Privacy policy AS Support B.V.

Version 1.8, 21-10-2026. Download this privacy policy as PDF · Nederlandse versie (PDF)

Introduction

AS Support B.V. respects the privacy of its customers and the end users of its services. In this privacy policy, we explain how we handle personal data, which data we process, and how we comply with the General Data Protection Regulation (GDPR).

What Data Do We Process?

AS Support processes personal data necessary for our services, such as:

1. Contact details: Name, address, email address, phone number.
2. Financial data: Information required for invoicing or for arranging mortgages or insurance.
3. Technical data: IP addresses, browser details, and log files.
4. Sensitive data: Financial information entered into tools or modules.
5. Data from imports and connected external sources: Data provided by customers through file imports, such as Excel or CSV files, or through customer-activated integrations with external services and APIs, including selected file content, spreadsheet data, metadata, relationship fields, account identifiers, encrypted authorization credentials, and technical logging, insofar as necessary for the requested functionality.
6. Data from the Google Business Profile: Data we retrieve from Google after you connect your Google Business Profile. This is the email address of the connected Google account, the accounts and locations of your profile and, for the location you choose, the average score, the number of reviews and the most recent reviews. For each review this means the reviewer’s name, the stars, the text, the date and your own reply. We also store the access token of the connection in encrypted form.
7. Data from social media integrations: Data necessary for customer-activated integrations with social media platforms, including Facebook, Instagram, and LinkedIn, such as account or page identifiers, usernames, encrypted access tokens, publication IDs, technical status information, and publication metadata, insofar as necessary for the requested functionality.
8. Data from AI functionality: Data entered or selected by customers or users when using AI functionality within our services, such as prompts, instructions, selected text fragments, draft texts, source information, context data, generated output, technical metadata, user IDs, timestamps, error messages, and logging data, insofar as necessary for the requested AI functionality, security, management, and support.

Social Media Integration

Our service offers optional integrations with social media platforms to publish news articles on your behalf. These integrations are only active when you choose to enable them yourself.

Socials Hub (Facebook Integration)

If you use the Socials Hub module (as registered with Meta) to publish news articles to Facebook, the following additional data is processed:

• Facebook page IDs and access tokens (stored in encrypted form only).
• Name, email address, and (if relevant) profile information of the account linked to the Facebook page, only as far as necessary for posting messages on your behalf.
• News posts published on Facebook via our service, including related metadata (publish time, post ID, etc.).

This data is used solely to publish news articles to your own Facebook page on your behalf and to manage your Facebook connection. We do not share data with Facebook except as strictly necessary for this functionality. You can disconnect Facebook at any time in your account settings.

Note: This processing only applies if you explicitly use the Facebook integration via Socials Hub. If you do not use this module, no Facebook-related personal data is processed or shared.

LinkedIn Integration

If you choose to use the option to automatically post news articles to your LinkedIn profile or page, the following applies:

• AS Support only receives and processes the data necessary to post news articles on your behalf via the LinkedIn connection.
• We do not share any other data with LinkedIn and will never post content without your permission.
• You can revoke this connection at any time via the platform or through your LinkedIn settings.

Instagram Integration

If you choose to use the option to automatically publish news articles to your Instagram account, the following applies:

• AS Support only receives and processes the data necessary to publish news articles on your behalf and to allow the connection to function technically.
• This may include your Instagram account ID, username, linked Facebook page or business account context, encrypted access tokens, and technical or publication-related metadata, insofar as necessary to publish, manage, or support publications on your behalf.
• If publications are placed through this integration, AS Support may also process data about the published content, publication times, media or publication IDs, and the technical status of the publication.
• This data is used solely to publish news articles to your own Instagram account on your behalf, to manage the Instagram connection, and to support the functioning of this integration.
• We do not share data with Instagram except as strictly necessary for this functionality.
• We will never post content without your permission.
• You can revoke this connection at any time via the platform or through your Instagram settings.

Note: This processing only applies if you explicitly use the Instagram integration. If you do not use this module, no Instagram-related personal data is processed or shared.

