1. Who we are and what this notice covers
Amerged B.V. ("amerged", "we" or "us") is established at Op de Smelen 1, 5863 BN Blitterswijck, the Netherlands, registered with the Dutch Chamber of Commerce under number 42154221, with VAT identification number NL869953308B01.
This notice describes processing for which we are the controller: visits to amerged.com, business enquiries, relationships with customers and suppliers, contract and billing administration, and the management and security of our services. Our services are for business customers and include AI and automation projects, software development, training, and agreed hosting and operations.
We generally process personal data in files, prompts, integrations or other customer content on the customer's behalf. The customer determines the purpose and legal basis for that processing. Our Data Processing Agreement (DPA), the order and that customer's privacy information apply to it. This notice does not give us an independent right to use customer content for other purposes. Separate products may have their own privacy notices; a reference to another product does not automatically make this notice applicable to it.
2. Contact for privacy matters
Use our contact form for privacy questions or requests about your personal data. You may also write to Amerged B.V., attention: Privacy, Op de Smelen 1, 5863 BN Blitterswijck, the Netherlands. Existing customers and their contacts may also use the channel and contact person designated in their agreement or ongoing correspondence. Please identify the service, relationship or processing to which your request relates. Using a different contact channel does not affect your statutory rights when your request reaches us.
For personal data we process solely on behalf of a customer, it is best to contact that customer. If we receive such a request directly, we support the relevant customer in handling it and forward it where appropriate.
3. Data we receive
Depending on your interaction, we process the data needed for it:
- Business contact data: name, organisation, role, work email address, telephone number, correspondence address and the content of messages actually sent to us.
- Relationship and administration data: quotations, arrangements, orders, billing details, VAT details, payment status, contact history and information needed for support or recording decisions.
- Service and access data: where an account or managed service has been agreed, for example user identification, permissions, sign-in events, configuration and relevant support information.
- Technical data: during website or service use, for example IP address, timestamp, requested URL, browser and device information, error messages and security events. The extent depends on the service and enabled security features.
We receive data from you, your employer or another authorised contact, and through use of our website or services. Where relevant, we use public business or register information to verify business details. We do not routinely collect special categories of personal data, complete identity documents or data about minors. Only send such data where agreed in advance and necessary for the relevant service.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Responding to enquiries, preparing quotations and maintaining business relationships | Our legitimate interest in business communication and providing services. For steps requested by an individual who will personally become a contracting party: taking those precontractual steps. |
| Performing an agreement and managing accounts, support or training | Performance of the agreement where you are personally a party as an individual. For employees and representatives of a business customer: our and the customer's legitimate interests in carrying out the business relationship. |
| Billing and keeping legally required records | Legal obligations, supplemented by our legitimate interest in accurate financial administration and collection. |
| Delivering the website and services, resolving faults and preventing abuse, fraud or attacks | Our legitimate interest in secure, reliable and available systems and, where applicable, statutory security obligations. |
| Handling rights requests and establishing, exercising or defending legal claims | Legal obligations and our legitimate interest in protecting rights. |
| A separately offered, voluntary activity for which consent is required | Your prior, specific consent; the relevant request explains the purpose and consequences. |
When relying on legitimate interests, we balance necessity against your interests and privacy rights. We limit data and access to what is reasonably necessary. You may object; see section 10. This notice does not provide consent for newsletters, advertising tracking or training general-purpose AI models on your data. We request separate consent for processing that requires it.
If necessary contact, contractual or billing information is missing, we may be unable to provide a quotation, access or a service. Other information is voluntary unless explained otherwise when it is requested.
5. The contact form, PDF files and browser storage
When you submit the contact form, we receive your name, email address, selected service and message to handle your enquiry. The form sends this information through the ohmyho.st mail gateway to our Google email mailbox. The data is therefore actually transmitted to amerged and the email providers involved. Submission does not subscribe you to marketing. Include only information necessary for your question; do not send passwords, special categories of personal data or customer files through the general form.
