Privacybeleid

1. What is personal data?

The General Data Protection Regulation (GDPR/AVG) states that personal data is any information about an identified or identifiable natural person. This means that the information relates directly to someone or can be traced back to that person. 'Personal data' is therefore a broad concept. Think, for example, of your name, telephone number and other contact details.

2. The purpose of this privacy and cookie statement

With this privacy statement we inform you about the way in which Webosa collects, uses and protects your personal data. We also explain how we comply with privacy legislation such as the GDPR. Please read this statement carefully, so that you know how we handle your personal data.

3. The use of your personal data

We only use your personal data for the purpose for which the data was obtained by us. In this case, because of your visit to our website, because you are a customer of ours or because you wish to place an order. We inform you about our privacy and cookie statement via our website.

4. For which purposes do we process your personal data?

4.1 In order to process orders placed via our website

As soon as you have placed an order, we process data such as: gender, first and last name, address details, telephone number, e-mail address and (if applicable) VAT number. Do you have a personal account? In that case the data is (also) stored in your account. We also store information about previous orders and/or cancellations in your account. This enables us to help you more quickly. As soon as you place, change or cancel an order, you always receive a confirmation from us by e-mail.

Invoicing and payments take place via our invoicing and payment partner Moneybird, by bank transfer or direct debit (SEPA). In doing so, we process the necessary invoicing and payment data. This is necessary for the conclusion or performance of an agreement (Article 6(1)(b) GDPR).

4.2. To create and maintain your personal account

An account is created for you, so that you can make full use of your services. An account contains personal data such as your first name, surname, address, place of residence, telephone number, e-mail address, previous orders and/or current contracts. This purpose is necessary for the conclusion or performance of an agreement (Article 6(1)(b) GDPR). You can change the personal data you provide via your account whenever you wish.

4.3. For customer service: handling questions, comments and complaints

You can reach us via the contact form, e-mail, WhatsApp and social media. Webosa works entirely remotely; we do not offer a telephone desk. In order to help you straight away, we use the data available in our customer relationship system, such as your contact details and purchase history. We may use contact logs with our customer service to improve our services.

Applications. If you apply via our form, we process the data you send us yourself: your name, e-mail address, motivation and any CV you attach. We use these solely to assess your application and to communicate with you. The legal basis is your consent and our pre-contractual relationship (Article 6(1)(a) and (b) GDPR). The file is transmitted encrypted and the temporary copy on our server is automatically deleted within seven days.

The data we use for this purpose is necessary for the conclusion or performance of an agreement (Article 6(1)(b) GDPR) and/or our legitimate interest (Article 6(1)(f) GDPR).

4.4. For analyses and for the development of our website, products and services

We sometimes approach you for customer surveys, for example to measure your satisfaction. Your feedback and (online) customer behaviour are very valuable to us in order to be able to improve our services. We always give you the opportunity to unsubscribe from such customer surveys via support. The legal basis is our legitimate interest in efficient business operations (Article 6(1)(f) GDPR).

Our website uses functional and necessary cookies that are needed to make the website and the ordering process work. For visitor statistics we use Umami, a privacy-friendly analytics service that places no cookies and stores no personal data or IP addresses. Only aggregated figures are recorded, such as the number of visits per page; we cannot trace these back to you. We place no marketing or advertising cookies and use no third-party tracking services. Because no cookies requiring consent are used, we do not display a cookie consent banner. You can read more about the cookies we use in the cookie statement further on.

4.5. For sending offers, news and promotions by e-mail

You only receive marketing messages from us if you have given your consent for this, or if you have purchased products or services from us and have not indicated that you do not wish to receive the marketing messages. For sending and managing our newsletters we use Brevo. Would you prefer not to receive a newsletter any more? You can unsubscribe by clicking 'Unsubscribe' at the bottom of the newsletter.

We also process some data without you directly noticing it. For example when you read our electronic (news)letters. We collect this data by means of e-mail pixels. With the help of the e-mail pixels we know whether and when an e-mail has been opened and which links in the e-mail have been clicked. This tells us how effective and relevant our newsletters are and enables us, in time, to send a more personalised selection of news and/or offers and to tailor these to your interests.

If you do not want us to use an e-mail pixel, that is of course no problem. You can indicate this via our contact form. In that case you will no longer receive personalised newsletters and/or offers. The legal basis is our legitimate interest (Article 6(1)(f) GDPR).

