conducting research in order to improve our Services.
We will store Personal Data that falls under a legal retention obligation in accordance with the duration of this legal retention obligation. For example, we retain Personal Data that forms part of the statutory basic administration for a period of five to seven years after the termination of the relevant commercial agreement. In all other cases we will keep the Personal Data for a maximum period of 1 (one) year after the end of the relevant commercial agreement, unless the Privacy Statement of an affiliated company contains a deviating retention period for that particular affiliated company. We recommend our customers and visitors to carefully read the applicable Privacy Statement(s) as well. When Personal Data is no longer needed, it will be securely deleted or anonymised.
The following Personal Data might be collected from Data Subjects:
We collect Personal Data from and about Data Subjects as follows:
As Data Controller we can engage other parties as Data Processors to perform an aspect or part of our Services to our customers and users; this could be a platform we use for our Services. Where third parties require access to Personal Data in order to support the delivery of our Services, we have implemented appropriate contractual, technical, and organisational safeguards to ensure that such third parties process the Personal Data only for the agreed purposes and in line with our instructions.
Furthermore, we will not provide Personal Data to other parties without permission of Data Subjects, unless this is legally required or permitted. For example, it is possible that investigative authorities request Personal Data from us in the context of fraud investigations. In that case, the Companies are legally obliged to provide this Personal Data.
When we share Personal Data with third parties that are considered separate Data Controllers, each party shall be able to determine the purpose and means of processing the Personal Data held under its control in accordance with its privacy notice. With respect to the separate controllership of each party and without the intention of entering into a joint-controllership as defined in Article 26 GDPR, we shall enter into a partner agreement with such separate Data Controllers, that sets out the framework for the sharing of Personal Data between the parties and defines the principles and procedures that the parties shall adhere to and the responsibilities the parties owe to each other. The shared Personal Data will only be processed as far as is necessary according to the purposes and in order to fulfil the obligations as set out in the partner agreement and the parties guarantee that the processing of Personal Data will be solely based on one of the legal grounds set forth in Article 6 GDPR.
We have implemented the following security measures to protect Personal Data:
In the situation where we are Data Controller for the collection of the Personal Data and therefore directly responsible, a Data Subject can address us in writing for:
This Privacy Statement does not apply to third-party websites that are linked to our website through links. We cannot guarantee that these third parties will handle Personal Data in a reliable or secure manner. We recommend that visitors read the applicable privacy notice before using such third-party website.
We reserve the right to make changes to this Privacy Statement. It is recommended that visitors regularly consult this Privacy Statementso that they are aware of these changes. The date of the latest version will be shown at the top of the Privacy Statement. Significant changes will be communicated to you where required by law.
We use cookies on our websites and in our apps. Any visitor can deactivate cookies for all sites in its browser.
Our services are not directed to children under 16. We do not knowingly collect Personal Data from children. Where required by law, we will obtain parental consent before collecting data from minors.
Where Personal Data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as: adequacy decisions by the European Commission, or Standard Contractual Clauses (SCCs). Consumers’ personal information may be transferred outside of Quebec (for Quebec consumers) or outside of Canada (for non-Quebec consumers). We ensure any transfer of personal information by us which is undergoing processing or is intended for processing after transfer outside of Quebec, or outside of Canada to a third country, shall take place only if, subject to the other provisions of this Privacy Statement, all applicable laws on data protection are complied with.
General Contact Information
Contact details Data Protection Officer
Email: dpo@yepads.com
Mr. Philippe van Wijnen