The website uses the local browser setting amerged-cookie-note to remember that you have dismissed the technical storage notice. This setting contains only the acknowledgement and remains until you remove your browser storage or the browser clears it. You can remove or block this storage through your browser.
The current website contains no advertising pixels or visitor analytics placed by us. Depending on enabled security features, Cloudflare may use technically necessary cookies or similar means to assess traffic and prevent abuse. Dismissing a notice is not consent to optional tracking. If we later add non-essential storage, we will provide further information in advance and request consent where required.
PDF versions of our legal documents are generated locally in your browser when downloaded; no document is sent to an external conversion service for that purpose. Loading the page and the necessary website files does generate ordinary technical website traffic.
6. Recipients and infrastructure
Access within amerged is limited to people who need the data for their work. We engage infrastructure suppliers to provide services, with appropriate agreements covering their role and processing.
The core environment for hosted customer services uses Contabo GmbH in Munich, Germany, unless a different environment is expressly agreed in the order. Cloudflare, Inc. provides network and protection services. The public website is also delivered through Cloudflare's edge infrastructure, using ohmyho.st as a service operated by Amerged B.V. itself. In this context, ohmyho.st is not a separate external legal entity. Cloudflare may process request and traffic data and, where traffic is decrypted there, the content of those requests.
Resend (Plus Five Five, Inc., United States) delivers contact-form messages from the ohmyho.st mail gateway to our Google mailbox. It processes sender and recipient details, the message and delivery metadata. The gateway operated by Amerged B.V. and the Google mailbox do not remove the separate role of Resend and its further processors; processing outside the EEA is possible.
orq.ai is optional. For agreed AI services, amerged uses models compliant with the applicable EU AI Act obligations through orq.ai on EU-hosted infrastructure; model execution takes place in the EU. This commitment applies to the selected models and the agreed execution. The order specifies the entity involved, models, endpoints, logging, retention periods and permitted fallback routes within the EU. We separately assess the processing needed for support and telemetry and the further providers involved. We make no general guarantee about training use by an unspecified model provider. Permitted processing is established before activation.
Google provides our business email and email environment for support. This is the Google email/cloud mail service under our account agreement; the precise service and contracting entity are determined by that agreement. Google's current entity schedule generally names Google Cloud EMEA Limited in Ireland as the contracting party for Dutch Google Workspace and Cloud accounts. Email addresses, message content, any attachments, and delivery and security metadata are processed to receive, store and answer correspondence. A European account does not guarantee exclusively European processing. Personal data we process on a customer's behalf in support messages is subject to the DPA and the arrangements for the permitted support channel.
The general contact form and ordinary support email are intended for administrative correspondence and problem descriptions. Do not include production data or files containing personal data about your own customers unless a suitable support channel has been agreed in advance. If Google is used as a subprocessor for that customer content, the agreed process and deletion settings must actually support the DPA deadlines; a supplier's general retention period does not extend them.
We use Revolut Business for invoices and related payment administration. This may involve names, business contact details, billing addresses, invoice items, payment references and transaction status. Revolut acts as an independent controller for its own financial, statutory and fraud-prevention purposes; its Netherlands privacy information identifies Revolut Bank UAB as the primary controller in the EEA. For features that process billing data solely on our behalf, its role depends on the applicable service terms. This does not automatically make Revolut a subprocessor of content in our customer applications. Our account agreement determines the Revolut entity actually used.
The subprocessor list identifies relevant suppliers, the email delivery chain and their functions. Recipients of administrative personal data may also include professional advisers, competent authorities, banks or parties involved in a specific legal proceeding, where necessary and supported by a valid legal basis. They may act as independent controllers. We do not sell personal data. External links lead to services governed by their own privacy information.
7. Processing outside the EEA
Core hosting in Germany does not mean every network request or supporting processing activity remains within the European Economic Area (EEA). Cloudflare and our email providers use international infrastructure; Revolut may also process outside the EEA for its financial services. Our commitment to LLM execution through orq.ai in the EU does not automatically extend to these separate network, email and administrative processing activities. Support, telemetry and further recipients in an AI supply chain are assessed separately.
