Introduction, Summary

In the course of our work, we process personal data. These are data that can be used to identify a specific person. For example, a name or an email address containing a name. These data are not ours, but yours. Therefore, we must handle them carefully. This means, for example, that we only use data if we have the right to do so. Or that we must ensure that others also handle them carefully if we provide the data to others. If you read further, you will find more specific information, such as a description of the types of data we process and an explanation of the options you have to protect your own data. At the bottom, you will find the contact details of the person you can contact with questions or comments.

How and why does TILLEN collect personal data?

TILLEN collects personal data in the course of its work. In most cases, these are data that they request from the data subject or that the data subject provides on their own. Consider, for example, an initial phone call between TILLEN and a (potential) client or the situation where a (potential) client sends an email to TILLEN.

In processing personal data, TILLEN operates as carefully as possible. An essential part of this care is transparency. TILLEN considers it important that third parties and data subjects have insight into how they use personal data and the underlying reasons for this. Therefore, they have prepared this statement. If, after reading this Statement, you have any questions or comments, you can contact TILLEN. This also applies if you wish to exercise any of the rights described below or if you have a complaint. The full address and the name of the contact person can be found at the bottom of this statement.

Who exactly is TILLEN?

TILLEN is in many cases the controller for the processing of personal data. They are registered with the Chamber of Commerce under number 20132455, located at  Strijkviertel 28A in De Meern, reachable by phone at   +31 (0)85 3010 684 and by email at info@tillen.com

Does TILLEN have a Data Protection Officer?

TILLEN has not appointed a Data Protection Officer. However, they have designated an employee as the primary point of contact for privacy and personal data matters. This is Mr. H.P. van den Heuvel. The full address can be found at the bottom of this statement.

What personal data does TILLEN process and why do they do it?

TILLEN processes various types of personal data for different reasons. The most commonly processed data are:

• Identification data (name, email address, contact person, phone number, Chamber of Commerce number)
• Location data (postal and/or business address)
• Financial data (bank account number, payment details).

During a job application, TILLEN processes additional data, namely:

• Family composition, education, and training.

When you visit the TILLEN website, they also process other data not mentioned above. This may include:

• Your IP address, location, family composition, leisure activities and interests, and personal characteristics (age category, areas of interest, income category).

The primary purpose of this processing is to establish an agreement with the client. For this, TILLEN and the client must be able to communicate with each other. Consider, for example, assessing the client's wishes and preparing a quote. The second main purpose is to execute the concluded agreement. This includes, for example, periodic consultations on progress. The third main purpose is to enable invoicing of the work or services, as well as to facilitate payment (and, if necessary, collection). The fourth main purpose is to carry out marketing activities to attract more clients or to gain greater brand awareness. The final main purpose is to inform the client about developments that may be relevant to him or her.

Is TILLEN allowed to process these data?

TILLEN processes personal data when it is necessary to establish or execute an agreement with a client and/or supplier. This is the case, for example, when a quote is requested or when an order is placed. Furthermore, TILLEN processes personal data when their own interests justify it. This will be the case if it is reasonably impossible for TILLEN to perform their work without processing those data. Finally, TILLEN sometimes also asks for permission to use the data. The legal grounds for processing are therefore:

• that processing is necessary for the performance of a contract to which the data subject is a party, or is carried out at the request of the data subject prior to entering into a contract.
• that processing is necessary for the purposes of the legitimate interests pursued by TILLEN (or a third party).
• that the data subject has given consent to the processing.

Regarding category (ii), it always concerns processing necessary for TILLEN to realize their services. They simply cannot do their work, communicate, or issue quotes, etc., without using the client's personal data. Therefore, they have a legitimate interest in these processing activities. TILLEN believes that this interest, when weighed against the interest of the data subject, should take precedence. Two considerations justify this. First, the fact that TILLEN knows from experience that such processing generally does not encounter objections. TILLEN takes this as a starting point. Second, the fact that TILLEN does not retain the data longer than necessary. Nevertheless, to respect the rights of the data subject as much as possible, TILLEN only uses the data necessary to achieve the purpose.

Regarding category (iii), consent given can be withdrawn at any time without giving a reason.

Do these personal data end up with others?

TILLEN will, in some cases, share personal data with parties it collaborates with. These are so-called 'processors'. TILLEN has entered into agreements with these processors to ensure that they handle the data as carefully as TILLEN itself. For example, under these agreements, the processor is obliged to ensure proper security, handle the data confidentially, and destroy the data.

TILLEN does not intend to share personal data with parties other than processors. It foresees that information may occasionally be shared with (another) employee of the customer or with parties directly related to the customer.

Do the personal data remain in Europe?

In this context, the European Economic Area (EEA) is referred to. It consists of the EU countries, supplemented by Norway, Liechtenstein, and Iceland. All countries outside of this area are considered 'third countries'. TILLEN, in some cases, transfers personal data to third countries, particularly the USA. This only happens if it has been explicitly established at the European level that the respective country ensures an adequate level of personal data protection. For the USA, this means we only transfer data to parties certified under the EU-US Privacy Shield.

How long are the data retained?

TILLEN retains the data it collects for various periods, depending on the category of data and the way it was collected. The exact periods are recorded in the register of processing activities that TILLEN has prepared.

When determining the applicable periods, TILLEN has primarily based them on statutory (minimum) periods. Think of the legal obligation to retain accounting information. Furthermore, TILLEN has aligned with the retention periods in the Exemption Decree Wbp wherever possible. For example, the retention period for the contact details of the customer is up to a maximum of one year after the termination of the relationship between the parties. Finally, TILLEN has been guided by its interests and those of its customers when determining the retention periods. For example, it may be important for both parties that documents containing (further) agreements are retained for longer than two years. If such documents (e.g., email correspondence) contain personal data, these will also be retained.

Regarding the data collected through cookies on the website, the retention periods described in the Cookie Statement (see our website) apply.

What rights do I have?

According to the law, you are an 'individual' and individuals have a number of specifically described legal rights. You can submit a request to TILLEN to view, receive, modify, or delete your personal data. You can also object to the (further) processing of your data. If TILLEN processes your personal data based on your consent, you can withdraw this consent at any time. For all these matters and for other questions, you can contact:

Telephone:  +31 (0)85 3010 684
General e-mail:  info@tillen.com

Address    Strijkviertel 28A
Postal code    3454 PM
City    De Meern, The Netherlands

If you believe that TILLEN acts in violation of the applicable laws and regulations regarding personal data, you can submit a complaint to the Dutch Data Protection Authority (Postbus 93374, 2509 AJ DEN HAAG).

Is there automated decision-making at TILLEN?

There is no automated decision-making at TILLEN.

What else should I know?

To maintain a proper privacy policy, TILLEN has prepared a register of all the ways it processes personal data. For each process, the purpose, legal basis, and retention period are included. If you feel that you have not been adequately informed by this Privacy Statement, you can request access to that register.

To protect your personal data, TILLEN has taken appropriate technical and organizational measures. A description of these measures is also included in the processing register. TILLEN periodically assesses whether these measures are still adequate.

TILLEN's privacy policy also covers matters unrelated to its relationships with its customers. For example, there is also a retention period for applicant data.

TILLEN ensures that all its employees are familiar with its privacy policy and that they understand its importance. All employees are required to keep personal data confidential.

From time to time, it will be necessary to change this Privacy Statement. TILLEN has the right to do so. We recommend that you check this Privacy Statement occasionally for any changes.

Version 1.0, dated June 1st 2024