PRIVACY STATEMENT – TRACEY

Version 1.0 - 22 February 2022

1. Tracey

We are Tron B.V., a Dutch company that trades under the name ‘Tracey’. We store our data on servers in the EEA, unless stated otherwise below.

We process your personal data when you visit our website, contact us or when you use our services. In this privacy statement we summarize when and how we collect, use and secure your personal data.

2. General

We may change provisions of this privacy statement from time to time. If we do that, we will inform you of the changes. However, we also advise you to check for yourself from time to time whether the privacy statement has been changed.

3. Which personal data do we collect and for which purposes?

There are a number of ways in which we can collect your personal data. Below we explain which personal data we may collect from you. The personal data is processed according to your role and to the different processing purposes. The data retention period also differs depending on the processing goal. Note that should there be any legal changes to the possible data retention periods, these legal changes will take precedent over the periods mentioned in this privacy statement.

3.1 You visit our website or contact us via our website

If you are a visitor to our websites, we may process the data mentioned below.

A. If you contact us through our website or via our e-mail, we process the contact information and details as provided by you for up to 6 months. Our processing ground is our legitimate interest to be able to contact you after you’ve voluntarily provided your contact information to us. This data is processed by Hubspot and our e-mail provider. They may process your personal data in the United States, although we did conclude a data processing agreement and standard contractual clauses with them.

B. If you sign up for our newsletter, we process your e-mail address until you sign off from the newsletter. Our processing ground is your permission, granted by signing up for the newsletter. This data is processed by Hubspot and our e-mail provider. They may process your personal data in the United States, although we did conclude a data processing agreement and standard contractual clauses with them.

C. To be able to improve our website, we use an analytics cookie to process the personal data mentioned below as you visit our website for up to 2 years after collecting the personal data. Our processing ground is your permission, as given through our cookie banner. If you wish to withdraw your permission, you’re free to do so via our cookie banner. Refusing or withdrawing permission has no negative consequences for your ability to use our website.

D. To be able to secure our website and prevent attacks on our website, we process the first numbers of your IP-address as visit our website for up to 24 hours after visiting our website. Our processing ground is our legitimate interest to secure our website. Your interests are protected due to the pseudonymized processing and the short retention period.

3.2 You work for one of our customers

If you are an employee of one of our customers, we may process the data mentioned below.

A. If you are the contact person for our customer, we process your contact information and correspondence in order to be able to contact you for up to 2 years after our agreement with the customer ends or up to 4 years after you leave the customer as employee. Our processing ground is our legitimate interest to be able to contact you, related to the agreement we concluded with our customer or otherwise. This data is processed by Hubspot and our e-mail provider. They may process your personal data in the United States, although we did conclude a data processing agreement and standard contractual clauses with them.

B. In order to maintain an adequate administration, we may process your e-mail address if it is the e-mail address to which we send our invoices. Our processing ground is our legal obligation to maintain an adequate administration. We process this information for up to 7 years.

C. To be able to improve our software, we use analytics software provided by Hotjar to process the personal data mentioned below as you use our software. Our processing ground is your prior permission. If you do not wish for us to process the information mentioned below anymore, you can always withdraw your permission through the settings. Please note that the information below is stored in a pseudonymized user profile and that we only see general statistics. Refusing or withdrawing permission has no negative consequences for your ability to use our website.

D. To be able to secure our software, we process the personal data mentioned below as you use our software for up to 90 days after your use of our software. Our processing ground is our legitimate interest to secure our software. Your interests are protected due to the pseudonymized processing and the short retention period.

E. We may send you marketing material, such as our newsletter. We process your e-mail address for this purpose until you sign off from the newsletter or up to 2 years after our agreement with the customer ends or as soon as we receive notice that you left the customer as employee. Our processing ground is our legitimate interest to send our contacts marketing materials. This data is processed by Hubspot and our e-mail provider. They may process your personal data in the United States, although we did conclude a data processing agreement and standard contractual clauses with them.

3.3 You work for one of our suppliers

If you are an employee of one of our suppliers, we may process the data mentioned below.

A. If you are the contact person for our supplier, we process your contact information and correspondence in order to be able to contact you for up to 2 years after our agreement with the supplier ends or up to 4 years after you leave the customer as employee. Our processing ground is our legitimate interest to be able to contact you, related to the agreement we concluded with our supplier or otherwise.

B. In order to maintain an adequate administration, we may process your e-mail address if it is the e-mail address to which we send our invoices. Our processing ground is our legal obligation to maintain an adequate administration. We process this information for up to 7 years.

4. Sharing personal data

We may use so called data processors to process your personal data on our behalf. We conclude data processing agreements with these processors, to assure they only process your personal data on our instruction.

We use the following types of processors:

If you provide additional information to these processors yourself, we are not responsible for this. It is wise to inform yourself properly about the processor and his company before you provide your personal data.

Sharing data with your consent

We may also share personal data with others if you give us permission to do so. For example we can cooperate with other parties to offer you specific services or offers. If you register for these services or marketing offers, we may provide your name or contact details if they are necessary to provide that service or contact you. Before we do this, you will always be expressly asked for your consent.

