Request your trial

Privacy Statement

mosa.cloud B.V., with its registered office at (6121 XK) Born, Kasteelhof 4, registered in the Business Register of the Netherlands Chamber of Commerce (KVK) under number 97554618, is responsible for the processing of personal data as set out in this Privacy Statement.

Version: 17 September 2026

Contact Details

mosa.cloud is committed to the protection of your personal data. This Privacy Statement explains which data we process when you use our services and/or website, why we do so, and which rights you have. We process personal data solely in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679).

This Privacy Statement describes the personal data we process as a controller, meaning the data we determine the purpose of ourselves. The data our clients store in the Platform is a separate matter and is covered in the section “Data Our Clients Store in the Platform” below.

Data Our Clients Store in the Platform

Our services are a digital workspace. When an organisation uses mosa.cloud, its users create, send and store email, documents, files, chat messages, meeting data and AI prompts in the Platform. This information passes through and is stored on our infrastructure, including in system logs and back-ups. This is inherent to operating the Platform.

For this data, mosa.cloud acts as a processor and the client organisation acts as the controller. The client organisation decides what data is stored in the Platform and for what purpose. We process that data only on their documented instructions. This Privacy Statement does not govern that processing; the Data Processing Agreement between mosa.cloud and the client organisation does. If you are a user within such an organisation, please direct questions about that data to your own organisation in the first instance.

In principle we do not access the data our clients store in the Platform. We do so only where necessary to provide technical support, to resolve faults or security incidents, or to comply with a legal obligation.

We do not use the data our clients store in the Platform to train, fine-tune or evaluate artificial intelligence models, and we do not provide it to third parties for those purposes. The AI features in the Platform are provided exclusively through providers that are established within the European Economic Area and that process personal data within the EEA.

Clients may connect third-party applications and services to the Platform themselves. mosa.cloud does not offer or provide these third parties and is not responsible for the way in which they process personal data. Any such processing takes place under the client organisation’s own arrangements with that third party.

Types of Personal Data We Process

mosa.cloud may process the following types of personal data because you use our services and/or because you provided this data to us.

We process the following types of personal data:

  • First name and surname
  • Phone number
  • Email address
  • Address
  • Bank account number
  • Invoice address
  • IP address
  • Data about your activity on our website
  • Log-in and session information
  • Other personal data you actively provide through correspondence or by phone

Why We Process Personal Data

Depending on our services, we process your personal data for the following purposes:

  • Creating and managing client accounts
  • Handling contact requests that are placed via our website
  • Performing marketing activities, such as sending personalised offers based on previous use of our services
  • Administrative processes and invoicing
  • Complying with the legal retention obligation
  • If we are legally required to, for example when filing tax returns
  • Informing you about changes to our services
  • Delivering products and/or services to you
  • Sending out our newsletter
  • Securing our software and websites
  • Analysing your behaviour on our website in order to improve the website

If you submit personal data to us via email, by post, through a portal provided by us or through (online) forms, this data will only be collected and used for the purpose for which you provide them. We process this data solely for the purpose for which you provide it and according to the bases set out below.

Legal Basis for Personal Data Processing

Data processing is necessary for the performance of the agreement or compliance with a legal obligation. For sending out our newsletter and personalised offers based on previous use of our services, we rely on the legal basis of legitimate interest of direct marketing. However, you can object at any time via privacy@mosa.cloud and we will stop the processing for that purpose immediately.

When We Process Your Data

When you sign up for (one of) our services, we ask you to submit personal data. This data is used to be able to provide the service based on an underlying agreement and/or to comply with legal obligations. Sometimes we may ask you for personal data that is relevant for a specific situation. This enables us to process your questions and respond to your requests.

Use of Third-Party Service Providers

For the processing of personal data we use third-party service providers, who store or process data on our behalf. We have signed processing agreements with these parties in accordance with Article 28 of the GDPR. These parties include IT suppliers, cloud service providers, AI providers, hosting and communication providers.

These service providers act under the responsibility of mosa.cloud and process personal data only upon written instructions from mosa.cloud.

Location of data processing

Your personal data may be shared with third parties and external service providers within the European Economic Area (EEA), but only if this is necessary to perform the services or if there is a legal obligation to do so. The EEA has an equivalent level of protection of personal data, in accordance with the GDPR.

Sharing of Data with Third Parties

mosa.cloud does not sell your data to third parties and shares your data only when this is necessary to perform our agreement with you or to comply with a legal obligation. Access to your data is limited to mosa.cloud employees who are directly involved in the order you have placed with us.

Retention Period

Administrative data will be stored for at least 7 years after termination of our services, in accordance with fiscal legislation. Account data will be stored for up to one year after termination of the service. Client data will be stored for the duration of the agreement and up to 60 days after termination. Back-ups are stored for one month at a time (rolling basis). Technical logs are stored for up to twelve months. Data you submit via the contact form are stored for a maximum of twelve months if no activity or no agreement follows from this. Data stored from your visit to the website is stored for a maximum of six months.

Automated Decision-Making

mosa.cloud does not make automated decisions about matters that may have (significant) consequences for people. This concerns decisions made by computer programmes or systems without intervention from a human person (for example, one of our employees).

Security

mosa.cloud will take appropriate technical and organisational security measures to protect your data against loss, unauthorised access or any form of unlawful processing.

If you feel your data is not properly protected or if there are any signs of misuse, please contact us via privacy@mosa.cloud.

Cookies or Similar Technologies

mosa.cloud uses cookies for functional and technical purposes. Cookies are small, locally stored files that websites use to track user information, and which are stored on your device (computer, phone, tablet) by your browser. The main purpose of cookies on our website is to track user experiences. No prior consent is required for the use of these cookies.

mosa.cloud does not use tracking cookies or third-party cookies for advertising purposes. We analyse the use of our website based on server log files, not cookies. mosa.cloud does not place analytical cookies.

mosa.cloud uses functional cookies for technical services, for example, to keep track of an authentication session or language preferences.

Accessing, Amending or Deleting Data

You have the right to access, amend (or have amended) or delete (or have deleted) your personal data. You also have the right to object to the processing of your personal data, the right to restriction of the processing of your personal data, and the right to data portability. This means that you can submit a request to have mosa.cloud send the personal data it holds of you as a computer file to you, someone else or another organisation, chosen by you. You may send a request for access, rectification, deletion, restriction or portability of your personal data, or an objection to the processing of your personal data, to privacy@mosa.cloud.

To make sure the request is made by you, mosa.cloud asks you to confirm your identity, for example by sending the request from the email address linked to your account. Only where there is reasonable doubt about your identity may we ask for additional information to verify it. We will respond to your request as soon as possible, but within four weeks.

Minors

Our services are aimed at business clients. We do not knowingly process data of minors under 16 years of age. If you suspect we may have unknowingly processed data of a minor, please contact us via privacy@mosa.cloud.

Data Protection Officer

mosa.cloud has appointed a Data Protection Officer (DPO). This person is Riël Notermans (riel@mosa.cloud).

Questions or Complaints

If you disagree with the way mosa.cloud processes your personal data or handles your rights, please contact us via privacy@mosa.cloud.

You can also file a complaint with the national supervisory authority, the Dutch Data Protection Authority, via this link: https://autoriteitpersoonsgegevens.nl/en/submitting-a-tip-off-or-a-complaint-to-the-ap.

Changes to the Privacy Statement

mosa.cloud may make changes to this privacy statement. The latest version will always be available on the mosa.cloud website.