AI Functionality / OpenAI API

Our services may include optional AI functionality that allows customers or users to have texts, data, or other content analyzed, summarized, rewritten, generated, or supported. For this AI functionality, AS Support uses the API services of OpenAI.

If you use AI functionality within our services, the following applies:

• AS Support processes only the data necessary to perform the AI functionality requested by you.
• This may include prompts, instructions, selected text fragments, draft texts, source information, context data, generated output, technical metadata, user IDs, timestamps, error messages, and logging data.
• The entered data and generated output are used solely for the requested functionality, the technical operation of the service, security, error analysis, and support.
• AS Support does not use this data for its own marketing purposes, profiling, resale, or any purpose unrelated to the requested functionality.
• The processing through the OpenAI API is subject to OpenAI’s business/API terms and data controls. According to the current OpenAI API documentation, data processed through the OpenAI API is not used by default to train or improve OpenAI models, unless this is explicitly opted into.
• Insofar as personal data is processed through the OpenAI API, this takes place only insofar as necessary for the requested functionality and within the scope of the agreed services.
• Users should not enter personal data, special categories of personal data, or confidential information that is not necessary for the requested AI functionality.
• AI output may be incorrect, incomplete, or outdated. Users remain responsible for checking, reviewing, and, where necessary, adjusting AI output before it is used, sent, published, or shared.
• The AI functionality is supportive in nature and does not constitute independent legal, financial, tax, medical, or other professional advice.

Note: This processing only applies if you explicitly use AI functionality within our services. If you do not use this functionality, no data is processed through the AI functionality or OpenAI API.

Google Drive / Google Sheets Integration

If you choose to use the option to link your Google Drive and/or Google Sheets data to the AS Support newsletter module, the following applies:

AS Support only accesses and processes the data necessary to read relationship data from the Google files or spreadsheets selected by you or made available by you for this purpose.

Depending on the configuration of the integration, AS Support may process:

• selected Google Drive files and Google Sheets spreadsheets;
• spreadsheet content, including rows, columns, worksheet names, and cell values, only insofar as necessary to import, read, match, or synchronize relationship data with the newsletter module;
• file metadata, such as file name, spreadsheet ID, worksheet name, column headers, and last modified date;
• account and connection data necessary to maintain the integration, such as your Google account identifier, email address, and OAuth access or refresh tokens.

This data is used solely for the following purposes:

• establishing and maintaining the Google Drive / Google Sheets connection;
• reading and synchronizing relationship data with the newsletter module;
• supporting, troubleshooting, securing, and technically managing the integration;
• responding to user support requests relating to the integration.

Read-only access (Google Drive and Google Sheets)

For the newsletter and for imports, AS Support only reads. AS Support does not create any other files and does not change or delete them.

Limited use of Google user data (Limited Use)

AS Support’s use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

For the Google Business Profile connection and for the Google Drive and Google Sheets connection this means:

• We process Google data only to deliver the function you set up in the dashboard: showing reviews on your website, or reading relations from your spreadsheet.
• We only pass Google data on to others when this is needed to deliver that function, for security or to prevent abuse, to meet a legal obligation, or after you have given permission. In a merger or acquisition we only pass it on after your prior permission.
• AS Support staff do not read Google data. Exceptions: you give permission for a specific support question, security or abuse requires it, the law requires it, or we only look at aggregated and anonymised figures for internal operations.
• We do not sell Google data and do not pass it to advertising platforms or data brokers. We do not use it for advertising. We do not use it to assess anyone’s creditworthiness or for a loan.
• We do not train AI or machine learning models with Google data and we do not improve models with it.
• These rules also apply to aggregated, anonymised and derived data, and to AS Support’s staff, partners and successors.

Storage and security

Where technically necessary, OAuth tokens or similar authorization credentials are stored in encrypted form and only for as long as required to maintain the active connection. Access to such credentials is restricted to authorized personnel and systems on a need-to-know basis.

Sharing of data

AS Support does not share Google user data obtained through this integration with third parties, except where this is strictly necessary for hosting, security, technical support, legal compliance, or the provision of the requested service.

