Privacy statement of Alewijnse, version dated October 2018
Privacy Statement of Alewijnse
Alewijnse Holding B.V. (Chamber of Commerce number: 10037019), with its registered office at Energieweg 44 in Nijmegen (6541CX), and its subsidiaries (jointly: ‘Alewijnse’), are very concerned about preserving privacy as it conducts its activities. Alewijnse will set out in this privacy statement how it does this.
Alewijnse specifies the purpose for which and the means by which personal data is processed when carrying out its business activities. For this reason, Alewijnse will be regarded as a ‘data manager’. In this capacity, Alewijnse will strive to process all personal data lawfully, correctly
and transparently. Personal data will only be processed for a specific purpose and with a legal basis in accordance with article 6 of the General Data Protection Regulation. In addition, no personal data other than that which is necessary will be processed.
PURPOSE AND MANNER OF PROCESSING PERSONAL DATA
Personal data is data relating to an identified, or identifiable, individual. In other words, it must relate to a person (not a company) and the data must be unique to be able to identify a person. Personal data can also be combined to make it unique.
Alewijnse generally distinguishes between the following purposes for processing personal data.
Maintaining business relationships
Alewijnse exclusively targets the business market and completes projects for its customers. Within the context of processing orders, but also in the course of completing orders, Alewijnse gathers contact details such as names, telephone numbers and e-mail addresses of (potential) customers and suppliers. This data is stored in a database, subject to consent.
Alewijnse uses the database of contact details for customers and suppliers to maintain its business relationships. It is therefore possible that business associates will obtain information about the services of Alewijnse or invitations to events. The contact details will be deleted as soon as the person concerned no longer works for Alewijnse’s business relation.
Alewijnse processes personal data in its application procedure. Personal data of applicants is only processed with the consent of the applicant. This can include contact details, CVs, cover letters, diplomas, assessments and correspondence. Alewijnse will process this data solely insofar as this is relevant to the application procedure. The data will be deleted after four weeks, unless the applicant gives consent for the data to be stored for longer.
Alewijnse is supported by employment agencies and subcontractors when carrying out its activities. The personal data of temporary staff and the staff of subcontractors will only be processed based on an agreement and on the statutory obligations of Alewijnse in this respect. Alewijnse will request this data exclusively via the employment agency/subcontractor or from the person concerned directly. The following personal data will be processed by virtue of Alewijnse’s legal obligation to identify the persons and limit the recipient's liability and sequential liability of Alewijnse.
- Name and address details --> Number and period of validity of proof of identity
- Citizen service number --> A1 form, work permit, visa
- Nationality --> Copy of proof of identity (only if Foreign Nationals Employment Act applies)
In addition, this data may be disclosed to Alewijnse’s customer for the same purpose and/or to record the presence of staff on the work site as part of safety measures. In the latter case, a copy of the proof of identity may also be necessary. Alewijnse may also request proof of the qualities of a person deployed by a user company or subcontractor in the form of diplomas, certificates, etc.
The personal data processed within the context of recipient's liability and sequential liability (‘inleen- en ketenaansprakelijkheid’) will be kept for a maximum of 7 years in accordance with the retention obligation under fiscal regulations. Otherwise, personal data will only be kept for the duration of a project.
Cameras are installed on Alewijnse sites. These are used to secure the sites. Camera pictures will not be stored for more than four weeks.
In all cases, it is possible that personal data may be processed in countries outside of the European Economic Area (‘EEA’), if Alewijnse carries out work outside the EEA for example. Alewijnse will impose a sufficient level of protection on processors of personal data in third countries by concluding an agreement.
SECURITY AND RETENTION PERIOD
It is compulsory to take appropriate technical and organisational measures to prevent the loss of personal data or improper processing. Within this context, the systems in place at Alewijnse offer sufficient guarantees that personal data will be processed in the correct manner. Both physical and technical measures have been taken to prevent unauthorised processing. In addition, the systems containing personal data are only accessible to those employees who have been assigned the relevant rights.
Alewijnse will not share personal data with third parties, unless it is necessary, and if so only based on the law and subject to receipt of consent. In cases where personal data has been shared with third parties, Alewijnse will reach clear agreements on this.
Furthermore, Alewijnse will aim to ensure that any personal data that is processed is and remains correct. Personal data will not be stored for longer than necessary and will be deleted once the statutory retention periods have elapsed.
A person whose data is processed is referred to as a ‘data subject’ in the General Data Protection Regulation. A data subject has rights that Alewijnse and other bodies that process data must respect.
A data subject has a right to the following:
- Clear information on the processing being undertaken;
- Access to view the data being processed;
- Correction and amendment of data if it is incorrect and/or incomplete;
- Deletion of data (the right to be ‘forgotten’);
- Restriction of data processing – a data subject can request this if processing is incorrect, improper or unnecessary;
- To object against processing;
- Easy transfer of data (data portability);
- Not to be subject to automated decision-making processes.
If you wish to invoke these rights, then you can direct this request to firstname.lastname@example.org or to:
Alewijnse Holding B.V.
6500 AB NIJMEGEN
Requests will be dealt with within a month, unless more time is required for a request. You will be informed if this is the case. If your request is not handled to your satisfaction, then you can contact the Dutch Data Protection Authority.