Privacy statement

Pull continuously aims to process privacy-sensitive data of data subjects, including personal data, with the greatest possible care; this is what the person concerned can expect from Pull. In the event of a suspected failure to do this, Pull asks the person concerned to speak to her about this. In addition, the data subject has the right at all times to submit a complaint to the supervisory authority, which is the Dutch Data Protection Authority. You will find more information about this under point 12 below. With this privacy statement, Pull wants to show its customers and other data subjects whose personal data it processes that this is done in a proper and transparent manner.

Content privacy statement

1. Definitions
2. Identity and contact details
3. Data Protection Officer
4. The personal data
5. Processing Purposes
6. Legal basis for the processing
7. Receivers
8. Cross-border processing
9. Retention period
10. Rights of the data subjects
11. Security
12. Right of complaint
13. Other

 

1.           Definitions

AVG: abbreviation of 'General Data Protection Regulation', being: 'Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC' (from 24- 05-2016); where "Regulation" is used, the same is understood.

Data subject: the natural or legal person who, in whatever capacity, addresses Pull in any way and of which Pull processes at least one personal data.

Cookies: a small text file, in which information is stored regarding the search behavior, which is placed on the device used by the data subject during the visit to the website. This information can be recognized again by the Pull website on a later visit.

Cross-border processing:
a)           processing of personal data in the context of the activities of establishments in more than one Member State of a controller or processor in the Union established in more than one Member State; or

b)           processing of personal data in the context of the activities of establishments in more than one Member State of a controller or processor in the Union established in more than one Member State; or

Personal data breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, data transmitted, stored, or otherwise processed.

Company: any natural or legal person engaged in economic activity, regardless of its legal form, including partnerships and partnerships or associations regularly engaged in economic activity.

Receiver: a natural or legal person, a public authority, a service or another body, whether or not a third party, to whom / to whom the personal data is provided.

Personal data: any information about an identified or identifiable natural person ("the data subject").

Consent of the data subject: any free, specific, informed, and unambiguous expression of will by which the data subject accepts a processing of personal data concerning him by means of a statement or an unambiguous active act.

Supervisory Authority: an independent public authority established by a Member State pursuant to Article 51 GDPR; in this case the 'Personal Data Authority'.

Representative: a natural or legal person established in the Union who has been designated in writing by the controller or processor pursuant to Article 27 to represent the controller or processor in relation to their respective obligations under this Regulation.

Processor: a natural or legal person, a public authority, service or other body that processes personal data on behalf of the controller.

Processing: an operation or a set of operations on personal data or a set of personal data, whether or not carried out by automated means, such as collecting, recording, organizing, structuring, storing, updating or changing, retrieving, consulting, using, providing by means of transmitting, disseminating or otherwise making available, aligning or combining, blocking, deleting or destroying personal data.

Controller: the person who determines the 'purpose and means' for the processing; the controller determines how and why personal data is processed. The controller is the (legal) person who is literally responsible for compliance with the GDPR.

 

2.           Identity and contact details

Pull's identity and contact details as controller and processor of the personal data of data subjects are as follows:

Company data
Company name: Pull

Business address: Utrechtsestraatweg 222

Postal code: 3911 TX

Location: Rhenen, The Netherlands

Chamber of Commerce number:      30018828

T.           : 0318 - 471001

F.           : 0318 - 472088

E.           : info@pullrhenen.nl

W.          : www.pullrhenen.nl

 

3.           Data Protection Officer

Although the appointment of a data protection officer (hereinafter: DPO) is not mandatory for Pull, it has appointed one. The DPO internally monitors and advises on Pull's application and compliance with the Regulation. The DPO is also the point of contact for the data subject. As the controller, Pull remains ultimately responsible for proper compliance with the Regulation.

The contact details of the data protection officer are as follows:

• DPO          : Mr. M. de Cock
• Contact: mdecock@pullrhenen.nl

 

4.           The personal data

Pull does not process any data from data subjects other than strictly necessary for, and for the sole purpose of, the purposes stated under point 5. Pull will, if necessary, first ask the person concerned for permission to process any other personal data and/or for other purposes. If Pull collects data outside of the data subject, the data subject will be notified of this within a reasonable period of time after receipt of the data. In principle, the same information is provided as if the data were obtained from the data subject himself. When notifying, the source from which the personal data was obtained is also stated. If the source of the information cannot be determined, general information about the source will be provided.