For transfers outside the EEA, we ensure an applicable basis under Chapter V GDPR: for example, a valid adequacy decision or the European Standard Contractual Clauses (SCCs), supplemented by additional measures where needed. Reliance on the EU–US Data Privacy Framework is possible only where the specific recipient is actively certified and the processing falls within that certification. An EU business address is not, by itself, a transfer safeguard.
You may use the contact in section 2 to request information about relevant recipients, countries and safeguards and obtain a copy of applicable safeguards. Confidential business information or other people's data may be redacted. See also our SCC information.
8. Retention and deletion
We apply the following rules and delete or anonymise data when the relevant period and purpose end:
| Data | Retention period |
|---|---|
| Business enquiries that do not result in an agreement | Up to 24 months after the last substantive contact. |
| Operational contact and support data | During the relationship and for no more than 24 months afterwards, except records needed for statutory administration or a specific legal claim. |
| Invoices and core tax records | Generally 7 years after the end of the relevant financial year. For records that remain current for longer, the statutory period starts only when they cease to have current relevance. A statutory 10-year period applies only to the relevant categories. |
| Security and access logs under our control | No more than 180 days, unless relevant portions are needed to investigate a specific incident or comply with a legal obligation. |
| Customer content we manage as a processor | During the order. After termination: 30 days for export or return, followed by deletion from active systems within the next 30 days, and therefore no later than 60 days after termination. Remaining backups expire within 90 days after active deletion, and therefore no later than 150 days after termination. |
The 180-day period applies to security logs for which we act as controller, on the legal basis described in section 4. Where logs contain customer personal data that we process on instructions, the shorter post-termination deletion periods under the DPA take precedence.
A shorter agreed period or a valid deletion instruction may apply to customer content under the DPA. During the wind-down, customer content is not used for new service delivery. Backups are for recovery, are not accessed for ordinary processing, and have applicable deletions reapplied if restored.
A legal retention requirement or a specific, documented need to address a dispute may justify a longer period for the strictly necessary data. That exception does not automatically apply to an entire account, all customer content or all backups. Such data is segregated or its use restricted and deleted when the need ends. A supplier is responsible for its own processing and transparency where it retains data for its own statutory purposes.
9. Security and AI processing
We establish technical and organisational measures appropriate to the nature of the data and the service's risks. Agreed measures are described in our TOMs and, where applicable, the order. Those measures are not a statement that every project has the same configuration or an independent certification.
We do not use the administrative data described in this notice for solely automated decisions producing legal or similarly significant effects on you. AI functionality we build or operate on a customer's behalf is subject to that customer's instructions and transparency obligations. The presence of AI in a project does not authorise incompatible reuse of personal data.
10. Your rights
Subject to the GDPR's conditions, you may request access, rectification, erasure, restriction of processing and data portability. Portability applies in particular to data you have provided that we process by automated means based on consent or a contract. You may object to processing based on legitimate interests; we will stop unless we demonstrate compelling legitimate grounds or a necessary legal claim. You may always object to direct marketing.
Where processing relies on consent, you may withdraw it at any time. This does not affect the lawfulness of earlier processing. We may request proportionate information to verify your identity, without routinely requiring a complete copy of an identity document. We generally respond within one month. For complex or numerous requests, the statutory period may be extended by up to two further months; we will explain the reason within the first month.
You may also complain to the Dutch Autoriteit Persoonsgegevens or the competent supervisory authority in the member state of your habitual residence, place of work or the alleged infringement. You do not have to complete our internal procedure first.
11. Changes and language
The version label above identifies this document edition. We inform affected individuals appropriately about material changes and obtain renewed consent where required. A new notice does not retroactively make previously unlawful processing lawful.
The Dutch text is the primary version. English and German translations are provided for accessibility. In case of a discrepancy, the Dutch text is the reference, without restricting mandatory privacy rights or transparency obligations. The webpage and downloadable PDF are generated from the same source.