Last updated: 3 October 2026
Privacy statement
Version 2.0.
Van Oosten Advies B.V. (also trading as Van Oosten Software), Wilgestraat 40, 4431 CH 's-Gravenpolder, the Netherlands, Chamber of Commerce 42077708, VAT NL869603504B01, email info@van-oosten.nl, telephone +31 85 109 1360, is the controller for the processing described in this statement. We have no data protection officer; please send questions about privacy to info@van-oosten.nl.
1. Who this statement applies to
This statement applies to visitors to our website, to (contact persons of) customers, prospects and suppliers, and to employees of customers who contact us for support. It does not apply to the data we process on behalf of our customers in their own IT environment (for example the contents of mailboxes, files and backups of a customer that uses our managed IT services). For that processing the customer is the controller and we are the processor; the arrangements for it are set out in our data processing agreement. Questions about that data should be addressed to the organisation concerned.
2. Which data we process, why, and on what legal basis
| Processing | Data | Purpose | Legal basis |
|---|---|---|---|
| Contact form and email | Name, email address, organisation, subject, message, telephone number if you provide it | Answering your question; preparing a quotation | Performance of a (prospective) contract if you are the customer yourself; otherwise legitimate interest (business contact) |
| Booking an introductory call | Name, email address, chosen time slot, any notes | Scheduling the appointment | Performance of a prospective contract; legitimate interest (Microsoft Bookings, part of Microsoft 365) |
| Booking an introductory call | Name, email address, chosen time slot, any notes | Scheduling the appointment | Performance of a prospective contract; legitimate interest (Microsoft Bookings, part of Microsoft 365) |
| Customer administration and contract management | Name, job title, business contact details of contact persons; company, contract and payment details | Concluding and performing contracts, invoicing, relationship management | Performance of the contract; legitimate interest (contact with business relations); statutory retention obligation for the accounts |
| Support and ticket registration (managed IT and consultancy) | Name and contact details of the person reporting, time, subject, status and time spent on a request | Handling requests, measuring response times, invoicing | Performance of the contract with the customer; legitimate interest. We process the content of requests and attachments as a processor on behalf of the customer |
| Telephony and WhatsApp Business | Telephone number, name, time and duration of calls; content of WhatsApp messages | Availability for customers and support | Performance of the contract; legitimate interest. Calls are not recorded. We and our customers do not share passwords or sensitive data via WhatsApp; after handling, messages are recorded in our ticketing system and deleted from WhatsApp |
| Microsoft partner administration | Company details of the customer; name, email address and telephone number of the person who accepts the Microsoft Customer Agreement on behalf of the customer; subscription details | Registering the customer relationship and subscriptions in the Microsoft Partner Center and with our indirect provider, as the Microsoft partner terms require | Performance of the contract; legal and contractual obligation |
| Security of our own systems | User names and actions of our staff in our management and documentation platforms; security logs | Security, accountability for management actions | Legitimate interest (information security) |
| Website server logs | IP address, time, page requested, browser details | Security and troubleshooting | Legitimate interest |
| Website statistics | Aggregated page views and conversions that cannot be traced to individuals (Vercel Analytics and Speed Insights, without cookies) | Insight into how the website is used | Legitimate interest |
| Error tracking | URL, error message, stack trace, browser version, IP address, only in the event of a technical error (GlitchTip, self-hosted by us in the Netherlands) | Finding and fixing errors | Legitimate interest |
| Campaign parameters (UTM) | Where your visit came from, held only in the memory of the page and linked to your data only if you submit the contact form | Knowing through which channel an enquiry arrives | Legitimate interest |
We do not take decisions based on automated processing and do not engage in profiling.
3. Recipients and processors
We share personal data only with parties we need for the purposes above and with whom we have a data processing agreement, or who are themselves responsible for their processing.
