GDPR Privacy Statement
URETEK Benelux BV
Zuiveringweg 93
NL-8243 PE Lelystad
Chamber of Commerce: 39046022
URETEK Benelux BV
Meersbloem-Melden 46
B-9700 Oudenaarde
KBO: pending
Ter Huurne Beheer BV
Zuiveringweg 93
NL-8243 PE Lelystad
Chamber of Commerce: 39052508
Lelystad, 25 May 2018
Legal basis:
All personal data obtained will be used for the performance of a contract between both parties. This data will be processed accurately in our ERP system.
Personal data refers to any information that can be used to identify an individual: name, gender, telephone number, address, email address, photographs, etc.
We will only disclose data to third parties if this is necessary for the performance of our contract with you or to comply with a legal obligation. We work with various partners, where the data is stored and/or processed for URETEK’s internal purposes. Data processing agreements have been concluded with these partners. These partners include the suppliers of our ERP system, our system administrator, our marketing partner, and our accountants and HRM advisers.
Purpose:
We use personal data to be able to telephone, write to or email the data subject where this is necessary to provide our services.
The data obtained will be used for the relevant agreement; this may include the agreements listed below.
Newsletter: Once you have subscribed to the newsletter, only your name and email address will be stored in our Mailchimp mailing system, managed by our marketing partner Sablebonne Communications. This data will only be used to send the newsletter.
You can therefore only subscribe or unsubscribe via the unsubscribe link in the newsletter, via our website, or via the following links:
– Subscribe to the newsletter (Netherlands)
– Subscribe to the newsletter (Belgium)
– Unsubscribe from the newsletter (Netherlands)
– Unsubscribe from the newsletter (Belgium)
This registration process complies with all legal requirements. We are unable to subscribe or unsubscribe you from this list in any other way.
Our website and/or service does not intend to collect data about website visitors under the age of 16, unless they have permission from a parent or guardian. However, we cannot verify whether a visitor is over 16. We therefore advise parents to be involved in their children’s online activities to prevent data about children from being collected without parental consent. If you believe that we have collected personal data about a minor without such consent, please contact us at boekhouding@uretek.nl, and we will delete this information.
Request for a quotation, price estimate or advice: When a request is made, the data requested and obtained is stored and processed in the ERP system. A ‘project’ will then be created, containing all the information we deem necessary to prepare a quotation, price estimate or advice. Based on the information obtained, a quotation, price estimate or advice will be drawn up and sent to the customer at the email address provided, and/or discussed with the customer by telephone or in person.
Order confirmation: Upon acceptance of the quotation, an order confirmation will be sent to the customer, setting out the work to be carried out and the completion date.
Other communication: We will respond to any enquiries and requests received by telephone, email or post. The data may be stored in our ERP system.
Duration of storage:
Newsletter: Name and email address are stored for as long as the customer remains subscribed to the newsletter.
Request for a quotation, price estimate or advice: all data will be retained until the customer notifies us that they are exercising their right to be forgotten. See the following section for further details on the procedure.
Work carried out: All information relating to the quotation, the work carried out and the invoicing will be retained for at least the 30-year warranty period on the materials. If there is no warranty period, the statutory retention period of 7 years applies. Should a customer exercise their right to be forgotten, the data will be deleted after this period in accordance with the procedure described in the following paragraph.
Other communications: telephone notes and email correspondence will be retained for as long as this information may be of any use to us or until the data subject exercises their right to be forgotten. See the following paragraph.
Right of access, rectification or erasure of personal data:
Once you have provided personal data, you have the right to access, rectify or have the information deleted. You may exercise this right by sending a request to the email address boekhouding@uretek.nl.
If you wish to access your personal data, this will be provided to you by email within 4 weeks.
If you wish to have your data rectified, this request will be assessed by management. Within 4 weeks, management will contact the applicant to discuss the rectification and subsequently carry it out.
