1. Who we are
Oostsoft Pro B.V., trading as LSQapps ("we", "us", "LSQapps") is the controller for the processing of personal data through LSQapps and related installations. Our contact details:
- Registered address: Boterdiep ZZ 27, 9781 GP Bedum, the Netherlands
- Dutch Chamber of Commerce number: 66845246
- VAT ID: NL856721876B01
- Email (general): info@lsqapps.com
- Email (privacy & GDPR): info@lsqapps.com
2. Which data we process
We only collect data that is needed to deliver, secure and improve our services. That is:
- Account and contact details: name, email address, telephone number, job title, organisation.
- Authentication data: hashed passwords, 2FA tokens, session IDs, IP address at sign-in.
- Invoicing and payment data: company name, Chamber of Commerce number, VAT ID, visiting address, partial IBAN (final digits only, for reference), subscription and transaction history. Full payment details are not stored by us — see section 5 on Paddle.
- Usage and log data: sign-in timestamps, error logs, performance measurements, IP address for security purposes.
- Content you place: data you enter or upload in the applications. For this we act as a processor; your organisation remains the controller. A separate data processing agreement is available on request.
3. Purposes and legal bases
| Purpose | Legal basis (art. 6 GDPR) |
|---|---|
| Performing your subscription or order | Performance of the contract |
| Invoicing, accounts receivable administration | Legal obligation (statutory tax retention) |
| Security and fraud prevention | Legitimate interest |
| Service emails, status messages, notifications | Performance of the contract |
| Product improvement using aggregated, pseudonymised data | Legitimate interest |
| Direct marketing by email to customers | Legitimate interest; you can always unsubscribe via the opt-out link |
4. Retention periods
- Account data: up to 30 days after the subscription ends (the data export window), after which it is deleted or pseudonymised.
- Invoicing and payment data: 7 years (Dutch statutory tax retention, art. 52 AWR — the Dutch State Taxes Act).
- Security logs: 12 months, aggregated thereafter.
- Content you upload: for as long as your subscription runs, plus the 30-day export window. We do not keep back-ups indefinitely without your instruction.
5. Who we share data with
We share personal data only with parties that are necessary for the performance of our services:
- Paddle.com Market Limited ("Paddle") — our Merchant of Record for sales to customers outside the EU. Paddle processes credit card and payment data on our behalf and is itself the controller for the payment step. See Paddle’s privacy statement.
- Hosting and infrastructure suppliers within the EU (the Netherlands and Germany). No transfer outside the EEA without appropriate safeguards (GDPR chapter V).
- Our accountant for the annual accounts; aggregated financial data only.
- Payment service providers for SEPA direct debit and iDEAL (the Dutch online payment method) within the EU.
- We provide data to third parties only where this is required by law (for example to law enforcement acting under a valid power).
We do not sell personal data, and we do not use it for profiling with automated decisions attached to it.
6. Security
We take appropriate technical and organisational measures: encryption in transit (TLS 1.2+), encryption of sensitive fields at rest, 2FA, separated test and production environments, audit logs, and a restricted and traceable access policy. In the event of a data breach that poses a risk to data subjects, we report it within 72 hours to the Autoriteit Persoonsgegevens (the Dutch data protection authority) and — where legally required — to you.
7. Your rights
Under the GDPR you have the right to:
- Access the personal data we process about you.
- Rectification of inaccurate or incomplete data.
- Erasure of data (the "right to be forgotten"), insofar as statutory retention periods allow.
- Restriction of the processing.
- Objection to processing based on legitimate interest.
- Portability of your data in a common machine-readable format.
- Lodging a complaint with the Autoriteit Persoonsgegevens, the Dutch data protection authority (autoriteitpersoonsgegevens.nl).
Requests via info@lsqapps.com. We respond within four weeks.
8. Cookies and similar techniques
On this website we use only functional cookies that are strictly necessary to display and secure the pages. We place no tracking or marketing cookies and use no third-party analytics tools. We do count ourselves how often a page is viewed, so that we know which subjects people are looking for. For that we record only the path of the page and the date — no IP address, no cookie, no characteristic by which you could be recognised, and no data about where you came from or where you go next. That count is therefore not personal data and is shared with no one. Inside the signed-in platform at lsqapps.com additional session cookies apply; those are described in the in-app cookie statement.
9. Changes
We may amend this privacy statement. The most recent version is always at lsqapps.com/en/privacy, with the version date at the top. We notify signed-in users of substantial changes by email.
10. Contact
Questions about this statement or about your data? Email info@lsqapps.com or write to Oostsoft Pro B.V., trading as LSQapps, Boterdiep ZZ 27, 9781 GP Bedum, the Netherlands.