| Recipient | Service | Country and processing location | Safeguard for transfers outside the EEA |
|---|---|---|---|
| Vercel Inc. | Website hosting, Analytics and Speed Insights | United States; processing in the US and the EU | EU-US Data Privacy Framework (Vercel Inc. is certified under it according to its own statement) and the standard contractual clauses of the European Commission |
| Plus Five Five, Inc., trading as Resend | Sending email from the contact form | United States; email is sent from the EU (AWS region Ireland), but account data, email metadata and logs are stored in the US | EU-US Data Privacy Framework (according to its own statement) and standard contractual clauses |
| Upstash, Inc. | Limiting abuse of the contact form (based on a hashed IP address) | United States; database in AWS region Ireland | EU-US Data Privacy Framework (according to its own statement) and standard contractual clauses |
| GlitchTip (self-hosted) | Website error tracking | The Netherlands | Not applicable |
| Microsoft Ireland Operations Ltd. | Microsoft 365 (our own email, calendar and documents), Microsoft Dynamics 365 Business Central (our accounts and invoicing), Microsoft Partner Center | Ireland; processing within the Microsoft EU Data Boundary with the exceptions documented by Microsoft | Microsoft Products and Services Data Protection Addendum; standard contractual clauses |
| Crayon B.V., Amsterdam (indirect provider Microsoft) | Licence administration and invoicing of Microsoft subscriptions | The Netherlands | Not applicable |
| NinjaOne, LLC (US) | Ticketing system, documentation, device management and monitoring, backup for customers that use managed IT services | Processing and storage in the EU (management platform on Amazon Web Services in Germany; backup in AWS data centres in Frankfurt or Dublin); support access possible from the US and the Philippines | EU-US Data Privacy Framework (according to its own statement) and standard contractual clauses |
| Huntress Labs Incorporated | 24/7 automated monitoring of accounts and devices for customers that use managed IT services | United States | EU-US Data Privacy Framework (according to its own statement) and standard contractual clauses |
| CyberDrain B.V. | Management platform for customers' Microsoft 365 environments | The Netherlands; hosting in Microsoft Azure in the EU, Frankfurt region | Not applicable within the EU |
| Proton AG | Password vault (end-to-end encrypted) | Switzerland; storage in Switzerland, Germany and Norway | Adequacy decision of the European Commission for Switzerland |
| WhatsApp Ireland Limited (Meta) | WhatsApp Business app | Ireland; transfer to WhatsApp LLC and Meta Platforms, Inc. in the US | EU-US Data Privacy Framework and the standard contractual clauses of Meta |
| Beltify (Chamber of Commerce 94049475, Groningen; telephony) | Business telephone number and call handling | The Netherlands | Not applicable |
| Accountant, bank, debt collection agency (only for an unpaid invoice), insurer, government authorities | Accounts, payments, debt collection, insurance, legal obligations | The Netherlands | Independently responsible |
For transfers outside the European Economic Area we rely on an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for organisations certified under it and the decision for Switzerland) or on the standard contractual clauses of the European Commission, with supplementary measures where necessary. If a safeguard lapses, we switch to another safeguard or stop the transfer. We provide an up-to-date overview of our processors on request; managed IT customers find it in the data processing agreement and the customer portal.
4. Retention periods
| Data | Retention period |
|---|---|
| Messages via the contact form and email without follow-up | At most 2 years after the last contact |
| Quotations without an assignment | 2 years after the date of the quotation |
| Contracts, invoices and the accounts | 7 years after the end of the financial year (statutory tax retention obligation) |
| Ticket registration (metadata) of customers | Term of the contract plus 2 years |
| Content of tickets and attachments of managed IT customers | In accordance with the data processing agreement: deleted after the exit period (active copies within 30 days, backup copies within 90 days) |
| WhatsApp messages | Deleted after being recorded in the ticketing system, at the latest 90 days after the last message |
| Data in the Microsoft partner administration | For as long as the customer purchases Microsoft subscriptions through us, plus the period required by Microsoft and the statutory tax retention obligation |
| Security logs of our own systems | At most 12 months, unless needed longer for an incident investigation |
| Website server logs | At most 30 days |
| Error tracking (GlitchTip) | At most 90 days |
| Campaign parameters | Only in the memory of the page; they disappear when you refresh or close it |
5. Security
We protect personal data with measures including multi-factor authentication on all our accounts, separate administrator accounts, encrypted storage of access credentials in a password vault, encrypted and centrally managed workstations, logging of management actions and suppliers with a demonstrable level of security (ISO 27001 or SOC 2). Our security measures for managed IT customers are set out in the data processing agreement.
6. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest. You can withdraw consent at any time. Send your request to info@van-oosten.nl; we respond within one month. We may ask you to identify yourself. If you disagree with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) or, if you live or are established in Belgium, with the Belgian Data Protection Authority, the Gegevensbeschermingsautoriteit (gegevensbeschermingsautoriteit.be).
7. Changes
We may amend this statement. The current version is always on this page with the date of the last change. In the event of material changes we inform customers by email.
See also: cookie statement, terms and conditions, disclaimer.