Privacy Statement

This is a courtesy translation. The Dutch version at /privacy is the legally binding text.

Last updated: 15 June 2026

At Aeruga we handle your data with care. In this statement we explain which personal data we process when you visit our website, create an account or buy a work from us, why we do so and what rights you have. We keep it as clear as possible.

Who we are

Aeruga is a brand of Lucien Digital Systems B.V., established in Rekken and registered with the Dutch Chamber of Commerce (Kamer van Koophandel) under number 98364065. We are the data controller for the personal data processed via aeruga.com. Our full company details, including our place of business and our VAT identification number, can be found on the contact and colophon page of the site.

Do you have a question about this privacy statement, or would you like to submit a request regarding your data? Email us at info@luciendigitalsystems.nl. That is also the address for all your privacy requests.

We have not appointed a data protection officer; for a service of this size that is not mandatory. For all your privacy questions you can reach us at the email address above.

Which personal data we process

Depending on how you use Aeruga, we process the following data.

• Account data. If you create an account, we process your email address and, if you provide it yourself, your name. You log in via a login link (magic link), so we do not store a password.
• Purchase data. If you buy a work, we process which work you bought, the amount, the status of the payment and the payment ID from our payment service. We also need this data for our records.
• Payment data. Your payment is processed via our payment service Mollie. We do not receive full payment card details; Mollie processes those itself. We only see whether a payment has succeeded or failed.
• Download data. We keep a limited log of the downloads of purchased works, for example the time and which work it concerns. This allows us to detect misuse and to account for ourselves.
• Newsletter data. If you sign up for our newsletter, we process your email address and the confirmation of your sign-up. We use a double opt-in: your sign-up only becomes active after you have clicked the confirmation link in our email.
• Technical data. When you visit the website, we process a limited set of technical data that is necessary to make the site work and to secure it, for example the session data that keeps you logged in. When you use a public form, such as the newsletter sign-up form, we additionally process your IP address briefly to prevent misuse and automated sign-ups.

Do you have to provide this data?

To create an account and buy a work from us, we need your email address and the associated purchase data. This is necessary in order to enter into and perform the agreement with you. If you do not provide this data, we cannot create an account for you and cannot complete the purchase and delivery. For our records, we are additionally legally obliged to retain certain transaction data. Providing your name and signing up for the newsletter are voluntary; no account or purchase depends on them.

What we use personal data for

We use your data for the following purposes.

• Creating and managing your account and enabling you to log in.
• Handling your purchase: the payment, the delivery of the purchased work and making downloads available.
• Sending transactional email, such as your login link, a confirmation of your purchase or a service notice about your order.
• Keeping our records and complying with our statutory retention obligation.
• Sending our newsletter, if you have signed up for it.
• Securing the website and detecting and preventing misuse, including via the download log and the brief processing of your IP address on public forms.

On which legal bases we do this

For each processing operation we have a legal basis under the General Data Protection Regulation (GDPR).

• Performance of the agreement (Article 6(1)(b)). For your account, handling your purchase, the delivery of the purchased work and the associated service notices, such as your login link and the confirmation of your purchase.
• Consent (Article 6(1)(a)). For sending our newsletter. You give this consent voluntarily and you can withdraw it at any time (see below under Your rights).
• Legitimate interest (Article 6(1)(f)). For securing the website, detecting and preventing misuse, the download log and the brief processing of an IP address on public forms. Our interest in this is protecting our content, our income and the proper functioning of the service. We have weighed that interest against your privacy. Would you like to know how that balancing was carried out, or do you want to object? You can; see Your rights.
• Legal obligation (Article 6(1)(c)). For retaining our records on the basis of the fiscal retention obligation.

Retention periods

We do not retain your data longer than is necessary for the purposes set out above.

• Account and purchase data we retain for as long as you have an account with us. If you delete your account, we delete or anonymise this data, except for the data we are legally required to retain for longer.
• Records and transaction data that fall under the fiscal retention obligation we retain for as long as the law prescribes, in principle seven years. This data is therefore retained even if you delete your account.
• Newsletter data we retain until you unsubscribe or withdraw your consent.
• The download log we do not retain longer than is necessary for misuse protection and accountability, and we clear it out periodically; in principle we delete or anonymise this data within twelve months.
• The IP address that we process on public forms we use solely for misuse protection and we do not retain it longer than is necessary for that purpose.

With whom we share data

We do not sell your personal data. We share it only with parties that help us deliver our service, and only insofar as that is necessary. We work, among others, with the following parties.