Who
The data subjects from whom Pull collects personal data are: customers;

• suppliers;
• carriers;
• clients;
• (sub)contractors;
• contact person involved in an assignment or agreement;
• (service) agency or other organization involved in an assignment or agreement.

Pull also processes personal data of other natural persons who contact Pull in any way and for which processing is relevant or necessary.

What
The data of data subjects to be processed by Pull are, insofar as applicable:

• Mailing address;
• e-mail address;
• delivery address;
• Chamber of Commerce number;
• name and address details;
• imagery
• telephone number;
• bank account number;
• place of residence or place of business;
• information about the order history;
• company data to be regarded as personal data;

other relevant personal data that the person concerned provides on his own initiative.

When
Pull processes the data of the data subject when they:

• requests a quote or quotation;
• enters into an agreement with Pull;
• contact us via the contact form on the website;
• contact us by telephone, e-mail, or postal address;
• through contact applications or social media channels.

Cookies and analysis
Information about the use of the website is processed using cookies. Some cookies are necessary, for example for the Pull website to function properly, or to be able to provide a service requested by the person concerned. In addition, cookies are used to analyze website visits. The user, in this case, Pull, does not require permission for these functional cookies, but the data subject must be informed about this. Pull uses these functional cookies.

In addition to functional cookies, there are also non-functional cookies. This includes marketing cookies, third-party cookies, social media cookies, and advertising cookies. The use of these types of cookies does require permission from the data subject if personal data (e.g. an IP address) is processed. Pull does not use non-functional cookies. If Pull does wish to use this type of cookie at a later date, it will first ask for permission.

Newsletter
If the person concerned registers for the Pull newsletter, the contact details requested will be stored and used for the purpose of sending the newsletter. The data will be used until the person concerned unsubscribes from the newsletter. You can unsubscribe from this at any time.

Customer Satisfaction and Service Survey
If Pull invites those involved for customer satisfaction and/or service survey, this will always be anonymous. The information obtained in such investigations will not be traceable to a specific data subject.

 

5.           Processing Purposes

Pull only processes the personal data of the person concerned for specific purposes, namely:

• managing the data subject's account;
• performing any credit checks;
• improving the quality of products and services;
• processing an application or order placed by the person concerned;
• the proper execution of an agreement with the data subject;
• developing new products and improving services;
• the payment process to be carried out for the purpose of processing an application or order;
• bringing the products and services to the attention in a personalized and adequate manner.
• the passing on in order to be able to effect a proper execution of the agreement with the data subject.

E-mail marketing (opt-in)
Pull will only use the name and e-mail address if the person concerned has given permission for this to send the newsletter with information about Pull's activities, services, and other interesting information. You can unsubscribe from these mailings at any time via the unsubscribe link at the bottom of the mailing or by replying to the message sent.

 

6.           Legal basis for the processing

Pull only processes personal data if this is based on one or more of the legal bases. The grounds for data processing in the case of "visual material" are Art. 6(1)(f) of the GDPR, namely: the processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, unless the interests or fundamental rights and freedoms of the data subject require the protection of personal data, outweigh those interests, in particular where the data subject is a child and for other personal data Art. 6(1)(b) of the GDPR, namely: "the processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract".

 

7.           Receivers

If necessary, the personal data of the person concerned will be passed on to cooperation partners. This includes recipients such as

• suppliers;
• carriers;
• a third party involved or engaged in an assignment;
• a third party engaged for the administration;
• a third party to be engaged for the purpose of fulfilling an agreement.

If necessary, a processing agreement will be drawn up for the aforementioned transfer. Processing by the processor takes place solely on the basis of a processing agreement between Pull and the relevant processor. These processors process the personal data under the same conditions as under which Pull processes the data. Where appropriate, the data will only be processed by the designated party and will only be used for the authorized purpose designated by Pull. For the rest, Pull never provides the data of the person concerned to third parties, except in situations in which it has a legal obligation to do so. If desired, the data subject can request a list of processors.

