English legal text · Version 14 October 2026. The Dutch version is authoritative.
Sound of Service is provided by 10TO10, Dutch Chamber of Commerce number 85073989. Contact hello@soundofservice.eu for privacy questions and requests. This policy covers our website, business contacts, accounts and use of the service.
10TO10 is controller for its own website, business relationship, account administration, billing and security. For personal data a customer processes in its business environment, including its customers and employees, Sound of Service generally acts as processor on that customer’s instructions. A separate data processing agreement governs that processing; this policy does not replace it.
Contact requests contain the information you provide, such as name, email, company, subject and message. Accounts and contracts may require business, billing and access details. Security and troubleshooting involve technical records such as IP addresses, sign-in times, browser information and relevant logs. Data entered in a tenant depends on the modules used and may include customers, devices, serial numbers, loans and service history.
We answer requests and perform contracts. Processing business contacts’ and customer employees’ data is based on our legitimate interest in managing the business relationship. Necessary security, abuse prevention and technical logging rely on our legitimate interest in a reliable service, balanced against privacy interests. Statutory administration relies on a legal obligation. Where consent is required, including for non-essential cookies or certain marketing, we ask first; consent can be withdrawn.
A tenant is an organisation’s business environment. Membership, roles and authorisations restrict access; another organisation does not gain access to your administration merely by having an account. This is logical isolation, not a promise of a separate physical server or database per customer. Authorised staff and service providers may have necessary access for support, security or delivery of the service under appropriate confidentiality and processing arrangements.
Isolation does not prevent deliberate sharing. Supported collaboration, integrations, publication and transfers can make information accessible outside the tenant. Public passport information and occasion listings may be viewed by others. The publishing organisation must establish what information is appropriate and lawful to share. Device history is not a basis for unrestricted publication of previous owners’ personal details. External providers’ privacy information and agreements also apply to their own services.
We may use providers for hosting, storage, email delivery, payments, administration and technical support, sharing only what is necessary under appropriate arrangements. Website messages are stored in the CMS and Mailgun is used for email delivery. We do not sell personal data. Subprocessors for customer data are addressed in the data processing agreement. Processing outside the EEA requires a valid GDPR transfer mechanism, such as an adequacy decision or appropriate contractual safeguards.
We retain information only as long as necessary for its purpose. Contact messages remain for handling and reasonable follow-up; account information for the relationship, security and its closure. Records subject to statutory retention remain for the legally required period. Tenant content, post-termination export and backup expiry follow the contract and data processing agreement. Backups are not permanent archives. A concrete legal obligation or dispute may require longer retention with restricted access.
Necessary cookies and local storage may support functionality, security and language or display preferences. Non-essential measurements are enabled only with the required consent. You can change your choice through the website’s cookie settings. Sending a contact request does not automatically subscribe you to marketing.
We apply appropriate technical and organisational measures based on processing risks, including access management and limited permissions. No online service can guarantee absolute security. Report suspected unauthorised access or a breach to hello@soundofservice.eu. When acting as processor, we notify the affected customer of an identified personal data breach without undue delay.
You can request access, correction, erasure, restriction and, where applicable, portability. You can object to legitimate-interest processing and withdraw consent without affecting earlier lawful processing. Contact hello@soundofservice.eu. Proportionate identity checks may be necessary. We generally respond within one month and inform you of any lawful extension. For data processed by a customer in its tenant, contact that organisation first; we assist under the processing agreement. Complaints may be submitted to the Dutch Autoriteit Persoonsgegevens at autoriteitpersoonsgegevens.nl.
Technical information and service/repair history associated with devices are retained when a subscription ends or a device is transferred, so that the history can remain with the device. Ending a subscription does not itself delete that device history. This is not a basis to retain personal data indefinitely or to publish all history. Personal details, contact information and other identifying information are deleted, anonymised or restricted as required by purpose, legal basis, statutory duties and data subjects’ rights. Private tenant administration does not automatically become public or accessible to another organisation.
Version 14 October 2026. This policy is updated as the service or processing changes. We notify affected customers appropriately of material changes.
