In this privacy statement you can read everything about the way your personal data is collected and how it is handled. This explains where your data is stored and for what purposes your data is stored. In addition, you will also find all your rights regarding your data here and how you can exercise those rights

The privacy statement is sometimes changed due to, for example, changes in the law. It is therefore advisable to consult the statement periodically.

Hans van Diggelen/Willem de Fiouw

Business Data Challengers BV

Personal data is collected by Business Data Challengers for a number of purposes. These goals are explained below.

1. Commercial services
In our administration we keep the contact details of customers and suppliers of Business Data Challengers. We keep personal data of contact persons in order to provide our services as optimally as possible. Information from possible prospects is also stored for commercial activities.

2. Legal obligations
Some of our processing is required by law. This mainly concerns personal data that is necessary to ensure business operations and to comply with Dutch laws and regulations. This includes the data of Business Data Challengers employees and that of hired employees, but also data from customers and suppliers in connection with contractual obligations.

3. Marketing activities
Business Data Challengers sends newsletters via email.
These newsletters are commercial on the one hand and aimed at knowledge sharing on the other. Your first name and email address are collected via the appropriate form on the Business Data Challengers website. You may also be asked orally or in writing to register.

4. Contact us
Your data is collected when you contact Business Data Challengers. However, this form only asks for the necessary information to offer a proposal or a service, such as your name, company name, email address and telephone number.

5. Analytics
The Business Data Challengers website collects your data to improve the website. This is done with Google Analytics. This data is anonymous and is therefore not linked to your personal data. This includes information such as the duration of your website visit or the pages you visit often.

Your data will be kept for a longer period of time by Business Data Challengers, but never longer than is necessary to carry out activities, unless we have to keep your data for longer based on a legal regulation. The processing of the data by Business Data Challengers takes place in Simplicate and Exact Online. Below is a description of how Business Data Challengers deals with this by deploying these systems.

1.Right to be forgotten
Business Data Challengers deletes personal data if the person in question requests it and if no valid counterargument can be found. Deleting a person also leads to a physical deletion of the record. The data remains in the backups for a maximum of 30 days and is then completely deleted.

2.Right to data portability
A data subject has the right to export his or her data so that it can be used again in other situations.
Business Data Challengers are able to extract data from the software through exports, such as (Excel) and API options, to comply with this part of the legislation.

3.Right to access data
A data subject has the right to view and request his or her recorded data. The systems used offer the possibility to make visible which personal data has been recorded. This data may be shared with the person who requested the insight. If the request to view the recorded data comes from a natural person, this data can be exported via the export function.
This allows the applicant to assess what data is available
have been recorded and whether they are correct.

4.Data will not be kept longer than necessary
It is not permitted to store personal data for longer than necessary. Simplicate offers the option to set up a notification linked to a date field so that Business Data Challengers are informed when they need to destroy the data.

5. A basis for processing is required
The basis for data processing by Business Data Challengers is broadly described in “03. Basis".
The basis for which Business Data Challengers processes data may be based on a contractual obligation because the data is necessary for the execution of an agreement. Another example of a basis is that the person has actively given permission for processing. In Simplicate, fields can be added to personal data for a specific process to record the basis for which this data is processed. Lists can be generated based on these fields.

6.Security of personal data
Data is processed in such a way that appropriate security of personal data is guaranteed. In this way, personal data is protected against unauthorized or unlawful processing and against accidental loss, destruction or damage.

Business Data Challengers refers to a data breach as personal data
data falls into the hands of third parties who are not allowed to have access to that data.

Although data leaks are often only seen from a technical risk, data leaks can also arise in other ways, for example:
• An employee makes an export of personal data and emails it to an external party;
• An API user also incorrectly retrieves personal data.

Business Data Challengers is obliged to report a data breach to the Dutch Data Protection Authority within 72 hours of discovery, unless it can demonstrate that the leak does not endanger the personal data collected.

Security and data privacy are taken very seriously by Business Data Challengers. No physical copies are made of your personal data. Your data is only managed in the systems and software mentioned.

1. Security and safety
The software products used are developed based on an architecture that ensures that environments and databases of different customers are physically separated. Data traffic with the systems runs via encrypted connections. Only authorized persons have access. Business Data Challengers keeps track of which employees in the administrations have which rights, for example to create relationships, edit bank accounts and layouts, and make payments. The software also has a very extensive authorization module where the rights surrounding personal data are regulated for all users. It is also clear which persons and API keys have access to (exports of) personal data. Exact Online also uses two-step verification.

2. Business Data Challengers has an internal procedure for incident management. This procedure also specifies the steps taken in the event of a data breach.

3. The devices that open your data are each also locked with a password and/or fingerprint. The number of devices that have access to your data is limited to only the necessary devices.

4. Your visit to our website is secured by an SSL
certificate. This means that your connection to the Business Data Challengers website is private. You can recognize this security by the green lock in front of the URL. In addition, the Business Data Challengers domain is signed with DNSSEC. This is an additional tool that makes the website 'signage' safer and more familiar.