Version 2.0 — effective 14 October 2026. Replaces the version of 01-11-2025.
This policy explains what personal data Managed FreeScout processes, why, and what rights you have. Short version: our modules run on your own server and your helpdesk conversations stay there. We only receive the data needed to sell, license, update and support our modules, and — for MFS Connect — the data needed to sign agents in from Microsoft Teams and deliver Teams notifications.
1. Who we are
Managed FreeScout is a trade name of StackPros B.V., De Wel 20, 3871 MV Hoevelaken, the Netherlands, Chamber of Commerce (KvK) 97689173. StackPros B.V. is the controller for the processing described in this policy, except where section 2 says we act as a processor.
Our checkout, invoices and your customer account run on invAIse (app.invaise.com), our own billing platform, also operated by StackPros B.V. It is not a third party: the same controller and the same rules in this policy apply.
Privacy questions and requests: info@managedfreescout.com. We have not appointed a Data Protection Officer; we are not required to.
2. Our two roles
- Controller. For our website, your account, orders, invoices, support, licence checks and module updates, we decide why and how data is processed.
- Processor. When MFS Connect signs your agents into FreeScout from Microsoft Teams or sends them Teams notifications, we process those agents' data on behalf of the organisation that bought the subscription. That organisation is the controller. The Data Processing Annex in our Terms of Service governs this.
Are you a support agent using MFS Connect at work? Your employer decides how your data is used. Please send requests to them first; we will help them answer.
3. What our modules send to us — and what they don't
Our modules are installed on your own FreeScout server. Your conversations, customers, attachments and mailbox contents stay on your server and are never sent to us, with these exceptions:
- Licence check. Every 6 hours, a module sends its licence key, the URL of your FreeScout installation, the module name and version, and (technically unavoidable) your server's IP address to our licence server.
- Updates. FreeScout downloads module updates from GitHub (github.com). GitHub then sees your server's IP address. GitHub acts as an independent controller under its own privacy statement.
- MFS Connect. This module only works together with our hosted service at app.managedfreescout.com. See section 4, row "MFS Connect".
4. What we process, why, and for how long
| Activity | Personal data | Purpose | Legal basis (GDPR art. 6) | Retention |
|---|---|---|---|---|
| Visiting our website | IP address, browser, pages visited | Running and securing the website | Legitimate interest | Server logs 14 days |
| Blog comments | Name, email and comment of earlier comments (new comments are no longer accepted) | Showing earlier comments | Consent (you choose to comment) | As long as the comment is published; ask us to remove it at any time |
| Contact forms and support | Name, email, your message, attachments, technical details you share | Answering questions and support requests. Contact forms are sent to us by email and not stored on the website | Legitimate interest; contract where you are a customer | 2 years after last contact |
| Account, orders and subscriptions | Name, company, email, address, country, language, VAT number with VIES check result and date, business or consumer status, orders, subscriptions, number of users, invoices | Concluding and performing the contract, correct VAT treatment, invoicing | Contract; legal obligation (tax) | Invoices and accounting records 7 years (Dutch tax law); other account data 2 years after the last subscription ends |
| Proof of acceptance | Date and time, IP address, browser (user agent), language, the exact texts accepted and the versions of the Terms and Privacy Policy | Proving what you agreed to | Legitimate interest; legal obligation | 7 years, together with the related invoices |
| Customer portal | Email, one-time login links, sessions | Logging in to your account without a password | Contract | Login links and sessions are short-lived |
| Payments | Stripe customer and payment IDs. Card details are processed by Stripe only, never by us | Collecting payments | Contract | As account data; payment records 7 years |
| Invoice and service emails | Name, email, delivery status (delivered, bounced), and whether and when you opened the email or clicked a link in it, with IP address and device type | Sending invoices, security notices, update and billing messages | Contract (sending); legitimate interest in knowing that invoices and important notices have been received (delivery and open/click data). You can object at any time | Until the related invoice is paid plus 6 months; for other emails 6 months |
| Licence management | Licence key, installation URL(s), module and version, server IP address | Activating modules, enforcing the purchased number of installations, preventing misuse | Contract; legitimate interest | Duration of the subscription; licence-check logs 8 weeks |
| MFS Connect — installation link | FreeScout URL, licence key, Microsoft 365 tenant ID, time of connection | Linking a Microsoft 365 tenant to the right FreeScout installation | Contract | Duration of the subscription |
| MFS Connect — sign-in (we act as processor) | Microsoft user ID, email address, and name where FreeScout accounts are created automatically at first sign-in | Signing agents into FreeScout from Teams without a password | On behalf of the customer (art. 28 GDPR) | Maximum about 1 day, then deleted automatically |
| MFS Connect — seat holders (we act as processor) | Microsoft user ID, email address, FreeScout URL, first and last use | Counting users against the purchased number of seats | On behalf of the customer (art. 28 GDPR) | Until the seat is freed, at the latest 30 days after the subscription ends |
| MFS Connect — Teams notifications (we act as processor) | Ticket subject, ticket number, name of the colleague who acted | Showing notifications in the agent's Teams activity feed via Microsoft Graph | On behalf of the customer (art. 28 GDPR) | Not stored; only passed through to Microsoft |
| MFS Connect — service logs (we act as processor) | Email address, Microsoft IDs, ticket numbers | Troubleshooting and security | On behalf of the customer (art. 28 GDPR) | 8 weeks |
| Marketing emails | Name, email | News about our modules | Consent, or for existing customers our legitimate interest (similar products), always with a one-click opt-out | Until you opt out |
Backups of our systems are encrypted and overwritten within 30 days, so deleted data disappears from backups within that period.
