How Adero handles personal data
Last updated 15 October 2026
This statement explains what personal data Adero holds, why, where it goes, how long it is kept, and what you can do about it. It is written to be read. If anything in it is unclear, write to us and we will explain.
1. Who we are
Adero B.V. i.o., a private limited company in the course of incorporation under the laws of the Netherlands, based in Amsterdam. Adero is the controller for the personal data described here. That means we decide why and how it is processed, and we are responsible for it.
We have not appointed a data protection officer, because the law does not require one for an organisation of our size and activities. Louis Botha is responsible for privacy at Adero. Questions go to hello@aderoworks.com.
2. Who this statement covers
- Clients, and the people at a client we deal with.
- People whose details appear in a client's financial records: employees, freelancers, suppliers, customers and funders. You may never have dealt with us directly. Section 4 explains how your data reaches us.
- People we speak to about working together, including people who answered our research.
- Visitors to aderoworks.com, and anyone who fills in a form here.
3. What we hold, why, and on what legal basis
| What | Why | Legal basis (GDPR art. 6) |
|---|---|---|
| Names, roles and contact details of the people we work with at a client | To deliver the work and communicate about it | Our contract with the client, and our legitimate interest in running the engagement |
| Financial records containing personal data: payroll totals, supplier and freelancer invoices, customer and funder records | To analyse the client's finances and report on them | Our legitimate interest, and the client's, in understanding and managing the client's business |
| Identity documents and ownership details of clients and their beneficial owners | To meet our client due diligence obligations, where they apply | Legal obligation under the Dutch anti-money-laundering act (Wwft) |
| Recordings and transcripts of conversations | To produce accurate notes of what was said | Your consent, asked before any recording starts. You may refuse or withdraw it at any time |
| Invoices and payment records | To bill and to keep our own accounts | Legal obligation to keep accounting records |
| Names, roles, organisations and what people told us about their needs | To follow up with people interested in working with us | Our legitimate interest in developing the business, where you were in touch with us or introduced to us |
| Answers to our market research | To understand what organisations like yours need | Your consent, given when you submitted your answers |
| Details you give us through a form on this website | To reply to you | Steps you asked us to take before any contract, or your consent |
Where we rely on legitimate interest, we have weighed it against your interests and rights. You can object at any time. Section 9 explains how.
We do not want sensitive data. We ask clients not to send us health information, citizen service numbers (BSN), or anything about why a person is absent. If it reaches us anyway, we delete it on receipt.
4. Where we get it from
Most of it comes from you, or from the client you work for or with.
If your details are in a client's financial records, you did not give them to us. The client or its accountant did, as part of the records we were asked to review. They may include your name, your role, amounts paid to or by you, and dates. We use them only to analyse the client's finances, we do not contact you, and we use them for nothing else.
5. Automated decisions
We do not make decisions about you by automated means alone. We use software, including AI tools, to help organise, summarise and draft our work. A person reviews every figure and every conclusion before anything leaves Adero, and no decision with legal or similarly significant effect on anyone is made by software.
6. Who we share it with
We do not sell personal data, and we do not share it for anyone else's marketing. We share it only with:
- Service providers who process it for us (section 7), under agreements that restrict how they use it.
- Our own professional advisers, such as our accountant and our insurer, where they need it and are bound by confidentiality.
- Authorities, where the law requires it.
Adero was founded together with V-Ventures B.V. and Stichting Veronica, who are investors in Adero. They do not receive client data and have no access to it.
7. Service providers, and where data goes
We store client files within the European Economic Area. Some of the tools we use process data outside it, in the United States. Where that happens, the transfer is covered by the European Commission's standard contractual clauses, or by the EU–US Data Privacy Framework where the provider is certified under it, and no provider may use your data to train its models.
| Provider | What for | Where it processes data |
|---|---|---|
| Anthropic (Claude), run in a European cloud region | Helping analyse and draft client work | European Union |
| Anthropic (Claude app) | Drafting our own material. Never client files | United States |
| Wispr Flow | Transcribing recorded conversations, only with consent | United States |
| Google Workspace | Email, calendar and documents | European Union and United States |
| Vercel | Hosting this website and its forms | United States |
| Resend | Sending email from this website's forms | United States |
| GitHub | Storing our internal working files, including notes on prospective clients | United States |
| Notion | Running our business: prospective clients, contacts and internal planning. Never client files | United States |
| OpenAI (ChatGPT) | Our AI assistants: preparing calls, keeping our calendar and planning our work. Not yet used on client files | European Union for storage. United States for processing and abuse monitoring |
| Supabase | Storing client files in our client portal, once it opens | European Union |
| Plausible Analytics | Counting website visits, without cookies or personal data | European Union |
We will tell a client before adding a provider that would process that client's confidential information outside the European Economic Area.
8. How long we keep it
| What | How long | Why |
|---|---|---|
| Client engagement files, including financial records and our working papers | Seven years from the end of the year in which the engagement ended | Our statutory retention obligation (art. 2:10 Dutch Civil Code and art. 52 AWR) |
| Client due diligence records | Five years from the end of the client relationship | Wwft art. 33 |
| Recordings of conversations | Deleted once the notes are approved, within 14 days | Consent was given for note-taking only |
| Notes and transcripts of conversations | With the engagement file, seven years | Part of our working papers |
| Details of prospective clients | Two years from our last contact, unless you become a client | No longer needed after that |
| Research answers | Two years from submission, or until you ask us to delete them | Consent |
| Messages sent through this website | One year from our last reply | No longer needed after that |
At the end of each period the data is deleted, or anonymised so that no one can be identified from it.
9. Your rights
You have the right to:
- see the personal data we hold about you and receive a copy;
- have it corrected if it is wrong;
- have it deleted, unless we are required to keep it;
- restrict how we use it while a question about it is resolved;
- receive it in a common electronic format, or have it sent to someone else, where we hold it on the basis of consent or contract;
- object to our using it where we rely on legitimate interest, and we will stop unless we have compelling grounds;
- withdraw your consent at any time, where we rely on consent. This does not affect anything done before you withdrew it.
Some records we must keep by law, in particular financial records for seven years. Where that applies, we will tell you, and we will keep the data only for the legal purpose and nothing else.
To exercise any of these rights, write to hello@aderoworks.com. We will reply within one month. If the request is complex we may need up to two further months, and we will tell you why within the first month. We may ask you to confirm your identity first.
10. Security
We protect personal data with encryption in transit and at rest, access limited to those who need it, separation between clients' data, and multi-factor authentication on our systems. We never ask for anyone's bank or accounting passwords. Where we keep a client's books, we use our own login to the accounting system, never theirs, and the client approves every payment in their own bank.
If a breach affecting your data creates a high risk to you, we will tell you without undue delay.
11. Complaints
If you are unhappy with how we have handled your data, please tell us first at hello@aderoworks.com.
You also have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl.
12. Changes
We will update this statement when what we do changes. The date at the top shows when it was last revised. Where a change materially affects clients, we will tell them directly.