PRIVACY STATEMENTThis is the Privacy Statement of ACT Commodities Group B.V., established at Strawinsklylaan 3127 (1077 ZX) in Amsterdam, the Netherlands., as well as its operating groups, affiliates and subsidiaries , hereinafter jointly referred to as: “ACT”, “we”, “us” or “ours”. Your personal data is processed by and shared within the ACT group, in the manner described in this Privacy Statement.
When this Privacy Notice mentions “ACT”, “we”, “us”, or “our”, ACT is referring to the ACT company that is deciding on the purposes and means of the processing of your personal data under this Privacy Statement. If you have any doubts about the respective ACT company controlling your personal data in a particular circumstance, please contact our ACT group central point of contact by means of the contact details provided in Section 7 of this Privacy Statement.This Privacy Statement sets out how we handle personal data, which we do with all possible care.
This Privacy Statement applies to the processing of personal data of our clients, prospective clients, applicants, and other people who visit our website (https://www.actcommodities.com/) or contact us.
Any processing of your personal data is subject to applicable requirements following from the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data ProtectionRegulation)(“GDPR”)as well as the Dutch GDPR Implementation Act, and/or any applicable local personal data protection laws and regulations (collectively referred to as the “Data Protection Laws”).
1. Which personal data do we process, for what purpose and on what legal basis?
Personal data of (contacts at) clients
We process the contact details (name, company name, phone number, email) of our contacts at our clients to execute orders for our clients, and to contact these people in the context thereof. We also use these details to bill our activities. The contacts' data processed is legally based on ACT’s legitimate interest (as the contacts are, strictly speaking, no party to the contract between ACT and the clients). This is different for clients who are natural persons (e.g. self-employed workers without employees). The processing of their data is necessary in the context of executing the contract with the clients.
We also use the clients’ contact details in connection with relationship management, for instance to send Christmas cards or birthday wishes. For this purpose, we may also process the date of birth of our clients’ contact persons. This processing is necessary in view of ACT’s legitimate interest to maintain a good relationship with its clients.
Finally, we use the clients’ contact details to conduct customer satisfaction surveys from time to time. Naturally, clients are not obliged to participate in such surveys. This processing is necessary in view of ACT’s legitimate interest to improve its services.
Recording conversations in the trading room
We record telephone conversations made in the trading room and made by the operations team of our Fuels department with contacts of clients in order to register proof of trades and to improve our services. This processing is necessary in view of ACT’s legitimate interest to be able to prove that an order was given for the transaction and to ensure the transparency of our communication with the clients.
Personal data of prospects
We process the contact details (name, company name, telephone number, email) of contacts at prospective and former clients to contact them in order to offer our services to them, and to send them holiday wishes. We process this personal data in view of our legitimate interest to perform our activities and to obtain new orders. We also make use of publicly available sources to obtain the contact details of prospects.
If we are contacted via the contact form on our website, by email, social media or telephone, we process the data that is provided to us. This typically includes the name, email and telephone number and the content of the contact (e.g. a question). We use this information, where relevant, to contact the person concerned, for instance to answer a question. We may add this data to our prospects’ files (please see above). We process this personal data in view of our legitimate interest to perform our activities and to obtain new orders.
Recruitment and application procedures
We process the personal data provided to us by prospective employees or obtained from a recruitment agency or via Linkedin. This may include contact and basic information (such as name, address, email, telephone number), recruitment information (such as resumé and CV and all information it contains) ), and information posted on Linkedin.
If an applicant is invited for an interview, we process, in addition to the information mentioned above, all other information the applicant provides us with. This may include information about education, work experience and references, including correspondence between you and us during the application process.
For the purpose of the second round of the application procedure we may process data from a personality test, and data concerning motivation, talent and competences in order to decide whether the applicant would fit in with the organization.
During the final phase of the application procedure, we may perform pre-employment screening, inter alia, by instructing an external agency to screen the applicant within the context of an integrity review and/or personality test. Obtaining a Certificate of Conduct (Verklaring Omtrent het Gedrag) is part of this screening. We only conduct the screening if this is necessary for the position concerned. The screening is highly secure and is conducted with all possible care and consideration.
The legal basis for processing personal data within the context of recruitment and application procedures is that this processing is a necessary step to enter into an agreement, and in view of ACT’s legitimate interest to recruit and hire new staff. We can also approach you again in the future for another (similar) position at ACT, if you are not hired for the current position you applied for. The legal basis for this is your consent.
If you as an applicant visit our premises for a job interview, we also process footage you are depicted on obtained via the security cameras (CCTV). We process this information in view of our legitimate interest to maintain our internal integrity, access control and security of our premises.
