Privacy statement

This statement describes how Van Croonenburg IT-Consultancy B.V. handles personal data on this website and in the AureaDesk service.

Who is responsible?

Van Croonenburg IT-Consultancy B.V., trading as AureaDesk, Oude Apeldoornseweg 45 – 067, 7333 NR Apeldoorn, the Netherlands, registered with the Dutch Chamber of Commerce under number 99307596, VAT number NL868926243B01. You can raise privacy questions at servicedesk@aureadesk.com, by post at this address, or on +31 85 203 3506.

The point of contact for privacy questions is the management, which you can reach at servicedesk@aureadesk.com.

Data you leave on this website yourself

If you complete the demo form, we process the details you enter: your name, organisation, email address, optionally your phone number, your chosen package, your preferred demo format, the explanation you send along, and the optional choices about your TOPdesk environment: the number of additional users, for Enterprise the number of additional TOPdesk environments and the server choice, an estimate of the size (number of cards and assets) and whether you archive automatically. On the contact page also whether you want to add Reservations Management or Operations Management. You can also tell us how you found AureaDesk. Your name, organisation and email address are needed so we can respond to your request; without those three we cannot get in touch. The other fields are optional. Providing this data is not a legal obligation.

• Purpose: to contact you about your request, to send you access to the demo environment or schedule a demo, and to make you a suitable proposal if you ask for one. We use your answer to the question how you found AureaDesk only to see through which channels requests reach us. Your request arrives as an email in our mailbox; we do not store it in a separate system.
• Legal basis: handling your request, including sending you the access details for the demo environment and one or two follow-up messages about that same request: taking steps at your request prior to a possible agreement (Article 6(1)(b) GDPR). For your answer to the question how you found AureaDesk, the legal basis is our legitimate interest in knowing through which channels requests reach us (Article 6(1)(f) GDPR); the question is optional, and we keep the answer with the request. If you do not become a customer, we then keep the request and our replies for up to twelve more months on the basis of our legitimate interest (Article 6(1)(f) GDPR): this lets us retrieve what was discussed if you contact us again later, and handle questions or disputes about the request. We send you commercial messages only if you gave consent for that when submitting your request (Article 11.7 of the Dutch Telecommunications Act (Telecommunicatiewet)); every message explains how to unsubscribe, and unsubscribing is always free of charge. You can object to the retention based on our legitimate interest, see Your rights.
• Consent to news and offers: only if you tick the box for it in the form, we occasionally send you news and offers about AureaDesk by email (legal basis: your consent, Article 6(1)(a) GDPR). We keep your request with your choice as proof of that consent for as long as the consent stands, also after the twelve-month period. You can withdraw the consent at any time via the unsubscribe option in every message or via servicedesk@aureadesk.com; we then stop immediately.
• Retention: up to twelve months after the last contact about your request, unless a customer relationship arises. In that case the retention periods under Customer administration and licenses apply. If you ask for erasure earlier, we erase the request, unless we still need it to handle a pending question or dispute.

Consent to news and offers given earlier via the pop-up. Until 1 October 2026 you could also sign up on this website for news and offers about AureaDesk via a pop-up, with a discount code for a first subscription. That pop-up has been removed; signing up is now only possible via the box in the demo form above. If you signed up via the pop-up, your consent remains valid until you withdraw it.

• Purpose: to occasionally send you news and offers about AureaDesk by email, for as long as your consent stands. A discount code you received via the pop-up remains valid under the conditions stated in that message.
• Legal basis: your consent (Article 6(1)(a) GDPR and Article 11.7 of the Dutch Telecommunications Act (Telecommunicatiewet)).
• What we recorded: when you signed up, a message went to our mailbox with your email address, the language of the page, the time and the version of the text you agreed to. That message is our proof of your consent. The web server kept nothing of your sign-up.
• Retention: we keep the proof of your consent for as long as the consent stands and for twelve months after that, so that we can show we were allowed to send you the earlier messages. If you unsubscribe, we stop immediately and keep only your email address on our unsubscribe list, for as long as we send news, so that we do not approach you again (legitimate interest, Article 6(1)(f) GDPR).
• Unsubscribing: every message explains how to unsubscribe; you can also reply with "unsubscribe" or email servicedesk@aureadesk.com. Unsubscribing is free of charge.

Support and contact

If you email or call us, or use the Contact service desk or Suggest an improvement button in your AureaDesk environment, we process your name, your email address or phone number, the name of your organization and of your environment, and the content of your message, including any screenshots you attach to an email.

