Privacy statement

Introduction
HEXCHANGE takes your privacy very seriously and will process and use information about you (the data subject) in a secure manner. In this Privacy Statement, we explain which data we process, and for what purpose we do so. Additionally, in this Privacy Statement, you can read about your rights regarding our processing of your personal data. We advise you to carefully read this Privacy Statement. For questions, you can always contact [email protected].

Who is HEXCHANGE?
HEXCHANGE is the private company of TCC Spares B.V., with its office located at De Wetering 24, (4906 CT) Oosterhout, The Netherlands registered in the trade register of the Chamber of Commerce under number 58179097.

When HEXCHANGE processes your personal data, HEXCHANGE is the data controller.

HEXCHANGE has appointed a data protection officer. You can reach Freek Gielen via [email protected].

How does HEXCHANGE use your data?
Below you will find an overview of the purposes for which HEXCHANGE processes personal data about you. For each purpose, it is indicated which data HEXCHANGE uses for that specific purpose, what the legal basis is to be allowed to process that data, and how long the data is retained by HEXCHANGE. To keep it clear, we have grouped everything by type of data flow.

Service provision, customer management, and financial administration
Purpose: Financial Administration
Data: Company Name, Invoice Address, Bank Details (Bank Name/IBAN/BIC), Outstanding Balance
Basis: Legal Obligation
Retention Period: As long as necessary for this purpose

Purpose: Invoicing
Data: Company Name, Invoice Address, Bank Details (Bank Name/IBAN/BIC), Outstanding Balance
Basis: Legal Obligation
Retention Period: As long as necessary for this purpose

Purpose: Management of Orders
Data: Personal Details (Name, Address, City), Delivery Address, Invoice Address, Email Address, Phone Number, Payment Details, Account Number, Order Number, Complaint Content, Chamber of Commerce Number, VAT Number, Customer Number
Basis: Execution of the Agreement
Retention Period: As long as necessary for this purpose

Purpose: Handling Complaints about the Product
Data: Personal Details (Name, Address, City), Delivery Address, Invoice Address, Email Address, Phone Number, Payment Details, Account Number, Order Number, Complaint Content, Chamber of Commerce Number, VAT Number, Customer Number
Basis: Execution of the Agreement
Retention Period: As long as necessary for this purpose

Purpose: Provision of the Service Itself
Data: Personal Details (Name, Address, City), Email Address, File Data, Financial Data, Data Required to Provide the Service, Data Generated During the Service
Basis: Execution of the Agreement
Retention Period: As long as necessary for this purpose

Purpose: Handling Complaints about the Service
Data: Personal Details (Name, Address, City), Email Address, File Data, Financial Data, Data Required to Provide the Service, Data Generated During the Service
Basis: Execution of the Agreement
Retention Period: As long as necessary for this purpose

Purpose: CRM
Data: Name, Email Address, Location, Order History, Browser, Phone Number
Basis: Legitimate Interest
Concerned Interest: Commercial Interest
Retention Period: As long as necessary for this purpose

Marketing
Purpose: Direct Marketing
Data: Name, Personal Details (Name, Address, City), Email Address, Phone Number, Order History, Mail/Invoice Address
Basis: Legitimate Interest
Concerned Interest: Commercial Interest
Retention Period: As long as necessary for this purpose

Purpose: Affiliate Marketing
Data: Name, Personal Details (Name, Address, City), Email Address, Phone Number, Order History, Mail/Invoice Address
Basis: Legitimate Interest
Concerned Interest: Commercial Interest
Retention Period: As long as necessary for this purpose

Purpose: Newsletter
Data: Name, Personal Details (Name, Address, City), Email Address, Phone Number, Order History, Mail/Invoice Address
Basis: Legitimate Interest
Concerned Interest: Commercial Interest
Retention Period: As long as necessary for this purpose

Purpose: Retargeting
Data: Name, Personal Details (Name, Address, City), Email Address, Phone Number, Order History, Mail/Invoice Address
Basis: Legitimate Interest
Concerned Interest: Commercial Interest
Retention Period: As long as necessary for this purpose

Purpose: Social Media Marketing
Data: Name, Personal Details (Name, Address, City), Email Address, Phone Number, Order History, Mail/Invoice Address
Basis: Legitimate Interest
Concerned Interest: Commercial Interest
Retention Period: As long as necessary for this purpose

