Privacy Policy

This Privacy Policy (together with the Terms and Conditions (hermeq.nl/en/terms-conditions) sets out what personal data HERMEQ BV ("we" or "us") may collect and how we will process and use this personal data. Please read the following carefully to understand our views on your personal data and how we will treat it.

With regard to applicable privacy legislation, including the General Data Protection Regulation (“GDPR”), the controller for the data processing described in this Privacy Policy is:

Company name: HERMEQ BV

Registered address: John M. Keynesplein 10, 1066EP Amsterdam, Netherlands.

Registered in the Trade Register of the Chamber of Commerce under: 91365562.

In addition, HERMEQ UK Ltd may also be involved in the processing of your personal data as a (joint) controller:

Company name: HERMEQ UK LIMITED.

Registered address: Sams Lane, West Bromwich, England, B70 7ED.

Company number: 10147984

If you would like to receive further information about this, please contact us using the contact details below.

This Privacy Policy applies to processing of personal data of the following categories of data subjects:

• Our customers;
• Employees of our customers; and
• Visitors to our website.

1. Personal information we collect about you

The information we collect about you may include the following;

• Contact information (e.g. email address and telephone numbers);
• Financial information (for example your bank account); and

This information may come from:

• Your use of our e-commerce platform; for example, when you purchase a product from us or ask us to provide you with a personalized quote;
• The way you use your online account and if you open a trading account with us;
• Your digital devices through cookies;
• Your interactions with us, including information you voluntarily share with us in response to an inquiry or request; or

2. How we process your personal data

Dutch privacy legislation allows us to process your personal data provided we have a legal basis to do so. The principles on which we use your personal data are:

• You have given us permission;
• We need to use your data to fulfill our obligations under our agreement with you;
• We need to use your data to comply with a legal obligation to which we are subject; and

We (or a third party) have a legitimate interest in using your information that overrides your interests or fundamental rights and freedoms. In the table below we have set out the purposes for which we process your personal data and on what legal basis .

Purposes	Legal basis
Verifying your identity and other information you provide. Preventing and detecting fraud, money laundering or other crimes. Managing your account(s) with us. Preparing anonymised statistical reports based on information about you and other customers to help us better manage our business, for example by improving our risk models. Improving the relevance of marketing messages we may send you. To analyze, assess and improve our services to customers and for training and monitoring purposes. Establishing, exercising and defending legal claims. Sending you service and marketing messages.	We carry out this processing on the basis of our legitimate interests, namely: Developing new products and services that our customers find useful. Protecting our customers against unnecessary risks. Preventing fraud and money laundering to protect our business. Protect ourselves and our customers from damage to our collective rights and interests. Verify your identity and any other information you have provided to us. Preventing or detecting fraud, money laundering or other crimes. Report regulations. Comply with reporting obligations under applicable regulations.
Verifying your identity and any other information you have provided to us. Preventing and/or detecting fraud, money laundering or other crimes. Complying with reporting obligations under applicable regulations.	We process this personal data in order to comply with a legal obligation, for example: NL/EU legislation and regulations against money laundering. NL/EU/UN sanctions (which prohibit us from supplying products to certain people). Rules and regulations imposed by the Netherlands Authority for the Financial Markets and other public institutions. Verify your identity and any other information you have provided to us. Prevent or detect fraud, money laundering or other crimes. Manage your account with us.
Verifying your identity and any other information you have provided to us. Preventing and/or detecting fraud, money laundering or other crimes. Managing your account with us.	We process this personal data in order to comply with our obligations based on the agreement we have entered into with you, for example: To answer your questions. To enable you to use our e-commerce platform. To enable us to provide the services or payment terms you request.
Sending marketing messages on behalf of third parties.	We process this personal data based on your consent.

 

You do not have to provide us with your personal data. However, we need your personal data in some situations, because the law requires us to request certain information about you or to fulfill our agreement with you. This means that in these situations we cannot offer you our products and services without your personal data.

When you register with HERMEQ BV, we give you the option to receive our updates occasionally. These messages inform you about new features on our website, ask your opinion and inform you about products you may not yet use. We only send these messages if there is something worth telling you about. If you do not want to receive these messages, you can click the unsubscribe link in the relevant message or call or email us.          

3. With whom we share your personal data

We may share your information with the following third parties on a need-to-know basis so that we can use your information for the purposes described above. We only share your information with third parties if (i) this is necessary for the third party's services; (ii) the authorized persons with access to the personal data are obliged to treat it confidentially; and (iii) they are obliged to comply with the laws and regulations applicable to the processing of personal data.

Credit reference and fraud prevention agencies;

• Competent supervisors or government agencies, for example the Netherlands Authority for the Financial Markets and the police;
• Authorized persons working at HERMEQ BV who are involved in the relevant processing activity;
• Authorized persons employed by debt collection agencies and law firms who help us collect money you owe us;
• Authorized persons working for our suppliers and subcontractors involved in the relevant processing activity;
• Your customers whose goods or services you have purchased using products supplied by us;
• Anyone to whom we may transfer all or part of our assets.

We do not pass on customer information to other customers of HERMEQ BV. We are not responsible for misuse of transaction information by others, but you must notify us immediately if you are a victim of misuse of that information.

4. Security

Security measures

Protecting your privacy and your personal data is our top priority. That is why we have implemented appropriate technical and organizational measures to secure and protect your personal data. In this way we also prevent breaches of the confidentiality, availability and integrity of your data. All employees of HERMEQ BV and any other persons who provide services for us are obliged to respect the confidentiality of personal data.