• Purpose: to handle your question or disruption, to be able to retrieve what was agreed and to improve our service.
• Legal basis: our legitimate interest and that of your organization in performing the agreement and in answering questions put to us (Article 6(1)(f) GDPR). If you are our contracting party yourself, the legal basis is the performance of the agreement (Article 6(1)(b) GDPR).
• Retention: up to two years after your question has been handled, so that we can see what was discussed earlier if you come back with a follow-up question; correspondence that belongs to an agreement, an invoice or a dispute is kept for seven years. We do not record phone calls.
• Where: in our mailboxes at Mijndomein (the Netherlands, EU). A message sent via the button in your environment goes through TransIP's mail server (the Netherlands, EU).

Please do not include personal data of callers or colleagues that we do not need in a support request; an incident number is usually enough.

Job applications

If you apply for a vacancy, we process your name, contact details, CV, motivation and anything else you send us.

• Purpose: solely for recruitment and selection for the vacancy you respond to. We do not share your data with third parties and contact references only after consulting you.
• Legal basis: steps prior to entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest in a careful selection (Article 6(1)(f) GDPR).
• Retention: if the application does not lead to a working relationship, we delete your data no later than four weeks after the end of the procedure. If you would like us to keep your data for a future vacancy, we ask for your consent and keep it for no more than one year. If a working relationship does follow, your data is transferred to the personnel or engagement file.
• Where: in our mailboxes at Mijndomein (Netherlands, EU).

Data recorded automatically

The web server of this website records technical data needed to deliver and protect the site: the IP address, the requested address, the timestamp, the status code and the browser type. We keep these log files for a maximum of thirty days and use them only for troubleshooting and abuse prevention. In addition, we keep track of how many demo form requests have come in from a particular IP address in the past hour, to slow down misuse. For that the web server keeps per IP address only a derived code (a hash) and the times, never the address itself; this is cleaned up automatically after at most one hour.

The same applies to the server that hosts our admin panel, our license server, the demo environment and the status page: we keep an access log with IP address, timestamp, requested address and status code for a maximum of thirty days, and an IP address from which sign-in repeatedly fails or that overloads the server is temporarily blocked (one hour, increasing on repetition to at most one day; the list of blocks is cleared after one day). That same server also hosts the AureaDesk environments of our customers; we keep their access log in the same way and for the same period, on behalf of the customer concerned, who is the controller for it (see Data inside AureaDesk itself).

The legal basis is our legitimate interest in a working and secure website and service (Article 6(1)(f) GDPR).

Cookies and tracking

With your consent we use Google Analytics for visit statistics, and Google Ads and the LinkedIn Insight Tag to see which ads lead to a request. This concerns data such as the pages you visit, the sending of a request (not its content), the type of device and your approximate region. In the cookie notice you choose "Accept", "Statistics only" or "Decline" (on the German pages "Akzeptieren", "Nur Statistiken" or "Ablehnen", on the French pages "Accepter", "Statistiques uniquement" or "Refuser"). Without consent, nothing from Google or LinkedIn is loaded and nothing is measured. Ad personalization is off, whatever you choose; as long as you have not consented to ad measurement, ad click data is redacted before it reaches Google.

For Google Analytics, Google Ireland Limited works on our behalf as a processor; for Google Ads, Google determines itself how it processes the data and is an independent controller. In Google Analytics we have set the retention of measurement data to 14 months after your last visit, disabled data sharing with other Google services and switched off the so-called Google signals; for Google Ads, Google’s retention policy applies. The data may be transferred to the United States. This is done on the basis of the European Commission’s adequacy decision for the EU-US Data Privacy Framework (Article 45 GDPR), under which Google LLC is certified (see dataprivacyframework.gov), with the European Commission’s standard contractual clauses as an additional safeguard. You can read more about Google’s transfer frameworks at policies.google.com/privacy/frameworks; a copy of the standard contractual clauses is available on request via servicedesk@aureadesk.com. The legal basis is your consent (Article 6(1)(a) GDPR).

We load the LinkedIn Insight Tag only if you choose "Accept" in the cookie notice. For it, LinkedIn Ireland Unlimited Company (Ireland) determines itself how it processes the data and is an independent controller. LinkedIn then receives your IP address, the page visited, the sending of a request (not its content) and characteristics of your browser, and links this to your LinkedIn profile if you are logged in there. We only see totals: which ad led to a request and which industries and job functions our visitors come from, never who someone is. LinkedIn removes direct identifiers within seven days and deletes the remaining data within 180 days. This data may also be transferred to the United States: on the basis of the adequacy decision for the EU-US Data Privacy Framework insofar as LinkedIn is certified under it, and otherwise on the basis of the European Commission’s standard contractual clauses; see LinkedIn’s privacy policy at linkedin.com/legal/privacy-policy. The legal basis is your consent (Article 6(1)(a) GDPR).

