Privacy Policy

Last updated: July 2026

Who we are

This website and our services are provided by Aurivian B.V., registered with the Dutch Chamber of Commerce under number 96750715 (VAT number NL867746257B01). For privacy questions, reach us at info@aurivian.nl or +31 (0)85 369 74 74. We have not appointed a Data Protection Officer; info@aurivian.nl is your point of contact.

Two roles

• As data controller we determine ourselves how we process data of website visitors, of people who contact us and of our clients (contact person, invoicing and, in the future, a CRM). This policy is about that.
• As data processor we process, on behalf of our clients, the data they place in the systems we manage (files, email and their employees' data). For that we conclude a data processing agreement with each client; the client is then the controller. That data does not fall under this privacy policy.

What data we collect

• Contact form: your name, email address, optionally your company name and your message. We ask for nothing more.
• Server logs: technical data such as IP address, timestamp and the page requested, for security and the correct functioning of the site.
• Client and invoicing data: the contact and invoicing details needed for the agreement and our administration.
• (Soon) CRM: for relationship management we may record contact details and the history of our contact. We will update this policy once that goes live.

Cookieless analytics

We measure site usage with Umami, a privacy-friendly, cookieless analytics tool that runs on our own infrastructure. Umami stores no IP addresses and builds no personal profiles; you are not tracked across other sites. So no tracking or advertising cookies are placed. The only local preference we store is your choice of a light or dark theme; it stays on your own device and is not personal data.

Purpose and legal basis

• Contact form: to respond to your message; basis: (pre-)contract and legitimate interest.
• Client and invoicing data: performance of the agreement and legal (tax) obligation.
• Server logs and security: legitimate interest (safety and continuity).
• Cookieless analytics: legitimate interest (improving the site), without us being able to identify you.

How long we keep it

• Contact messages: up to 12 months after handling; for an ongoing engagement, for its duration. Earlier deletion is always possible on request.
• Invoices and administration: 7 years (statutory tax retention obligation).
• Client data: for the duration of the agreement and afterwards only what is legally required.
• Server logs: a maximum of 4 weeks, unless longer is needed in connection with a security incident.

Who we share it with

We never sell your data and do not share it for marketing. For the core of this site we use the following services:

• Hosting party: this website and your contact message run on our own environment at OVHcloud (EU).
• Email: to respond to your message we use our own email facility.
• No external analytics, advertising or profiling parties.

The site also contains a booking function at afspraak.aurivian.nl and a chat function at assist.aurivian.nl. Information you enter there, and the technical data needed to operate those functions, are processed by those functions. Do not send confidential client content through them unless it is needed for your enquiry.

For the systems we manage on behalf of clients, separate sub-processors apply as named in the data processing agreement, such as the client's chosen EU server provider (Hetzner or OVHcloud) and, for telephony, the telecom provider.

Location and external processing

The Aurivian-managed website, contact messages and standard workplace can run on EU infrastructure. For the workplace, a client chooses between its own hardware and an EU server for the organisation. The Smart AI assistant can run shielded on Aurivian hardware in Europe; other AI arrangements can use a private EU environment or a device on site.

Aurivian cannot determine every data route completely. Email delivery, DNS and other ordinary internet services follow their own technical routes. An automation may use an external AI model where agreed in advance; in that case we record which data may be sent to that service for the process. Processing locations and service providers that apply to a client are recorded in the arrangements for that service.

Security

The connection to this site is encrypted (HTTPS/TLS). For client environments, access control, security measures, and backup and recovery arrangements are recorded for each environment. We do not train AI on your data. For an external AI service, the agreed data flow for that process applies. In the unlikely event of a security incident (data breach) we act in accordance with the statutory notification obligations and inform those affected in good time.

Your rights (GDPR)

You have the right to access, rectification, erasure, restriction, objection and portability of your data, and to withdraw consent given. There is no automated decision-making with legal effect. Send your request to info@aurivian.nl; we respond within a week. If you disagree with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or with the data protection authority in your own EU country.

Cookies

This site uses no tracking or advertising cookies. See our Cookie Statement for the details.

Changes

We may update this privacy policy from time to time. The current version is always on this page.