Privacy Statement

1. Who we are

Ernexo Holding B.V. ("Ernexo", "we") is the controller for the personal data described in this statement, within the meaning of the General Data Protection Regulation (EU) 2016/679 ("GDPR", in Dutch: AVG) and the Dutch GDPR Implementation Act (Uitvoeringswet AVG). Address: Watteaustraat 5-II, 1077ZH Amsterdam, The Netherlands. Contact: dev@ernexo.com.

2. Personal data we process

• Enquiry data: name, organisation, email address and the content of your message when you use the contact form or email us.
• Technical data: limited server and security logs (such as IP address, browser type and request time) needed to deliver and protect this website.

3. Purposes and legal bases

• Responding to your enquiry — your consent (Art. 6(1)(a) GDPR) and, where relevant, steps prior to entering into a contract (Art. 6(1)(b)).
• Operating, securing and preventing misuse of the website — our legitimate interest (Art. 6(1)(f)).
• Complying with legal obligations, such as Dutch tax and record-keeping rules — Art. 6(1)(c).

4. What we do not do

We do not sell personal data, use it for unrelated marketing, or make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects for you.

5. Retention

Enquiry data is kept only as long as needed to handle your enquiry and any follow-up, and is then deleted, unless a longer period is required by law. Technical logs are kept for a limited period for security purposes.

6. Sharing and processors

We share personal data only with service providers that process it on our behalf (for example hosting and email) under a data processing agreement (verwerkersovereenkomst) as required by Art. 28 GDPR, or where we are legally obliged to do so. We do not share data with other parties for their own purposes.

7. International transfers

We aim to process personal data within the European Economic Area. Where a provider processes data outside the EEA, we rely on an adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses (Chapter V GDPR).

8. Information security

We apply appropriate technical and organisational measures (Art. 32 GDPR), structured in line with the principles of ISO/IEC 27001 and the privacy extension ISO/IEC 27701. These include:

• Risk-based information security management and documented policies.
• Access control on a least-privilege, need-to-know basis.
• Encryption of data in transit (TLS) and, where supported, at rest.
• Supplier assessment and contractual security requirements.
• Logging, monitoring and an incident response procedure.
• Data minimisation and privacy by design and by default (Art. 25 GDPR).

Alignment with these standards describes how we manage security; it does not imply certification unless explicitly stated.

9. Data breaches

Personal data breaches are assessed without delay. Where required, we notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours and inform affected individuals when the breach is likely to result in a high risk to their rights and freedoms (Art. 33–34 GDPR).

10. Cookies

This website does not use tracking or advertising cookies, and fonts are served from our own infrastructure so no data is sent to third-party font providers. Only strictly necessary technical storage may be used to make the site work, which does not require consent under the Dutch Telecommunications Act (Telecommunicatiewet, Art. 11.7a). If this changes, we will ask for your consent first.

11. Your rights

You have the right to access, rectify and erase your personal data, to restrict or object to its processing, to data portability, and to withdraw consent at any time without affecting prior processing. Send requests to dev@ernexo.com. We respond within one month and may ask you to verify your identity.

You also have the right to lodge a complaint with the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

12. Reporting a security issue

If you believe you have found a security vulnerability in our website or systems, please report it confidentially to dev@ernexo.com (see also /.well-known/security.txt). Please do not exploit or publicly disclose the issue before we have been able to address it.

13. Changes

We may update this statement when our processing or the law changes. The latest version is always published on this page.