Security Policy

We use internal policies and procedures that further explain how HERMEQ BV achieves an appropriate level of technical and organizational security. We also have a procedure in place in the event of a (possible) data breach. This stipulates, among other things, that HERMEQ will inform the competent authority and persons involved in accordance with, and when required under, the applicable laws and regulations.

5. Transfer

We currently transfer your data outside the European Economic Area (EEA), namely to the United Kingdom ("UK"). This transfer is legitimated under two adequacy decisions of the European Commission for the UK. The European Commission hereby indicates that the UK ensures an adequate level of protection of personal data. 

If your personal data is transferred to a country outside the EEA for which no adequacy decision applies, we will agree an applicable model contract (Standard Contractual Clauses) with the relevant party. This is a standard contract to ensure the protection of your personal data, approved by the European Commission, the appendices to which are completed by the parties. See this link for the various model contracts.

You can contact us using the contact details below if you would like to receive additional information about how we legitimize transfers of your personal data to countries outside the EEA.

6. How long we keep your personal data

We do not store your personal data for longer than necessary for the processing purposes, unless it is required for a longer period in the context of legal proceedings, to comply with an applicable minimum retention period, or to comply with another applicable legal obligation.

We retain your data for at least five years after you close your HERMEQ account, to prevent fraud and other financial crimes, to comply with our legal obligations and to establish, exercise or defend legal claims. In exceptional circumstances, for example if there is an ongoing regulatory investigation or legal action, we may retain our information for longer than the five-year period. We periodically assess whether there is a valid reason for storing personal data. If this is missing, our retention obligation ends and we destroy the personal data.

7. Consequences of processing

If we, or an anti-fraud authority, identify you as a risk of fraud or money laundering, we may refuse to provide you with the services or financing you have requested, or to employ you, or we may discontinue existing services to you.

A record of any fraud or money laundering risk may be retained by anti-fraud authorities and may result in others refusing to provide you with services, financing or employing you. If you have any questions about this, please contact us using the details above.

8. Your Privacy Rights

Based on the General Data Protection Regulation, you have various privacy rights, which are listed below.

Right to information

We need to provide you with certain information when we collect your personal data, including how we use it and the legal basis for doing so, who we share it with, how long we intend to keep it, where we got the information from and what your rights in relation to this information. You will find this information in this Privacy Policy.

Right of access

We must provide you with a copy of your data unless providing some or all of your data would adversely affect the rights and freedoms of others, or the law permits us not to comply with your request. You can access your

obtain personal data by sending an email to accounts@hermeq.com or by calling us on 0800 0432 520. We aim to provide you with your information within 30 days. In the event that we need longer to process your request due to its complexity or number, we will inform you no later than one month after receipt that we need a maximum of two months longer. You will receive a substantive response to your request within three months.

Right to rectification

You may ask us to correct any information that you believe (i) is inaccurate (ii) incomplete or irrelevant to the purpose for which it was collected or (iii) that its use would otherwise violate applicable law- and regulations. We will update your information as soon as possible. You may be required to provide supporting evidence before we can process your request; for example, a copy of your marriage certificate if you want to update your name. This privacy right is not intended to affect professional opinions, conclusions or impressions with which you disagree. However, HERMEQ may consider adding your opinion.

Right to erasure ('right to be forgotten')

You can ask us to delete your personal data:

• If you believe that it is no longer necessary for us to keep your data;
• If you withdraw your (explicit) consent for processing;
• If you have successfully objected to the processing of your personal data by us;
• If you believe that we do not have legitimate grounds to process your data;
• If you believe that we are using your personal data unlawfully; or
• If you believe that we should delete your personal data because the law requires us to do so.

Right to restriction of processing

This right means that you can ask whether we store your personal data, but not process it further. You can ask us to stop using your personal data:

• If you believe your personal data is incorrect;
• If you believe that we are processing your personal data unlawfully;
• If you do not want us to destroy your personal data because you need it for legal proceedings;
• If you have told us that we have no legitimate reason to use your personal data and we are considering your request.

Right to data portability

If we use your data based on your consent or because we need it to fulfill our contractual obligations to you, you can ask us to provide or transfer your personal data in a structured, commonly used and machine-readable format to another controller.

Right to object

We may use your personal data to pursue our legitimate interests; For example, we may use information about you to improve our marketing messages because we have a legitimate interest in ensuring that our customers are aware of new products that could benefit them. We always give you the right to object when we want to use your personal data for our legitimate interests.

Right to Complaint

You have the right to file a complaint with the competent supervisory authority at any time if you believe that a privacy violation has occurred. See section 12.

Withdraw your consent

If you have given consent to the collection of your personal data, you can withdraw it at any time and free of charge. If you no longer wish to receive marketing communications, please contact our customer service at accounts@hermeq.com .

It may happen that you wish to exercise one of your rights and we are unable to comply with your request, for example because we have compelling legitimate reasons to use your data or because we need to retain your data to comply with a legal obligation. In that case, we will inform you why your request has been (partially) rejected and what you can do next.

You can send us your request by sending an email to accounts@hermeq.com or by calling us on 0800 0432 520.

9. File a complaint

If you are not satisfied with the way we have handled your information, you can raise your concerns with the Dutch Data Protection Authority, the body that regulates the processing of personal information data in the Netherlands, at:

10. Cookies

We use "cookies," which store small amounts of information on your computer or device to collect certain information from your web browser.

11. Changes to this Privacy Policy

This privacy statement may be changed from time to time. If we make changes, we will post the updated policy on this page. We encourage you to periodically review the contents of this policy. You will always see the last date of change here. Additional information will be provided about important changes.

This Privacy Policy was last updated on February 13, 2024.