If you exercise your right to be forgotten, the loyalty card will be blocked within 4 weeks for all staff except management. All requested data will be deleted, provided this does not affect the statutory retention period or warranty period. Should this be the case, only the data necessary for the warranty and statutory obligations will be retained.
The following data is exempt and will remain accessible only to management:
- Data that must be retained by law
- Data required for the warranty provided
- Data required for internal reporting (such as turnover analyses, project administration, application analyses, etc.)
To ensure that the request for access has been made by you, we ask you to include a copy of your identity document with your request. In this copy, please black out your passport photograph, the MRZ (machine-readable zone, the strip of numbers at the bottom of the passport), your passport number and your Citizen Service Number (BSN). This is to protect your privacy.
Right to lodge a complaint:
If you have a complaint regarding the use of your personal data, you can report this to the Technical Adviser responsible for your project or quotation. Their details and how to contact them are listed at the top of the quotation. If you have not received a quotation but wish to make a complaint regarding the newsletter or another registration, you can report this via the email address boekhouding@uretek.nl.
Should we fail to resolve your complaint to your satisfaction, you may report this to the Dutch Data Protection Authority by completing their form. You may also choose to take the matter directly to court. Further information is available via this link.
How we protect personal data:
We take the protection of your data seriously and take appropriate measures to prevent misuse, loss, unauthorised access, unwanted disclosure and unauthorised alteration. If you feel that your data is not properly secured or there are indications of misuse, please contact Jean Keulers or Sandra ter Huurne.
Cookies or similar technologies we use:
We only use technical and functional cookies, as well as analytical cookies that do not infringe on your privacy. A cookie is a small text file that is stored on your computer, tablet or smartphone when you first visit this website. The cookies we use are essential for the technical functioning of the website and for your convenience. They ensure that the website works properly and, for example, remember your preferences. They also enable us to optimise our website. You can opt out of cookies by configuring your web browser so that it no longer stores cookies. In addition, you can also delete any information previously stored via your browser settings.
Data breach notification obligation:
The GDPR requires that any data breaches be reported to the Dutch Data Protection Authority by the data controller.
Definition of a data breach
We use the GDPR and the Policy on the Obligation to Report Data Breaches as a guide when determining what constitutes a data breach. A data breach includes all security incidents that result in the protection of personal data being compromised at any time, or that expose personal data to loss or unlawful processing. Examples include the loss of a USB stick or computer, a hack, the sending of an email in which the email addresses are visible to all recipients, a malware infection or a disaster such as a fire in a data centre.
Notification to data subjects
If it transpires that a data breach has occurred, we will report this to the Dutch Data Protection Authority and/or the data subject(s).
If an investigation into the data breach is still ongoing to determine the nature of the breach, a description of the identified and suspected consequences of the breach, and the measures taken and to be taken to minimise and remedy the negative consequences of the data breach, a preliminary notification will be issued.
Once the data breach has been definitively established, all data subjects will be informed of the nature of the breach, a description of the identified and suspected consequences of the breach, and the measures taken to mitigate and remedy the negative consequences of the data breach.
Time limit for notification
The GDPR stipulates that notification must be provided ‘without undue delay’. According to the Dutch Data Protection Authority, this means without unnecessary delay and, where possible, no later than 72 hours after discovery. Unless we can demonstrate that the breach did not pose a risk to the personal data collected.
Progress and measures
We will keep those affected informed of the progress and the measures being taken.
Authorisations:
In both the ERP system and for access to our data servers, authorisations have been defined for all users, specifying the data to which a user has access. This depends on which data are required for the performance of the relevant role.
Furthermore, the AFAS ERP system, in conjunction with linked software, broadly determines the workflows to be applied, as well as which data are required for the tasks to be carried out and the necessary authorisations.
Changes:
The way in which we process personal data, and the nature or volume of data we process, may change. We therefore reserve the right to amend this privacy statement. Where possible, you will be notified of any changes. The most recent version can always be found at www.uretek.nl. We recommend that you visit this website regularly to keep up to date with any changes.