This is what is placed on your device:

• aureadesk-toestemming (your browser's local storage, placed by us): your choice, the date you made it and the version of the text you agreed to. Not a cookie, not sent to any server; needed to remember your choice. We ask again after twelve months.
• _ga and _ga_G-Y8JGD9LK7N (Google Analytics cookies, only with "Statistics only" or "Accept"): a random visitor number to keep page views from the same browser together. At most 13 months.
• _gcl_au and, after a click on an ad, _gcl_aw and _gcl_gs (Google Ads cookies, only with "Accept"): to link a request to the ad that preceded it. At most 90 days.
• li_fat_id (LinkedIn cookie, only with "Accept"): to link a request to the LinkedIn ad that preceded it. At most 30 days. On its own domain, LinkedIn additionally places cookies under its cookie policy (linkedin.com/legal/cookie-policy).

Use Cookie preference (on the German pages "Cookie-Einstellungen", on the French pages "Préférences cookies") at the bottom of every page to change your choice or withdraw your consent; that is as easy as giving consent. If you choose "Decline" after previously choosing "Accept" or "Statistics only", we remove the Google and LinkedIn cookies already placed and measurement stops. If you choose "Statistics only" after previously choosing "Accept", we remove the advertising cookies. Anything measured before the withdrawal remains lawfully processed.

Data inside AureaDesk itself

If you use AureaDesk as a customer, we process data from your TOPdesk environment inside your environment. That includes personal data of callers and operators, such as names and the incidents they are linked to. In addition, AureaDesk records data of its own in your environment: the accounts of your users (name, email address, hashed password, role) and an audit log of who did what and when in the dashboard, with IP address and with the incident opened in the detail window.

• AureaDesk also builds up a limited history that TOPdesk does not return: which operator group was in charge and when, the status progression with the name of the operator, and changes of job title and department. Exactly what is kept and for how long is set out in the data processing agreement with your organization; your own administrator can view, correct or erase it.
• For all of that data you are the controller and we are the processor. We record this in a data processing agreement, which describes precisely what AureaDesk records, for how long and with which security measures. That agreement is available in advance on request via sales@aureadesk.com.
• Your environment runs as a separate installation with its own encrypted database, kept apart from other customers.
• If you are a user of an AureaDesk environment and have questions about your data in it, your own organization is your point of contact; see Your rights.

Demo environment. The demo environment at demo.aureadesk.com contains fictitious sample data only and is not connected to any TOPdesk environment. If you are given access to the demo environment, the audit log of that environment records when the demo account signed in and what was done with it, with IP address; we keep those entries for at most thirty days. We keep the time and IP address of the most recent sign-ins with the demo account for ninety days. Apart from that, only the technical data under Data recorded automatically applies. For the demo environment we are the controller ourselves; the legal basis is our legitimate interest in a secure demo environment (Article 6(1)(f) GDPR).

Customer administration and licenses

If you are a contact person at an organization that subscribes to AureaDesk, we process your name, job title, business email address and phone number, the details of your organization and the arrangements in the agreement. In our license server we record per customer which license was issued, when it started and expires, which installation it is linked to, and who on our side changed what and when.

• Purpose: performing the agreement (onboarding, support, license management, invoicing) and complying with our statutory record-keeping obligation.
• Legal basis: our legitimate interest and that of your organization in performing the agreement (Article 6(1)(f) GDPR), a legal obligation for invoices and records (Article 6(1)(c) GDPR, tax retention obligation) and, if you are our contracting party yourself, the performance of the agreement (Article 6(1)(b) GDPR).
• Source: usually you or your organization when the agreement is concluded. If your organization names you as contact person, we point you to this statement at the latest in our first message to you.
• Retention: for the duration of the agreement and seven years afterwards (invoices, the agreement and license data, because of the statutory retention obligation). The change log of the license server is kept for two years. If you are replaced as contact person, we remove you from the active administration as soon as we are informed of the replacement; your name does remain in the agreement and the invoices that fall under the retention obligation.
• Who: see Who has access? The license server runs at TransIP in the Netherlands; email from it goes through TransIP's mail server.

Where is the data held?

The website and the customer environments run on servers in the Netherlands, European Union (EU): the website at Mijndomein, the customer environments on a VPS at TransIP in the Netherlands (EU), backups included. That same server also hosts our license server and our admin panel (see Customer administration and licenses) and the public status page status.aureadesk.com, which itself contains no personal data. Traffic is encrypted over HTTPS. Email that you send us through this website or directly arrives in our mailboxes at Mijndomein (the Netherlands, EU). Email that AureaDesk itself sends (for example a welcome email, a password reset or a report) goes through TransIP's mail server (the Netherlands, EU).

Who has access?

Access to the data is limited to our administrators and to any persons authorized by us and bound to confidentiality, only insofar as needed for administration and support. If we engage another person for administration or support, this is done under a written confidentiality obligation and with the same access rules.

For support purposes, whoever has administrative access on our side can, from our central admin panel, reset a password, block an account, restore a backup or, at the customer's request, erase history in a customer environment. Every action of that kind is recorded in the audit log of that customer environment, so that the customer can see it.

