Privacy
This website collects as little as possible. There are no cookies, no analytics, no trackers and no advertising networks. One external spam check runs on the contact page; apart from that, nothing is fetched from a third party during a visit. Below you can read exactly which data we do process, why we are allowed to, how long we keep it and what your rights are.
AEM Systems builds websites, custom software and AI automations. For the data processed through this website we are the controller within the meaning of article 4(7) of the General Data Protection Regulation (GDPR).
We are not required to appoint a data protection officer and have not done so. You can ask privacy questions at the email address above; they reach the founders directly.
There are exactly three moments at which personal data is processed through this website:
Nothing beyond this happens. There is no newsletter, there are no comments under blog articles, there is no account, and nothing is analysed or profiled.
The contact form asks for your full name and your email address. Your company name and your message are optional. Without a name and an email address we cannot reply, which is why those two fields are required. The receiving service also automatically sees your IP address, the time of sending and your browser type, as any internet service does.
That depends on your message, which is why we name two legal bases:
We do not ask for consent for this and do not rely on it. For a message you send us yourself, consent is not the appropriate basis.
The form is processed by Formspark, a service run by the Belgian company Trampoline Software SRL that forwards your message to us by email. Formspark stores messages within the European Economic Area, in Ireland and Germany, and processes them solely on our instructions and under a data processing agreement. After that, your message sits in our mailbox at Mijndomein.
To stop the form filling up with automated messages we use Cloudflare Turnstile, configured in invisible mode. That check runs only on this contact page, but from the moment you open the page — so it runs even if you never fill the form in. You see nothing of it: there is no puzzle and no checkbox.
Cloudflare receives your IP address, your browser signature and a characteristic of your secure connection in the process, and tells us through Formspark only whether the check passed. In carrying out that check Cloudflare acts as our processor. For improving its own bot detection, Cloudflare is an independent controller; we have no say over that use. By its own account, Cloudflare does not use this data to build profiles or serve advertising. The basis is our legitimate interest in a usable contact form (article 6(1)(f) GDPR): without this check, an open form is unusable in practice because of spam.
Exactly which data Cloudflare processes in doing so, and in which role, is set out in Cloudflare’s Turnstile Privacy Addendum.
If the contact leads to an assignment, we also process the data needed to carry out and invoice that assignment: contact details of the people involved, company details, correspondence, and whatever other data comes up during the project.
The basis is performance of the contract (article 6(1)(b) GDPR). For invoices and the related administration a legal obligation also applies (article 6(1)(c) GDPR): the fiscal retention duty in article 52 of the Dutch General State Taxes Act requires us to keep those for seven years.
If during an assignment we process personal data for which you are the controller — for example with hosting, maintenance or an AI automation — we will conclude a separate data processing agreement with you.
This website is hosted by Vercel. Vercel records technical data in server logs that is needed to deliver and secure the site: the IP address, the time, the page requested, the status code and your browser type. We do not use these logs to track or analyse visitors, and we keep no copy of them ourselves. The basis is our legitimate interest in a working and secure website (article 6(1)(f) GDPR). Vercel is a US company; article 7 explains what that means.
We do not sell your data and do not use it for advertising. We share it only with parties that help us run this website and our services:
| Recipient | Purpose | Role |
|---|---|---|
| Vercel | Delivering and securing the website | Processor |
| Formspark | Forwarding messages from the contact form | Processor |
| Cloudflare | The spam check when the contact form is submitted | Processor |
| Mijndomein | Receiving and storing our email | Processor |
With every processor we conclude a data processing agreement as required by article 28 GDPR. We may also share data with our accountant or an adviser, or where we are legally obliged to do so.
When you view this website your browser fetches nothing from third parties: all text, images, video and typefaces come from our own address. The site is, however, hosted by Vercel Inc., a company in the United States. Visitors from the Netherlands are in practice served from Vercel’s European node in Frankfurt, but because Vercel Inc. is established in the United States, processing your visit data does legally count as a transfer outside the EEA. Vercel relies on the European Commission’s standard contractual clauses for this, as set out in its data processing addendum.
When you open and submit the contact form, Cloudflare is added to that, also a US company. The European Commission’s standard contractual clauses apply to that transfer as well. Cloudflare additionally states that it participates in the EU-US Data Privacy Framework, for which the Commission adopted an adequacy decision on 10 July 2023.
The remaining links stay within Europe. Formspark is a Belgian service and stores messages in Ireland and Germany. Our email at Mijndomein is, according to that provider, hosted within Europe.
You can request a copy of the safeguards we agreed with these parties from us at info@aemsystems.nl. If you would rather reach us without Cloudflare’s spam check being invoked, email us directly at that same address. Do bear in mind that your visit to this website goes through Vercel either way.
| Data | Retention | Why |
|---|---|---|
| Contact form message that does not lead to an assignment | 12 months | To handle the enquiry and to look back on any follow-up |
| Message that does lead to an assignment | For the duration of the assignment, then 7 years | Part of the client file and the administration |
| Invoices and administration | 7 years | Fiscal retention duty, article 52 General State Taxes Act |
| Server logs | We keep no copy ourselves; our hosting provider keeps them available briefly | Technical management and security |
Once data is no longer needed, we delete it.
The GDPR gives you a number of rights. You can exercise all of them by sending an email to info@aemsystems.nl. We respond within one month. To prevent us handing data to the wrong person, we may ask you to identify yourself.
If you disagree with how we handle your data, please tell us first — we will sort it out. You also always have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.
The website is served exclusively over an encrypted connection (HTTPS), so what you type into the contact form cannot be read in transit. Access to our email and systems is limited to the three founders and secured with strong, unique passwords and two-factor authentication. We deliberately process as little as possible: what is not collected cannot leak.
If something does go wrong and it affects your data, we report it under articles 33 and 34 GDPR to the Autoriteit Persoonsgegevens and, if it is likely to pose a high risk to you, directly to you as well.
For the sake of clarity, and to save you reading a lot of standard text that does not apply here:
If anything changes about the website or the way we handle data, we will update this policy. The version and the date of the last change are always shown at the top. For significant changes we notify clients with whom we have an ongoing agreement.