Disconnecting the integration

You may revoke or disconnect the Google Drive / Google Sheets integration at any time through your account settings or through your Google account permissions settings. Once the integration is disconnected, AS Support will no longer access new data through that connection. Data already imported or processed within the newsletter module will only be retained insofar as necessary for the provision of the service, legal obligations, or legitimate recordkeeping requirements.

Google Business Profile (Google reviews)

With this optional connection you show the reviews of your Google Business Profile on your office website. The connection is only active when you set it up yourself in the Secure Dashboard. Without a connection, we retrieve nothing from Google.

What data do we receive from Google?

When you connect, you give Google permission for access to your Google Business Profile (business.manage). After that we receive:

• The email address of the Google account you connect with. We only show this address to your office in the dashboard.
• The names and titles of the accounts and locations of this Google account, with the links to the location on Google Maps and to the page where customers write a review.
• The average score and the total number of reviews of the location you choose, exactly as Google gives them.
• The 50 most recent reviews of that location. For each review: the reviewer’s name, the number of stars, the text, the date and your reply, if you posted a reply on Google. For an anonymous reviewer we receive no name.
• The access token of the connection. We store it in encrypted form.

We do not store photos or videos of reviews and we do not show profile photos of reviewers.

What do we do with this data?

• We only read. We do not post, change or delete anything in your business profile. We do not reply to reviews, not even automatically.
• Every night around 05:00 our system retrieves the newest data.
• We show the reviews on your office website, unchanged and in full, with a reference to Google as the source. We do not leave out reviews based on the number of stars and we do not calculate our own average.
• Your office chooses one location and the number of reviews on the website (1 to 20).

Who sees the data?

• Visitors of your office website see the reviews, with the reviewer’s name. The reviews come from our server in the Netherlands. We do not load images, fonts or scripts from Google in the visitor’s browser.
• Users of your office see a preview of the reviews in the dashboard.
• We do not share the data with others. Our hosting partner in the Netherlands stores it on our behalf.

How long do we keep the data?

• Reviews and locations stay for at most 30 days after the moment we last retrieved them from Google. Because we refresh every night, a review stays visible as long as it is on Google and among the 50 most recent. If you or the reviewer delete a review on Google, it also disappears on our side during the next nightly round.
• We delete all reviews and locations of your office immediately when you remove the connection and when you reconnect.
• If your office no longer has the Google reviews module, we delete the reviews during the next nightly round.
• If you withdraw access at Google, we notice this during the next nightly round and then delete the reviews.
• If Google is temporarily unavailable, the data stays for at most 30 days after the last successful round.
• Backups may contain this data for at most 30 more days. We only use backups to recover from a failure.

Your rights and choices

• You remove the connection yourself: Secure Dashboard, Office details, step Google reviews, button Disconnect. Only an administrator of your office sees this button.
• You can also withdraw access in the settings of your Google account, under third-party access.
• Does this not work? Email ln.troppussaobfsctd-3d46bd@ksedecivres. We handle a request to stop within 7 working days.
• A review is a public message on Google. Do you want your review or your name removed as a reviewer? Then delete the review on Google. On our side it disappears during the next nightly round. Do you want access to or deletion of data we hold about you? Contact the office or us.

Who is responsible for what?

• The office decides whether and how the reviews appear on its website. The office is the data controller for the reviews. AS Support is the processor and acts on the office’s instructions.
• Google is itself responsible for the data in the Google account, in the business profile and on Google. Google’s terms apply to that processing.

File Imports and External Integrations

If you use the option to provide personal data through file imports or through integrations with external services, the following applies.

AS Support only processes the data necessary to perform the functionality requested by you, such as importing, linking, synchronising, enriching, or managing relationship data within a module or other agreed service.

This may include:

• data contained in Excel, CSV, or similar files uploaded or provided by you;
• data obtained from external systems or data sources that you connect through an API or other technical integration;
• metadata such as file names, column headers, worksheet names, import mappings, modification dates, source identifiers, and logging data;
• technical authorization or connection data necessary to operate and secure the integration.

Such data is processed solely on your instructions and only insofar as necessary for the agreed services. AS Support does not use such data for advertising, profiling, resale, or any purpose unrelated to the delivery, security, or support of the requested functionality.