We do not use automated decision-making or profiling with legal or similarly significant effects.
5. Cookies
- Necessary cookies only. Our website and customer portal use cookies that are needed for them to work, such as session and login cookies. They need no consent.
- No analytics or advertising cookies. We do not track visitors for statistics or advertising, so we do not show a cookie banner.
- Fonts are loaded from our own server, not from third parties.
- Spam protection on our forms uses a hidden check field. It needs no cookies and sends nothing to third parties.
- Our emails (invoices and service messages, sent through Brevo) contain a small tracking image and tracked links. They tell us whether an email was delivered and opened and whether a link was clicked, so we know invoices and important notices have arrived. We use this only for that purpose, never for advertising profiles. Want us to stop? Email info@managedfreescout.com and we will no longer use open and click data for your account.
If we ever add cookies that need consent, we will ask for it first and update this section.
6. Who we share data with
We never sell personal data. We only share it with parties that help us provide our services, under a data processing agreement, or where the law requires it.
| Recipient | Role | What for | Location |
|---|---|---|---|
| mijn.host B.V. | Processor | Hosting of all our servers (website, invAIse, MFS Connect hub, licence server), databases and mail server | Netherlands |
| Hetzner Online GmbH | Processor | Encrypted off-site backups | Germany |
| Brevo | Processor | Sending invoice and service emails | France |
| Stripe | Processor; independent controller under payment regulation | Payment processing | Ireland / USA |
| Microsoft | Processor | For MFS Connect: validating Teams sign-ins and delivering Teams notifications (Microsoft Graph) | Ireland / USA |
| Our accountant and bookkeeping software (Basecone, Exact Online) | Processor | Bookkeeping and tax filings | Netherlands |
| Tax authorities, courts, police | Independent controller | Only where we are legally obliged | Netherlands |
We check VAT numbers through the European Commission's VIES service.
When we change a processor that handles customer data through MFS Connect, we inform customers in advance as described in the Data Processing Annex.
7. Transfers outside the EU
Some providers (Stripe, Microsoft, GitHub) are based in the United States. Transfers to them rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses. Our own infrastructure runs on servers in the Netherlands.
8. Security
We protect personal data with measures appropriate to the risk, including:
- encrypted connections (HTTPS/TLS) everywhere;
- secrets such as backend secrets and API keys encrypted at rest;
- short-lived, single-use, signed sign-in tokens for MFS Connect, stored only as a hash;
- separate test and production environments, with no customer data in test;
- access to production systems restricted to authorised staff, using key-based authentication;
- daily encrypted off-site backups in the EU, of which only the last 14 are kept.
If a data breach is likely to put your rights at risk, we report it to the Dutch Data Protection Authority within 72 hours and inform affected people and customers without undue delay.
9. Your rights
You have the right to access, correct, delete, restrict and port your personal data, to object to processing based on legitimate interest, and to withdraw consent at any time. Email info@managedfreescout.com. We answer within one month and may ask you to verify your identity.
You can also lodge a complaint with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) or the authority in your own country.
10. Children
Our products are not intended for children. We do not knowingly collect data from children under 16.
11. Changes to this policy
We may update this policy. The version date at the top shows the current version. Customers are informed by email of material changes before they take effect.
12. Contact
StackPros B.V. — Managed FreeScout, De Wel 20, 3871 MV Hoevelaken, the Netherlands. Email: info@managedfreescout.com.