Nonstop Staff is a trade name of MX Software Solutions, Chamber of Commerce 42114100, VAT NL005504017B74. Contact: [email protected].
This statement explains which personal data we process as controller: of visitors to our website, of people who take the growth scan or book a call, of businesses we approach, and of our customers and their users. We are not required to have a data protection officer; for any question, e-mail [email protected].
If you call or write to a business that uses Nonstop Staff, that business is responsible for your data. We are the processor: we only process the data on behalf of that business, under a data processing agreement.
In the first sentence you hear that you are speaking with a digital assistant, and then that the call is recorded in writing. We make a transcript and a summary so the business can help you or call you back. We only make an audio recording if the business has switched that on itself.
The business decides how long calls and messages are kept, 90 days by default; after that we delete the content automatically.
For access, correction or deletion, contact the business you called or wrote to. If your request reaches us, we pass it on.
Technical data every web server receives (IP address, browser, page, time). In addition we count visits anonymously and without a cookie: only the page path, the language and the domain you came from, without an IP address.
Purpose
Keeping the website secure and available, preventing abuse and knowing which pages are viewed.
Legal basis
Legitimate interest (article 6(1)(f) GDPR).
Retention
Technical logs briefly, normally no longer than 30 days. The visit count consists only of daily totals that cannot be traced to you.
Growth scan
Data
Company name, trade, town, your name, e-mail address, phone number, website, your answers, the results of the checks, the report and your choice whether we may contact you.
What we do
We look up your company’s Google business profile by company name and town, and check your website for availability, https and speed. An AI model writes the report, a second AI check reviews it, and we e-mail it to you.
Legal basis
Performing your request (point b). For contact afterwards your consent (point a), which you can withdraw at any time. You also get the report without that consent.
Retention
12 months after your request or your last booked call, then deleted automatically. If you become a customer, the data moves to your customer file.
Booking a call and contact
Data
Name, company, e-mail address, phone number, the chosen time and your message.
Purpose
Planning and holding the call, and answering your question.
Legal basis
Performing your request or preparing an agreement (point b), or legitimate interest (point f).
Retention
12 months after the last contact, unless you become a customer.
Nonstop Agent (website chat)
Data
The text of your questions and the answers; a random conversation number kept only in your browser tab (sessionStorage) that disappears when you close the tab; an encrypted code (HMAC) of your IP address, never the address itself.
How
The Nonstop Agent is an AI assistant, not a person. The answers are made by an AI model, normally Claude by Anthropic, directly (United States) or through Amazon Web Services in the EU; in case of an outage another model from the list below may take over. Under Anthropic’s commercial terms the text is not used to train models.
Legal basis
Legitimate interest (point f): answering visitors quickly and limiting abuse.
Retention
The conversation text 72 hours, then deleted automatically. After that we only keep a daily count of how many questions were about which topic, without text and without knowing who asked. Please do not share sensitive data in the chat.
Demo
Data
If you talk to the assistant of an example business in your browser or through the demo number, our speech supplier (ElevenLabs) processes your voice to hold the conversation.
Legal basis
Legitimate interest (point f): showing how the service works and limiting abuse.
Retention
We do not keep the content of the conversation; we delete it at the supplier as soon as the call ends. We only keep a non-traceable code and the duration in seconds to enforce the daily limit.
Customers and their users
Data
Company details, name and contact details of contacts and users, roles, passkeys (only the public key), login and session data, proof of acceptance (name, time, IP address, browser data, version of the terms), quotes, invoices, payment details (through Mollie), usage and support contact.
Purpose
Performing the agreement, securing access, invoicing and collecting, providing support, meeting legal obligations and showing what was agreed.
Legal basis
Performance of the agreement (point b), legal obligation (point c) and legitimate interest (point f).
Retention
Account and user data for the term of the agreement plus 30 days; invoices and records 7 years (tax retention duty); proof of acceptance up to 5 years after the end of the agreement; security logs without content at most 24 months.
Businesses we approach ourselves
Data
Public company data from the Trade Register and Google Maps (company name, legal form, address, phone number, website, trade), the name of the owner or contact person if known, and notes on our contact.
Legal basis
Legitimate interest (point f): business acquisition.
How we work
We do not call or e-mail a sole proprietorship or partnership without prior consent; we approach those at most by letter or visit. We call legal entities on business matters only, with the option to object straight away. If you do not want to be approached again, we put you on our do-not-contact list immediately.
Retention
12 months after the last contact. On the do-not-contact list we only keep what is needed not to approach you again.
Introducers and partners
Data
Name and contact details of the introducer, the businesses reported, commission and payment details.
Legal basis
Performing the arrangement (point b) and legal obligation (point c).
Retention
Reports that do not lead to a customer 6 months; data on commission paid 7 years.
We do not take decisions about you based solely on automated processing that have legal or similarly significant effects. The growth scan gives advice; a person walks you through the result.
We do not sell personal data. We use these suppliers, with a data processing agreement or similar arrangements:
Supplier
For
Country
Transfer basis
DigitalOcean
hosting and database
Netherlands (Amsterdam); US company
EU-US Data Privacy Framework (DPF) and standard contractual clauses (SCCs)
Cloudflare
domain name, security and passing on website traffic
global network; US company
DPF and SCCs
Anthropic
AI model (Claude)
US
SCCs
Amazon Web Services
AI model (Claude via Bedrock), where configured
EU
within the EU
Mistral AI
AI model (fallback), where configured
France
within the EU
ElevenLabs
speech (demo and telephony)
US
SCCs
Telnyx
telephony and SMS
US and EU
DPF and SCCs
Resend
sending e-mail
US
DPF and SCCs
Google
looking up business profiles (Places)
US
DPF
Dutch Chamber of Commerce (KvK)
looking up company details
Netherlands
n/a
Moneybird
invoices and bookkeeping
Netherlands
n/a
Mollie
payments (iDEAL, direct debit); Mollie is itself responsible for the payment
Netherlands
n/a
We also share data where the law requires it, or with our accountant or adviser under confidentiality.
Some suppliers process data in the United States. We only do that on a valid basis: the EU-US Data Privacy Framework for certified companies or the standard contractual clauses of the European Commission. You can request a copy of the safeguards at [email protected].
This website uses no tracking cookies, no ad pixels and no third-party trackers. We count visits anonymously and without a cookie.
Our network and security supplier Cloudflare may set one functional security cookie (__cf_bm). It recognises automated bot traffic, contains no data we use to follow you and expires after about 30 minutes. This cookie is strictly necessary to keep the website secure; no consent is needed for it.
The Nonstop Agent only keeps a conversation number in your browser tab (sessionStorage), not a cookie. If you log in to the customer app as a customer, we use one necessary cookie to keep you logged in.
To show the website and the customer app in the language you chose, we store one functional cookie (nss_lang, containing only “nl” or “en”) for one year. It holds no data about you and is not used to follow you.
We protect data with appropriate measures: encrypted connections (https), a database in Amsterdam with strict separation per customer, login with passkeys, encrypted storage of keys and credentials, recording of changes and access, and access only for those who need it. If you suspect a security problem, e-mail [email protected].
You have the right to access, correction, deletion, restriction of processing and portability of your data. You can object to processing based on legitimate interest, and always to direct marketing. You can withdraw consent at any time.
E-mail your request to [email protected]. We respond within one month and sometimes ask you to show who you are. If it concerns a call with a business that uses our service, see “Conversations we handle for our customers”.
If you are not satisfied with how we handle your data, please tell us first. You can also lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).
We update this statement when our processing changes. The date of the latest version is at the top. For an important change we inform customers by e-mail.