5. With whom do we share your personal data?

Webosa does not sell or trade your personal data to third parties. We may, however, share certain personal data with external suppliers (such as a processor) or government authorities for the purposes described above. This takes place in accordance with relevant legislation.

6. Suppliers

In limited cases, a specific supplier may assist us in processing your personal data. We conclude data processing agreements with such suppliers. We do this so that it is properly recorded that they secure personal data correctly and that they report to us in good time in the event of (a suspicion of) a data breach.

7. Government authorities

Webosa may be legally obliged to share some personal data with government authorities. It may also be necessary for Webosa to transfer your personal data in order to protect Webosa's rights. This too takes place in accordance with the relevant legislation. For example, we may share data with government authorities if we are of the opinion that your actions are not in accordance with the law, our terms and conditions or our policy, and in order to protect the rights, property and safety of Webosa and others. In that context, we always report misuse or evidently illegal activities.

8. Where do we store your data?

To obtain and retain certain data, we use various applications. In order to safeguard your privacy, we select our suppliers carefully and these applications are bound by strict rules. Most data is stored within the European Union (EU).

9. Storage outside the EEA

For the data that is transferred outside the EEA (European Economic Area), we only work with parties that offer sufficient protection according to the European rules. If we (possibly via our external service providers) process your data outside the EEA, we ensure appropriate protection of your personal data. For example by using special contracts (standard contractual clauses).

10. What are your rights?

You have the right to be properly informed about what we do with your data and why we need your data. We do this via this privacy statement. In addition, you have the following rights:

• right of access (if you want to know which data we collect about you);

• right to rectification (we are happy to correct any data that is no longer accurate);

• right to be forgotten (in some cases you can ask us to delete your data);

• right to restriction of processing (in some cases you may ask us to restrict the processing of your data);

• right to data portability (if you wish, we can pass your data on to another party or give you a copy of your data);

• right to object (in some cases you may object to the use of your data).

11. Exercising your rights

Would you like to exercise one of your rights? Please contact us via the contact details below. We are happy to help you exercise your rights. If we have good reasons to refuse your request, we will explain why this is the case.

12. Cookies

Cookies are small files that may be stored on your device when you visit the website. Webosa uses exclusively functional and necessary cookies. These are needed to make the website and the ordering process work and to manage your session and security. Our visitor statistics run on Umami, which places no cookies and processes no personal data: nothing is stored on your device and no profile can be linked to you. We place no marketing or advertising cookies and use no third-party advertising or tracking services. Because no cookies requiring consent are used, we do not display a cookie consent banner.

13. Enabling or disabling cookies

In your browser you can restrict or delete the storage of cookies. Because we only use necessary cookies, this may cause the website to work less well. Please consult your browser's manual for the settings.

15. Use of Cloudflare Turnstile

In order to prevent misuse, spam and automated attacks, we use Cloudflare Turnstile on parts of our website, forms and customer portals.

Turnstile is a security service from Cloudflare, Inc. that helps distinguish between real visitors and automated traffic (bots). In doing so, limited technical data is processed, including:

• IP address

• Browser and device information

• TLS fingerprint

• User-Agent data

• Interaction and security signals

This data is used exclusively for:

• protecting our website and services;

• preventing spam, misuse and fraudulent activities;

• improving bot detection and security.

According to Cloudflare, the signals collected are not used to identify individual visitors personally.

The processing of this data is based on our legitimate interest in securing our website, systems and users.

More information:

• Cloudflare Privacy Policy

• Cloudflare Turnstile Privacy Addendum

16. How long do we retain your data?

We do not retain personal data for longer than is necessary for the purposes for which we process it, or for as long as a statutory retention obligation requires:

• Account and service data: for the duration of your services and thereafter for up to 2 years, unless longer retention is necessary.
• Invoicing and payment data: 7 years, on the basis of the statutory tax retention obligation.
• Contact and support messages: up to 2 years after handling.
• Newsletter: until you unsubscribe.
• Application data and CVs: up to 4 weeks after the procedure ends, unless you give us permission to keep them longer.

17. Controller and contact

The controller for the processing operations described in this statement is Webosa (KvK 84291648). Do you have a question about your privacy or would you like to exercise one of your rights? Please contact us via the contact form on our website.

18. Complaint to the Dutch Data Protection Authority

Do you disagree with how we handle your personal data? You always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl). We would appreciate it if you would contact us first, so that we can resolve the matter together.