Alewijnse Holding B.V. (Chamber of Commerce number: 10037019), established in Nijmegen (6541CX) at Energieweg 44 and its subsidiaries (jointly: 'Alewijnse') consider the safeguarding of privacy to be of great importance in the performance of its activities. In this privacy statement, Alewijnse explains how it does this.
Alewijnse determines for what purpose and by what means personal data are processed in the performance of its business activities. That is why Alewijnse is designated as a 'controller'. In this capacity, Alewijnse strives to process all personal data lawfully, properly and transparently. Personal data is only processed for a specific purpose and with a basis in accordance with Article 6 of the General Data Processing Regulation (GTC). No more personal data is processed than necessary.
Personal data is data relating to an identified, or identifiable, natural person. In other words, it must be a person (not an enterprise) and the data must be unique in order to identify a person. Personal data can also be combined to become unique.
Essentially, Alewijnse distinguishes the following purposes of processing personal data.
Alewijnse focuses exclusively on the business market and carries out projects for its clients. Alewijnse collects contact details, such as names, telephone numbers and e-mail addresses of (potential) clients and suppliers, in the context of acquiring orders, but also in the execution of assignments. These data are stored in a database as part of the execution of the order.
Alewijnse uses the database with contact details of clients and suppliers to maintain its business relationships. It is therefore possible for business relations to receive information about Alewijnse's services or invitations to events. The contact details will be deleted as soon as the person in question is no longer employed by Alewijnse's business relations.
Alewijnse processes personal data in its application procedures. The processing of applicants' personal data only takes place with the applicant's consent. This may include contact details, CVs, cover letters, diplomas, assessments and correspondence. Alewijnse processes these data only to the extent relevant for the application procedure. After four weeks, the data will be deleted, unless the applicant gives permission to keep the data for a longer period of time.
Alewijnse is supported by employment agencies and subcontractors in the execution of its activities. The personal data of hirers and the staff of subcontractors are processed exclusively on the basis of an agreement and the legal obligations Alewijnse has in that respect. Alewijnse will only request these data through the employment agency/subcontractor or directly from the data subject. The following personal data will be processed because Alewijnse is required by law to identify the persons involved and to limit hirer liability and Alewijnse's chain liability:
- NAME data --> Number and period of validity of proof of identification
- BSN number --> A1 form, work permit, visa
- Nationality --> Copy of proof of identity (Aliens Employment Act only)
In addition, these data may be made available to the client of Alewijnse for the same purpose and/or to register the presence of personnel at the work location as part of safety measures. In the latter case, in some cases a copy of the proof of identity may also be required. Alewijnse may also request proof of the qualities of a person deployed by a hirer or subcontractor in the form of diplomas, certificates, etc.
Personal data processed in the context of hirer and chain liability will be retained for a maximum of 7 years in accordance with the tax retention obligation. For the rest, personal data is only stored for the duration of a project.
Cameras hang on the locations of Alewijnse. These are used to secure the locations. The camera images are stored for no longer than four weeks.
In some cases, personal data may be processed in countries outside the European Economic Area ('EEA'), for example if Alewijnse performs work outside the EEA. Alewijnse imposes an adequate level of protection on the processor of personal data in third countries by concluding an agreement.
It is mandatory to take appropriate technical and organizational measures to prevent the loss of personal data or unlawful processing. In this context, Alewijnse's systems offer sufficient guarantees to process personal data correctly. Both physical and technical measures have been taken to prevent unauthorized processing. In addition, the systems containing personal data are only accessible to the extent that employees have been granted rights to access them.
Alewijnse will not share personal data with third parties, unless necessary and only on the basis of one of the principles set forth in Article 6 of the GTC or if consent has been granted. In cases in which personal data is shared with third parties, Alewijnse will make clear agreements in that respect.
Furthermore, Alewijnse strives to ensure that the personal data that are processed are and remain correct. Personal data will not be kept longer than necessary and will be removed once the statutory retention periods have expired.
A person whose data is processed is referred to as a 'data subject' in the General Data Protection Regulation. A data subject has rights which Alewijnse, and other bodies processing data, must respect.
A data subject has the right to:
- Clear information about which processing takes place;
- Access to the data being processed;
- Correction and supplementation of the data if they are incorrect and/or incomplete;
- Removal of data (the right to be 'forgotten');
- Restriction of data processing. A data subject can request this if the processing is incorrect, unlawful or unnecessary;
- To object to the processing;
- Transfer of the data in a simple manner (data portability);
- In order not to be subjected to automated decision making.
If you wish to invoke these rights, please send this appeal to firstname.lastname@example.org or to:
Alewijnse Holding B.V.
P.O. Box 65
6500 AB NIJMEGEN
The request will then be dealt with within one month, unless more time is required. In the latter case, you will be informed. If the request is not handled to your satisfaction, please contact the Authority Personal Data, Bezuidenhoutseweg 30, 2594 AV, The Hague.