Sharing based on our legal responsibility

We may also share personal data with third parties if this is:

  1. necessary to comply with our legal obligations
  2. necessary to comply with legal requests from authorities
  3. is required to respond to any legal claims
  4. necessary to protect the rights, property or safety of us, our users, our employees or the public
  5. is required to protect ourselves or our users against fraudulent, abusive, inappropriate or unlawful use of our services

We will immediately notify you if a government agency makes a request that relates to your personal data, unless we are not allowed to do so on the grounds of the law.

Merger or sale (part) of the company

It may happen that we disclose, share or transfer your personal data when we transfer part of our business. Examples include (negotiations about) a merger, sale of parts of the company or obtaining loans. We will of course try to limit the impact for you as far as possible by transferring personal data only when necessary and anonymizing where possible.

5. Protection of personal data

Protecting your personal data is of the utmost importance for us. We have therefore taken appropriate technical and organizational security measures in order to protect your personal data. These measures include, but are not limited to:

We would like to point out that we cannot guarantee absolute security when sending personal data via the internet or storing personal data. We advise you to take this into account before sharing personal data.

6. Links to third party sites

Our website may contain links to other websites and services. These third party websites and services can collect and retain information about you. If you provide your personal data to third parties, then we are not involved. We have no control over these sites or the activities of the third parties. In that case, the privacy policy of the third party applies. We are not responsible for the content of the privacy policy of these parties and the way in which these parties deal with personal data. We encourage you to review their privacy and security practices and policies before you provide personal information to them.

7. Your rights

Privacy legislation gives you certain rights with regard to your own personal data. The rights that we describe below are not absolute rights. We will always consider whether we can reasonably meet your request. If we cannot meet your request, or if it would be at the expense of the privacy of others, we can refuse your request. If we refuse a request, we will let you know and explain our reasons.

Right of access

You have the right to request which personal data we process about you. You can also ask us to provide insight into the processing grounds, relevant categories of personal data, the (categories of) recipients of personal data, the retention period, the source of the data and whether or not we use automated decision making.

You may also request a copy of your personal data that we process. Do you want additional copies? Then we can charge a reasonable fee for this.

Right to rectification

If the personal data processed by us about you is incorrect or incomplete, you can request us to adjust or supplement the personal data.

If we grant your request, we will, to the extent reasonably possible, inform the parties to whom we provide information.

Right to erasure

Do you no longer want us to process certain personal data about you? Then you can request us to delete certain (or all) personal data about you. Whether we will delete data depends on the processing ground. We only delete data that we process on the basis of a legal obligation or for the performance of the agreement if the personal data is no longer necessary. If we process data based on our legitimate interest, we will only delete data if your interest outweighs ours. We will make this assessment. If we process the data on the basis of consent, we will only delete the data if you withdraw your consent. Have we accidentally processed data or does a specific law require that we delete data? Then we will delete the data. If the data is necessary for the settlement of a legal proceeding or a (legal) dispute, we will only delete the personal data after the end of the proceedings or the dispute.

If we grant your request, we will, to the extent reasonably possible, inform the parties to whom we provide information.

Restriction of processing

If you dispute the accuracy of personal data processed by us, if you believe that we have processed your personal data unlawfully, if we no longer need the data or if you have objected to the processing, you can also request us to restrict the processing of that personal data. For example, during the time that we need to assess your dispute or objection, or if it is already clear that there is no longer any legal ground for further processing of those personal data, but you still have an interest in us not deleting the personal data. If we limit the processing of your personal data at your request, we may still use that data for the settlement of legal proceedings or a (legal) dispute.

Right to data portability

At your request, we may transfer the data that we automatically process to execute the agreement or based on your consent, to you or another party designated by you. You can make such a request at reasonable intervals.

Automated individual decision making

We do not take decisions based solely on automated processing.

Right of restriction of processing and withdrawal of permission

If we process data on the grounds of a legitimate interest, you may object to the processing. If we process data on the basis of your consent, you may withdraw that consent. For more information, please refer to the relevant processing purposes above.

Exercising your rights

You can send a request for access, correction, deletion, data transfer of your personal data or request for withdrawal of your consent or objection to the processing of your personal data to privacy@tracey.support.

To prevent abuse, we may ask you to identify yourself adequately in the case of a written request for access, rectification or erasure.

We strive to process your request, complaint or objection within a month. If it is not possible to make a decision within a month, we will inform you of the reasons for the delay and the time when the decision is expected to be made (no longer than 3 months after receipt).

Dutch Data Protection Authority

Do you have a complaint about our processing of your personal data? Please contact us. We are naturally happy to assist you. If we cannot come to a solution, you are also entitled to submit a complaint to the national privacy authority, in this case the Dutch Data Protection Authority. For this you can contact the Dutch Data Protection Authority via https://autoriteitpersoonsgegevens.nl.

8. Contact

If you have questions, concerns or comments about this privacy statement or our data processing, please contact us via e-mail on privacy@tracey.support.