We engage the following processors and have concluded a data processing agreement with each of them:

• Mijndomein (the Netherlands): hosting of this website and the mailboxes sales@ and servicedesk@aureadesk.com, where requests, questions and support requests arrive.
• TransIP B.V., Leiden (the Netherlands): the server that hosts the customer environments, the demo environment, our license server, the admin panel and the status page, the associated backups, and the mail server through which email from the customer environments and the license server is sent (welcome and password emails, reports, signals and messages to our service desk).
• Google Ireland Limited (Ireland): only with your consent, for Google Analytics, under Google's data processing terms (Google Ads Data Processing Terms). See Cookies and tracking.
• Accounting and invoicing: the supplier of the accounting software in which we invoice, where we use an online service for that; that service then holds the customer name, address, contact person and invoice details. On request we will tell you the name and country of establishment of this supplier.

Other recipients. With your consent, Google Ireland Limited also receives data for Google Ads; for that, Google determines itself how it processes the data and is an independent controller (see Cookies and tracking). With your consent, LinkedIn Ireland Unlimited Company (Ireland) also receives data through the LinkedIn Insight Tag, likewise as an independent controller (see Cookies and tracking). If we engage an accountant or bookkeeper for the annual accounts and the tax returns, they receive the invoice details and are themselves the controller for that. You pay by bank transfer against an invoice; we do not use a payment service. The account number you pay from appears on our bank statement and is kept with the accounts for seven years. Other parties receive your data only where a legal obligation requires us to provide it, or where that is necessary to handle a dispute, a claim for compensation or an outstanding claim (for example our insurer, a legal adviser or a debt collection agency).

Your rights

For data for which we are the controller (such as the demo form, support and contact, the customer administration, the demo environment and visit statistics), you can come to us. You have the right to access that data, to have it rectified or erased, to have its processing restricted, to object to processing based on our legitimate interest, and to receive the data you provided yourself in a commonly used file format or have it transferred. We take no decisions about you based solely on automated processing.

Withdrawing consent. Consent you have given (for cookies and measurement, or for news and offers) can be withdrawn at any time: for cookies via Cookie preference at the bottom of every page, for email via the unsubscribe option in every message or via servicedesk@aureadesk.com. Withdrawal does not affect the lawfulness of processing before the withdrawal.

Objecting to direct marketing. If you do not want to receive commercial messages from us, you can always object to that; we then stop immediately and unconditionally.

Send your request to servicedesk@aureadesk.com or by post to the address at the top of this statement. We respond within four weeks; if a request is complex or there are several requests at once, we may extend that period by at most two months and we let you know within the first month. A request is free of charge; only for manifestly unfounded or excessive requests, for example because of repetition, may we charge a reasonable fee or refuse the request. If we are in doubt about your identity, we may ask for additional information to make sure we attribute the request to the right person; we use that information for that purpose only.

If your request concerns data from the TOPdesk environment of an organization that uses AureaDesk, or your user account in the AureaDesk environment of your organization (for example as an operator or caller), that organization is responsible for it, not us: we are then a processor. If you send us such a request anyway, we forward it to that organization within three working days and let you know we have done so.

If you disagree with how we handle your data, we would like to hear it from you first. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or bring the matter before a court.

Security

We take appropriate technical and organizational measures: encrypted traffic (HTTPS), the entire database stored encrypted, access only after signing in with a personal account and a password of at least twelve characters, two-factor authentication (mandatory for administrators, configurable for other users), automatic blocking after repeated failed sign-ins, separated customer environments with a database of their own per customer, a daily backup of each encrypted database, an audit log of administrative and user actions, limited read rights on the connected TOPdesk environment and a fixed procedure for notifying data breaches. The measures are described in full in Annex 2 to our data processing agreement.

Think you've found a vulnerability? Please report it responsibly via servicedesk@aureadesk.com.

Changes

We update this statement when our services or the applicable rules give reason to. The date at the top shows when that last happened. If we start using your data for a new purpose or engage a new processor that receives your data, we inform customers and contact persons of that in advance by email. We send earlier versions on request.

Version history: 14 October 2026 (names of the cookie notice buttons aligned, no substantive change); 8 October 2026 (demo form: optional question how you found AureaDesk, with purpose and legal basis; Operations Management added to the list); 7 October 2026 (two terms adjusted, no substantive change); 1 October 2026 (pop-up for news and offers and the discount code removed; consents given earlier remain valid); 25 September 2026 (LinkedIn Insight Tag added to the cookie choice); 24 September 2026 (sign-up for news and offers via the pop-up and the discount code); 17 September 2026 (processors and recipients added, customer administration and licenses, support and contact, cookie overview, rights extended); 11 September 2026 (three-step cookie choice, Google Ads); 10 September 2026; 8 September 2026; 29 August 2026 (first version).