Privacy statement
Last updated: 15 November 2026
1. Who is responsible
a10mlk (sole proprietorship, KVK 42213098), J.H. Isingserf 37, 3766 HB Soest, the Netherlands, is responsible for your account data. Questions: info@a10mlk.com.
For the clients, quotes, invoices and other content you enter about your own clients, you are the controller and we are your processor (see the Terms of Service, section 5).
2. What we collect and why
| Data | Why | Basis |
|---|---|---|
| Name, email address, password (stored only as a hash) | Create and secure your account, send you verification and password-reset emails | Contract |
| What you enter in the app: clients, leads, quotes, invoices, expenses, hours, kilometres, settings | Run the service for you | Contract |
| Sign-in sessions and attempt counters (e.g. number of failed logins) | Keep you signed in and protect against abuse and password guessing | Legitimate interest (security) |
| Date you accepted the terms, and that you confirmed you are 18 or older | Show that you agreed | Legal obligation / legitimate interest |
| Your payment details, once paid plans exist | Handle payments. These go to the payment provider; we do not store card or bank details. | Contract |
We do not use advertising trackers, analytics tools or session-recording tools, and we do not sell your data. We do not make decisions about you by automated means.
3. Cookies and storage
We set one cookie that is needed to keep you signed in (__Host-wp). It is strictly necessary, so no cookie banner is required. It is deleted when you sign out and expires after 30 days. The app loads its fonts and scripts from its own servers, not from third parties, so visiting it does not send your IP address to other companies.
4. Who processes your data
| Party | What for |
|---|---|
| Cloudflare, Inc. | Hosting, database storage and sending our emails |
Cloudflare runs a global network, so your data can be processed outside the European Economic Area. Cloudflare relies on the safeguards the GDPR requires for that, such as standard contractual clauses. We will add a payment provider here when paid plans start, and tell you beforehand. We do not share your data with anyone else unless the law requires it.
5. How long we keep it
We keep your data while your account exists. If you delete your account, we delete your account and everything you entered. Database backups at our hosting provider can hold older copies for a limited time (up to about 30 days) before they disappear. If the law requires us to keep something, such as payment records, we keep only that, for as long as required.
6. Security
Connections are encrypted. Passwords are stored as salted hashes and sessions as hashes, so we cannot read your password. Every account's data is kept separate. No system is perfect: if there is a breach that affects you, we tell you and, where required, the Dutch Data Protection Authority.
7. Your rights
You can ask us to see, correct, delete or export your data, to restrict its use, or to object to it. You can delete your account and data yourself in Settings. For anything else, email info@a10mlk.com; we answer within one month. If you think we handle your data wrongly, you can complain to the Autoriteit Persoonsgegevens.
8. Age
A10Desk is for adults. You confirm that you are 18 or older when you sign up. We do not knowingly keep data of children. If you think a child has an account, tell us and we will delete it.
9. Changes
If we change this statement in a way that matters to you, we tell you by email. The date at the top shows the latest version.