 

8.           Cross-border processing

The level of data protection is the same within the European Union. That's because all EU member states must comply with the General Data Protection Regulation (GDPR). The European Union is therefore one jurisdiction in the protection of personal data.

Third countries
Separate rules apply to the transfer of personal data from the Netherlands to countries outside the EU, so-called third countries. Third countries are all countries outside the European Union, with the exception of the countries in the European Economic Area (EEA), namely Norway, Liechtenstein, and Iceland. These three countries have an equivalent level of protection of personal data. The main rule is that Pull may only transfer personal data to third countries with an appropriate level of protection. If there is no question of a third country with an adequate level of protection, the transfer is only permitted on the basis of one of the legal provisions of the GDPR (Chapter V).

 

9.           Retention period

Pull does not store the personal data of data subjects for longer than is necessary for processing purposes. If storage of the data is no longer necessary, it will be destroyed.

 

10.         Rights of the data subjects

The data subject has various rights to ensure proper and transparent processing of personal data. The data subject can exercise these rights against Pull. The person concerned has:

• the right to access his data;
• the right to information about the processing;
• the right to object to the data processing;
• the right to restriction of data processing
• the right to transfer his data (data portability);
• the right to correction of the data if it is incorrect;
• the right to the erasure of the data and “the right to be forgotten”;
• the right not to be subject to automated decision-making.

Is Pull obliged to comply with requests from the data subject?

Yes. As a controller, Pull must respect the rights of the data subject and facilitate their implementation. Pull will therefore also comply with requests from the data subject unless these are manifestly unfounded or excessive. Pull will not charge for the exercise of the data subject's rights, except for unfounded or excessive requests to which Pull, although it may refuse, decides to cooperate. Pull will of course determine with sufficient certainty that the person making the request is actually the person concerned.

Within what timeframe does Pull respond to requests from the data subject?
Pull informs the data subject within one month of receipt of the request about the execution of the request, even if it does not comply with the request of the data subject. Pull will motivate any refusal and the data subject will be informed of the right of complaint with the supervisory authority. Pull will take a maximum of two months extra if it concerns many requests or complex requests. Pull will also inform the person concerned about this within one month of receipt of the request.

How will Pull implement the rights of the data subject?
When Pull informs the data subject, it will do so in clear and plain language. Furthermore, the information will be provided in a convenient, accessible form. The same applies to communication in the context of executing a request from the data subject (for example, responding to a request for access).

Are there any restrictions on the rights of the data subject?
In specific situations, Pull does not have to comply with the rights of data subjects. This may include situations in which restriction is necessary to guarantee the protection of the data subject or that of the rights or freedoms of others.

What if the individual disagrees with Pull's decision?
If the person concerned does not agree with Pull's decision or method of implementation, he or she can turn to the Dutch Data Protection Authority with a request to mediate or enforce.

 

11.         Security

Pull has taken appropriate technical and organizational measures to protect the personal data of those involved against loss or unlawful processing.

 

12.         Right of complaint

If the data subject suspects that Pull is processing the personal data in a way that is contrary to the privacy law, the data subject can hold Pull against this. The person concerned can, in addition, or instead, also contact the Dutch Data Protection Authority to submit a complaint or to request mediation. The procedure for submitting such a complaint can be found on the website of the Dutch Data Protection Authority.

 

13.         Others

The processing of the personal data of the person concerned by Pull is necessary for entering into or performing an agreement. The data subject is of course not obliged to have Pull process this data, but failure to provide it may have adverse consequences for entering into or performing an agreement with Pull. In addition, Pull cannot guarantee optimal customer focus if the necessary personal data is not provided. Pull reserves the right to change this privacy statement.

If necessary, Pull will inform the person concerned about this. This version of the privacy statement dates from May 2018. Do you have any questions or comments after reading this privacy statement? Please contact Pull. The contact details can be found under point 2.

Rhenen, July 2021