The customer remains responsible for the lawfulness, accuracy, and currency of the data provided through imports or external integrations and for being entitled to have such data processed by AS Support.

Why Do We Process Personal Data?

We process personal data only for the following purposes:

• Delivering websites, tools, and modules to customers.
• Processing data necessary for the services of our customers (e.g., mortgage or insurance applications).
• Securing our services and systems.
• Supporting our customers with requests from end users (such as access or deletion requests).
• Improving our services based on technical usage statistics.
• Importing, reading, linking, and synchronising relationship data from files provided by customers, such as Excel or CSV files.
• Importing, reading, linking, and synchronising relationship data from customer-activated external integrations, including API integrations and Google Drive / Google Sheets sources.
• Retrieving, temporarily storing and showing reviews from the Google Business Profile of an office, on that office’s own website.
• Providing optional AI functionality, such as analyzing, summarizing, rewriting, generating, or supporting texts and other content within our services.

Legal Bases

We process personal data based on the following legal grounds:

• Performance of a contract: For example, to provide our services.
• Legal obligations: Such as fiscal retention requirements.
• Legitimate interest: Improving and securing our services.
• Consent: For specific processing, such as marketing.

For customer-activated imports and integrations with external platforms, such as Excel imports, API integrations, Google Drive / Google Sheets and the Google Business Profile, processing takes place insofar as necessary for the performance of the contract and, where applicable, on the basis of the authorisation and instructions provided by the customer.

Controller and Processor

• AS Support’s customer is the data controller: AS Support processes data on behalf of its customers (for example, data from end users entered via our tools).

AS Support is the processor: We act only on instructions from our customers and take appropriate measures to secure personal data.

• Google is itself the data controller for the data in the Google account, in the Google Business Profile and on Google. For AS Support, Google is a source and not a sub-processor.

Data Retention and Deletion

We do not retain personal data longer than necessary for the purposes for which it was collected:

• Contact details: Up to 1 year after termination of the contract, unless legally required otherwise.
• Financial data: 7 years, in line with fiscal obligations.
• Technical data: Up to 6 months after processing.
• Integration and authorization data: OAuth tokens, API credentials, connection identifiers, and temporary technical synchronisation data relating to imports or external integrations are retained no longer than necessary to operate and secure the active import or integration functionality. Following revocation or termination of the integration, such data is deleted or rendered unusable, unless a limited retention period is required for security, audit, fraud prevention, or legal compliance purposes.
• Google Business Profile: Reviews and locations stay for at most 30 days after the last retrieval from Google. We delete them immediately when the connection ends. After you remove the connection, we delete the access token and the email address of the Google account within 30 days.
• AI data: Prompts, selected content, context data, and generated output are retained no longer than necessary for the requested AI functionality, security, error analysis, support, or legal obligations. Insofar as such data is processed only temporarily through the AI functionality, it is not retained longer than technically or functionally necessary.

Immediately after termination of services, all personal data is securely and permanently deleted, unless otherwise agreed in writing.

Data Security

AS Support takes extensive technical and organizational measures to protect personal data against loss, misuse, and unauthorized access:

• Sensitive data is stored in encrypted databases.
• Authorization credentials for connected third-party services, including Google integrations where applicable, are stored encrypted and are accessible only to authorized systems and personnel strictly where necessary for service operation and support.
• For hosting, data center, and CMS development, AS Support only partners with ISO 27001/NEN 7510 certified companies.
• Customers log in with username, password, and optionally 2FA (two-factor authentication).
• Access to personal data is strictly limited to authorized staff and certified partners, only as necessary to provide our services.
• Authorization data for connected external services, including Google integrations, API connections, social media integrations, and AI functionality where applicable, is stored in encrypted form and is accessible only to authorized systems and personnel insofar as necessary for the operation, security, and support of the relevant integration or functionality.

Rights of Data Subjects

End users have the following rights under the GDPR:

• Access: The right to view their data.
• Rectification: The right to correct inaccurate or incomplete data.
• Erasure: The right to have personal data deleted (“right to be forgotten”).
• Restriction: The right to restrict processing.
• Portability: The right to receive their data in a structured format.
• Objection: The right to object to processing based on legitimate interest.
• Reviewers of a Google Business Profile: you delete your review on Google. See the chapter Google Business Profile.