• Supabase, for the database, the authentication (logging in) and the storage of files.
• Vercel, for the hosting of the website.
• Mollie, for handling payments.
• A specialised email service, which sends transactional email on our behalf and, if you have signed up, the newsletter.
• A privacy-friendly analytics service, which measures in broad terms how the site is used, without tracking cookies and without following you across websites.

With parties that process data on our behalf, we set out in a data processing agreement how they handle your data, before the processing begins.

Mollie also processes data for the payment itself. For that part Mollie co-determines its own purpose and means and Mollie may be a controller in its own right. The privacy policy of Mollie applies to that part.

In addition, we may share data where we are legally obliged to do so, for example following a lawful request from a competent authority.

Transfers outside the EU/EEA

We preferably process your data within the European Economic Area (EEA). A number of our service providers have a parent company outside the EEA, which means it may occur that data is processed outside it.

If that happens, we ensure appropriate safeguards in accordance with the GDPR, such as a valid adequacy decision adopted by the European Commission or the standard contractual clauses approved by the European Commission. In this way your data protection remains at an equivalent level. Would you like to know more about the safeguards for a particular service, or receive a copy of the safeguard used? Then send us a message at info@luciendigitalsystems.nl.

Cookies and statistics

We are sparing with cookies. We only place cookies that are necessary to make the website work properly, such as a cookie that remembers your logged-in session. No consent is required for such functional cookies, and we therefore do not display a cookie banner.

For statistics we use a privacy-friendly approach. In doing so we place no tracking cookies and do not follow you across websites. We only measure in broad terms how the site is used and how well it works, so that we can improve it. We do not build a profile of you with it and do not use the data to treat visitors differently. Our analytics service processes this data only for us and not for its own purposes, processes no or anonymised IP addresses, does not link the data to advertising or tracking services, and we conclude a data processing agreement with that service.

As long as we use exclusively functional cookies and this privacy-friendly, cookieless analytics, we do not have to ask for your consent and we do not display a cookie banner. Should we later wish to deploy tracking or marketing cookies, we will first ask for your consent.

We load our fonts from our own environment. We use no external font servers for this, so that your IP address does not go there.

Security

We take appropriate technical and organisational measures to protect your data against loss and unauthorised access. For example, we use signed, temporary download links for purchased works, we keep our sensitive keys exclusively on the server side, and the database is set up so that you can only access your own data.

No service is completely invulnerable, but we do everything we can to keep the risks as small as possible and to keep our measures up to date.

If, despite our measures, a data breach should nevertheless occur, we report it within 72 hours after we have become aware of it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), where that is mandatory. If the breach is likely to result in a high risk to you, we also inform you, without undue delay.

Your rights

Under the GDPR you have a number of rights with regard to your personal data.

• Access. You may request which data we process about you.
• Rectification. You may have inaccurate data corrected.
• Erasure. You may ask to have your data erased, insofar as we are not legally obliged to retain it.
• Restriction. You may ask to temporarily restrict the processing of your data.
• Objection. You may object to processing based on our legitimate interest.
• Portability. You may ask to receive the data you have provided to us in a common format or to have it transferred.
• Withdrawing consent. If you have given consent, for example for the newsletter, you may withdraw it at any time. You do this via the unsubscribe link in every newsletter or by sending us a message. What we had already processed before then remains lawful.

You can send your request to info@luciendigitalsystems.nl. Submitting a request is free of charge. Only in the case of a manifestly unfounded or excessive request, for example if you submit the same request repeatedly, may we charge a reasonable fee or refuse the request.

To protect your data, we may ask you to confirm your identity before we carry out your request. We keep that check proportionate and do not ask for unnecessary data, such as a copy of your identity document with your citizen service number (BSN) or photo. In principle we respond within one month of receiving your request. If your request is complex, or if we receive several requests at the same time, we may extend this period by a maximum of two months; in that case we will let you know within the first month, together with the reason for the extension.

We do not let a computer make decisions in your place that affect you legally or have a similarly significant impact on you. We do not engage in profiling with such consequences.

Complaints

Are you dissatisfied with how we handle your data? Let us know first at info@luciendigitalsystems.nl, and we will look for a solution together. In addition, you always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), the Dutch supervisory authority in the field of privacy, via autoriteitpersoonsgegevens.nl. If you live or work in another EU country, you can also lodge your complaint with the supervisory authority there.

Changes to this privacy statement

We may amend this privacy statement from time to time, for example if our service or the regulations change. You will always find the most current version at aeruga.com. In the event of significant changes we will inform you clearly there, for example by email or with a notice on the site. At the top of this statement you will see when it was last updated.