Privacy Statement

Aurum Advies, trade name of Private Holding B.V., established at Gildeweg 18, 3771 NB Barneveld, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 77920228, is the controller for the processing of personal data as described in this privacy statement.

Aurum Advies provides business services in the field of process optimisation and IT and AI integration. We handle personal data with care and do not process more data than is necessary for our services.

1. Contact details

• Address: Gildeweg 18, 3771 NB Barneveld, the Netherlands
• Website: https://aurumadvies.com/en
• E-mail: info@aurumadvies.com

For questions about this privacy statement or about the processing of your personal data, you can contact us at info@aurumadvies.com.

2. Which personal data we process

We process personal data that you provide to us or that we receive in the course of our services. Depending on the situation, this concerns:

• Contact and identification data: first and last name, job title, company name, business e-mail address and telephone number.
• Address data: visiting and/or billing address.
• Administrative and financial data: invoicing details, bank account number (IBAN) and VAT number.
• Correspondence: the content of e-mail, messages and other communication you have with us.
• Project and assignment data: data required to carry out an assignment, insofar as it contains personal data.
• Account and login data: if you use an account on a portal managed by us.
• Technical and usage data: IP address, browser and device data, and data about your use of our website.

3. Purposes and legal bases

We process your personal data solely for the purposes set out below, in each case on the legal basis indicated under the GDPR:

• Performing the agreement and delivering our services — legal basis: performance of the agreement
• Maintaining contact and communicating about the assignment — legal basis: performance of the agreement
• Preparing and handling quotations, invoices and payments — legal basis: performance of the agreement and legal obligation
• Keeping our administration and complying with tax and other legal obligations — legal basis: legal obligation
• Managing and improving our website and securing our systems — legal basis: legitimate interest
• Relationship management and answering questions via our website or e-mail — legal basis: legitimate interest
• Website analytics and sending any newsletters or commercial messages — legal basis: consent

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Our services are aimed at business clients and are not directed at children. In principle, we do not process special categories of personal data (such as data on health, religion or political views).

4. Retention periods

We retain personal data for as long as is necessary for our services and the purposes set out below, and for as long as is legally permitted. We apply the following principles:

• Administrative and financial data (invoices, payment details): at least 7 years, based on the statutory tax retention obligation
• Project, assignment and client data (including data in our project and business systems): for the duration of the relationship and thereafter for as long as is necessary for managing current and earlier assignments, for follow-up services, and for bringing or defending against legal claims, up to the end of the applicable statutory limitation period at the latest
• Contact and relationship data: for the duration of the relationship and thereafter for relationship management, until you request erasure
• Account and login data: for the duration of the account
• Technical and website analytics data: a maximum of 26 months
• Data processed on the basis of consent (e.g. newsletter): until you withdraw your consent

At your request, we will erase your personal data, unless we are still required to retain it on the basis of a legal obligation or a legitimate interest. Data we no longer need is erased or anonymised.

5. Sharing with third parties and processors

We only provide your personal data to third parties where this is necessary for the performance of the agreement or to comply with a legal obligation. With parties that process personal data on our behalf (processors), we conclude a data processing agreement to ensure an equivalent level of security and confidentiality. Aurum Advies remains responsible for these processing activities.

We make use of, among others, the following processors:

• Hetzner Online GmbH — hosting and server infrastructure
• Microsoft — e-mail and office software (Microsoft 365)
• Cloudflare — website security and network services
• Anthropic PBC (Claude) — AI support for text and data processing
• Google Ireland Limited — website statistics (Google Analytics) and tag management (Google Tag Manager)
• PostHog Inc. — website analytics and session recordings
• Accounting and invoicing software — administration and invoicing

A current overview of the processors we engage is available on request. We do not sell your personal data to third parties.

6. Transfers outside the EEA

In principle, your personal data is processed within the European Economic Area (EEA). Insofar as a processor processes data outside the EEA, we ensure appropriate safeguards in accordance with the GDPR, such as an adequacy decision of the European Commission or the Standard Contractual Clauses.

7. Cookies and website analytics

Our website uses necessary and functional cookies that are required for the technical operation and usability of the website. These are placed without consent.

In addition, we may place analytics cookies to measure and improve the use of our website. Insofar as an analytics tool such as Google Analytics is used that is not fully configured in a privacy-friendly manner, we place these cookies only after you have given consent via the cookie notice. You can adjust your cookie preferences at any time via your browser settings or via the cookie notice on our website.

8. Automated decision-making

Aurum Advies does not make decisions based solely on automated processing that could have (significant) consequences for you.

9. Your rights

Under the GDPR, you have the following rights regarding your personal data:

• the right of access to the personal data we process about you;
• the right to rectification of inaccurate or incomplete data;
• the right to erasure of your data ("right to be forgotten");
• the right to restriction of processing;
• the right to object to processing;
• the right to data portability;
• the right to withdraw consent you have given.

You can send a request to exercise these rights to info@aurumadvies.com. To verify your identity, we may ask you to substantiate it in a way that requires as little data as possible. We will respond to your request as soon as possible, but no later than within four weeks.

You also have the right to lodge a complaint with the national supervisory authority, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), via https://autoriteitpersoonsgegevens.nl.

10. Security

Aurum Advies takes the protection of your data seriously and applies appropriate technical and organisational measures to prevent misuse, loss, unauthorised access, unwanted disclosure and unauthorised modification. These include access security with personal accounts and two-factor authentication, encrypted connections, secure server infrastructure and regular updates. If you have the impression that your data is not properly secured or there are indications of misuse, please contact us at info@aurumadvies.com.

11. Changes to this privacy statement

We may amend this privacy statement from time to time, for example in the event of changes to our services or to laws and regulations. The most recent version is always available on our website. This version was last updated on 13 October 2026.