Exercising Rights

Data subjects can exercise their rights by contacting us using the contact details in this policy. We respond to requests within 30 days. In exceptional cases, this period may be extended; we will inform the data subject in a timely manner.

Sub-Processors and Data Transfers

AS Support B.V. uses carefully selected certified partners (sub-processors) for parts of its services, such as hosting, data center services, and CMS management and development. For these sub-processors—including Rootnet B.V., BIT B.V., and LinkU B.V.—data processing agreements have been concluded, requiring them to protect personal data adequately and act in accordance with the GDPR.

For sending emails, AS Support B.V. uses SendGrid, based in the United States. Personal data such as email addresses and message content are only processed temporarily for email delivery. No data is stored at SendGrid after delivery; data is automatically deleted after sending, in accordance with SendGrid’s policy. Transfers to the United States always take place with appropriate safeguards, such as the use of standard contractual clauses under the GDPR.

For optional AI functionality, AS Support uses the API services of OpenAI as an external service provider/sub-processor, insofar as this functionality is used by the customer or user. Prompts, selected content, context data, and generated output may be processed temporarily in order to perform the requested AI functionality. Where necessary, AS Support uses appropriate contractual and technical safeguards, including the available business terms, data controls, and data processing arrangements of OpenAI. According to the current OpenAI API documentation, data processed through the OpenAI API is not used by default to train or improve OpenAI models, unless this is explicitly opted into.

If a customer connects Google Drive, Google Sheets, the Google Business Profile or another external service, data is exchanged with the external service provider the customer chooses. With the Google Business Profile, Google is a source of data and not a sub-processor of AS Support. AS Support stores the data from the Google Business Profile on servers in the Netherlands and does not pass it to parties outside the European Economic Area. When retrieving data, Google only receives the access token and the technical details of the request, such as the account and location name. Such processing takes place solely on the basis of the customer’s activated integration and within the scope of the agreed functionality.

AS Support aims to process personal data as much as possible within the European Economic Area (EEA). Insofar as processing outside the EEA takes place or is necessary, AS Support B.V. ensures appropriate safeguards, such as the use of standard contractual clauses, additional contractual and technical measures, or working with parties in countries for which an adequacy decision applies.

An up-to-date list of sub-processors is available upon request.

Data Breach Procedure

1. Detection of a data breach: Once a data breach is identified, AS Support records the incident in an internal log, including:
   • Date and time of discovery.
   • Data involved (if known).
   • Cause and impact of the breach.
   • In addition to data breaches, AS Support also informs customers of other serious security incidents that may affect the availability, integrity, or confidentiality of personal data.
2. Notification to customers
   • Within 48 hours of discovery, AS Support informs the customer of:
     • The nature of the data breach.
     • Which data may be affected.
     • Measures taken or recommended.
   • The notification includes sufficient detail for the customer (data controller) to comply with their own notification obligations.
3. Measures
   • AS Support immediately takes measures to stop the data breach and limit the impact. This may include:
     • Isolating affected systems.
     • Resetting access codes.
     • Adjusting security settings.
4. Follow-up and reporting
   • A full incident report is provided to the customer within 7 working days.
   • The report includes:
     • A summary of the incident.
     • Solutions implemented.
     • Any recommendations for future use.

Cookies

Our website www.assupport.nl places necessary cookies for the basic functioning of the site. Analytics cookies from Google Analytics are placed only after you give your consent via the cookie banner; without your consent, Google Analytics is not loaded at all. You can review or change your preferences at any time via the cookie icon at the bottom left of every page. Which cookies we place, how long they are kept and what they are for is described in our cookie policy (in Dutch).

Governing Language

This Privacy Policy is a translation of the original Dutch version. In case of discrepancies, the Dutch version shall prevail and is the legally binding document.

Contact Details

For questions about this privacy policy or to report incidents, please contact:

• AS Support B.V.
• Address: Frankenstraat 77, 6582 CW Heumen
• E-mail: ln.troppussaobfsctd-32c163@ksedecivres
• Phone: +31(0)24-388 6998