Privacy statement

Controller

The controller for the data processed through this website is Solius Media B.V., established at Iwanhof 5, 3025 NW Rotterdam and registered with the Dutch Chamber of Commerce under number 42151096. You can reach us via the contact form on this website.

This statement covers this website only. The platforms we operate each have their own privacy statement.

What data we process

We process only the data you provide yourself through the contact form and the data the web server records for technical reasons. We use no analytics services, no advertising networks and no social media buttons.

• Contact form: name, email address, chosen subject, the content of your message and the time it was sent.
• Server logs: IP address, date and time of the request, requested URL, HTTP status code, referring page and browser characteristics.

Purposes and legal basis

We process contact form data in order to handle your enquiry and, where your message leads to an agreement, to prepare and perform that agreement. The legal basis is performance of a contract or taking steps prior to entering into one (Article 6(1)(b) GDPR).

We process server logs to keep the website available and secure and to detect misuse. The legal basis is our legitimate interest in a safe and functioning service (Article 6(1)(f) GDPR). We have weighed that interest against your privacy and have therefore limited both the scope of the data and how long it is kept.

Retention periods

We do not keep data longer than is necessary for the purpose for which it was collected.

• Contact form messages: twelve months after the correspondence is concluded.
• Messages that lead to a business relationship: for the duration of that relationship and thereafter in line with statutory retention obligations, seven years for tax records.
• Server logs: thirty days, unless an incident requires a longer investigation.

Recipients and processors

We do not sell data and do not share it with third parties for their own purposes. To run the website and our email we use service providers who act solely on our instructions. A data processing agreement is in place with every processor.

• Hosting provider for the website and the storage of form submissions.
• Email provider for receiving and answering messages.
• Our accountant or adviser, only insofar as correspondence forms part of our records.

Transfers outside the EEA

Our hosting and email are located within the European Economic Area and we aim to keep data inside the EEA. Should a transfer to a third country be unavoidable, it will take place only on the basis of an adequacy decision of the European Commission or the standard contractual clauses, supplemented by an assessment of the circumstances in that country and, where necessary, additional measures.

Security

The website is available exclusively over an encrypted connection (TLS). Access to submissions is limited to staff who need it and is protected with two-factor authentication. We keep software and dependencies up to date and limit processing to what is necessary.

Data protection impact assessments and processing agreement

Where a planned processing operation is likely to result in a high risk to data subjects, we carry out a data protection impact assessment (DPIA) before it begins, as Article 35 GDPR requires. We review that assessment whenever the processing or the risks change.

If you are a client whose personal data we process on your behalf, our data processing agreement is available on request via the contact address in this statement.

Your rights

In respect of the data we process about you, you have the following rights:

• Access to the data we process about you.
• Rectification of inaccurate or incomplete data.
• Erasure where processing is no longer necessary or is unlawful.
• Restriction of processing, and objection to processing based on a legitimate interest.
• Portability: receipt of the data you provided in a common digital format.

Requests and complaints

You can submit a request via the contact form on this website. We respond within one month; for a complex request we may extend that period by two months and will tell you in good time. To prevent misuse we may ask you to substantiate your identity.

If you believe we are handling your data incorrectly, we would prefer to hear it from you first. You also always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), Postbus 93374, 2509 AJ The Hague.