Purpose: Behavioural Targeting
Data: Name, Personal Details (Name, Address, City), Email Address, Phone Number, Order History, Mail/Invoice Address
Basis: Legitimate Interest
Concerned Interest: Commercial Interest
Retention Period: As long as necessary for this purpose

Website
Purpose: Website Analytics
Data: Browsing Behavior, Location
Basis: Legitimate Interest
Concerned Interest: Commercial Interest
Retention Period: As long as necessary for this purpose

Purpose: A/B Testing
Data: Browsing Behavior, Location
Basis: Legitimate Interest
Concerned Interest: Commercial Interest
Retention Period: As long as necessary for this purpose

Purpose: Providing an Account
Data: Name, Email Address, Message Content
Basis: Execution of the Agreement
Retention Period: As long as necessary for this purpose

Purpose: Posting Messages or Reviews
Data: Name, Email Address, Message Content
Basis: Execution of the Agreement
Retention Period: As long as necessary for this purpose

Purpose: Chat Function
Data: Name, Email Address, Message Content
Basis: Execution of the Agreement
Retention Period: As long as necessary for this purpose

Security and Fraud Prevention
Purpose: Data Security
Data: Financial Resources, Debts, Expenditures, Solvency, Loans, Professional Activities, Agreements and Settlements, Name, Address
Basis: Legitimate Interest
Concerned Interest: Commercial Interest
Retention Period: As long as necessary for this purpose

Purpose: Credit Check
Data: Financial Resources, Debts, Expenditures, Solvency, Loans, Professional Activities, Agreements and Settlements, Name, Address
Basis: Legitimate Interest
Concerned Interest: Commercial Interest
Retention Period: As long as necessary for this purpose.

How does HEXCHANGE obtain your personal data?
HEXCHANGE has information about you because you have provided that data to us.

What are your rights?
Under the European General Data Protection Regulation, you have several rights concerning your data and its processing:

Access
You can always view and, if necessary, modify your own (personal) data in your account. If you want to see the personal data that HEXCHANGE has recorded about you, you can request access.
Modification
If you want to make changes to the personal data you've seen as a result of an access request and that you cannot change yourself in your account, you can request this from HEXCHANGE. You can ask HEXCHANGE to modify, correct, supplement, delete, or shield your data.

Restriction of processing
Under certain conditions, you also have the right to ask HEXCHANGE to restrict the processing of your personal data.

Right to object
If certain processing is based on the 'legitimate interest' of HEXCHANGE or a third party, you have the right to object to that processing.

Data portability
You have the right to obtain your personal data from HEXCHANGE. HEXCHANGE will provide this in a structured and commonly used form that can easily be opened in other standard digital systems. This way, you can also place your data with another provider.

Withdrawal of consent
In all cases where the basis for a particular data processing is your consent, you have the right to withdraw that consent. This has no consequences for the past, but it means that we can no longer process that data. It may be that HEXCHANGE can no longer provide you with certain services as a result.

Response by HEXCHANGE
A request can be sent to [email protected]. HEXCHANGE will grant your request as soon as possible and in any case no later than one (1) month after HEXCHANGE has received such a request. If HEXCHANGE rejects your request, we will indicate in our answer why the request is rejected.

Recipients of the personal data
It's possible that HEXCHANGE is obligated to provide your data to a third party, for instance, due to a legal obligation.

What are cookies and how does HEXCHANGE use them?
Cookies are small pieces of (text) information that are sent to your browser when you visit HEXCHANGE's website and are then stored on the hard drive or in the memory of your computer, tablet, mobile phone, or other devices (hereafter: "Device"). The cookies placed by HEXCHANGE's website cannot damage your Device or the files stored on it. When we talk about 'cookies', we don't just mean these small pieces of (text) information but also similar techniques with which information is collected, such as device fingerprinting.

Can this Privacy Statement be changed?
This Privacy Statement can be changed. We therefore recommend that you regularly read the Privacy Statement for any changes.

Where can you go with complaints and questions?
If you have any questions about this Privacy Statement and the way HEXCHANGE uses your data, you can send an email to [email protected]. If you have a complaint about how HEXCHANGE processes your data, you can also send an email to [email protected]. In addition, you can always contact the competent national supervisory authority in the field of privacy protection. In the Netherlands, this is the Autoriteit Persoonsgegevens (Personal Data Authority).