Visitors of the website
Finally, we process information about the visitors of our website (or rather about their mobile device), by placing cookies every time they visit our website. This information includes, for example, the pages you visit, the IP address of your device, the type of operating system you use, network information of your browser type, and traffic to and from our website. The legal basis for this is the consent we ask each visitor upon their first visit to our website (for non-privacy friendly and advertising cookies) and our legitimate interest (for functional and privacy friendly analytical cookies). You may withdraw your consent and/or object to the processing of your personal data on the basis of our legitimate interest, respectively, at any time. Please see our cookie statement for more information about the cookies we place.
2. How long do we keep your personal data?
In principle, we will retain your personal data no longer than necessary for the purpose(s) indicated in this Privacy Statement and in accordance with (local) legal obligations. Upon the expiration of a retention period, we will delete or anonymize your personal data, unless we have to retain the data for one or more other purposes. In that event, we will ensure that your personal data is only accessible for that other purpose.
Personal data of clients and their contacts
As a rule, we keep the personal data of our contact persons at clients for two years after the final transaction with that client is completed. We keep our administration, including invoices and other documents that include the personal data of parties, for a period of seven years after the end of the financial year, in order to comply with our statutory retention obligation for tax purposes.
Recordings of conversations in the trading room
The recordings of conversations in the trading room are kept until the information is no longer required, with a minimum retention period of five years.
Personal data of prospects
The personal data of prospects is deleted at the request of the data subject, or ultimately one year after the final communication with the person concerned.
Other contact details
We keep other contact details for one year after the final contact, or until you submit a request to us to delete them.
Recruitment and application procedures
Information about applicants that are not hired are kept until four weeks after the end of the application process. If you have given your consent, your data will be stored for a period of one year, so that we can keep you in mind for future vacancies. These terms are necessary for us to evaluate the applicant’s application, to create a talent pool which is of great value to us and to possibly contact the applicant about future opportunities consistent with this Privacy Statement.
Regarding CCTV images, we will retain your personal data for a maximum of four weeks. After this period, your personal data will be automatically erased, unless the footage is required in relation to an incident or contingency. We will erase your personal data after it is no longer necessary in this regard.
Personal data of visitors
Personal data that we collect about you as a website visitor will not be kept longer than necessary. The applicable retention periods are indicated in our cookie statement.
Please contact us using the contact details below if you have questions about specific retention periods.
3. Where do we store and transfer your personal data?
Where necessary for the purposes specified above, we may also share personal data within the ACT group of affiliates and subsidiaries, and with third parties, who are located outside the European Economic Area (“EEA”).
We have concluded a model agreement within the ACT group of affiliates and subsidiaries based on the standard contract clauses approved by the European Commission in Commission Decision of 4 June 2021 (EC 2021/914C) and other applicable laws.
If we transfer your personal data to third parties outside the EEA, we will apply appropriate safeguards that provide an adequate level of protection for your rights and freedoms as a data subject in accordance with the GDPR. We do this, for example, by relying on an adequacy decision as adopted by the European Commission in keeping with Article 45 GDPR, concluding contracts based on the standard contract clauses for data transfers issued by the European Commission, or by other appropriate safeguards as provided in Article 46-49 GDPR.
If you wish to receive further information on the international transfer of your personal data, please contact us by using the contact details provided at the bottom of this Privacy Statement.
4. With whom do we share your personal data?
We share your personal data internally and with third parties in the following circumstances:
- Within the ACT group of affiliates and subsidiaries.
- Personal data is stored electronically and may be included in emails we send or receive and is consequently stored (and processed) by our ICT providers. We have concluded data processing agreements with these providers that stipulate at least the same level of security and reliability that you may expect from ourselves.
- With other service providers that may process your personal on our behalf in the context of performing their services. We have concluded data processing agreements with these providers that stipulate at least the same level of security and reliability that you may expect from ourselves.
- We may also share data with firms that conduct customer satisfaction surveys for us.
- Recruitment and application data is stored in our recruitment software from Greenhouse Software, Inc., a cloud services provider located in the United States of America and engaged by ACT to help manage its recruitment and hiring process on ACT’s behalf. When an applicant proceeds to the next phase in the application procedure, his/her personal data may also be shared with an assessment agency and if necessary, and in consultation, with Validata Group B.V. (D/B/A CV-OK), the agency that conducts screenings for us. CV-OK has a license from the Dutch Data Protection Authority to process criminal data (if necessary).The data collected via cookies is processed by the providers of those cookies. Please see our cookie statement for more information.
- We may also share the personal data of contact persons at clients with third parties where this is necessary in order to execute your order. We may for instance share your data with sellers or regulators (where necessary).
- With our external advisors, such as auditors, consultants, lawyers and our accountant. Our accountant e.g. may have access to the personal data of contact persons at clients.
- When required to do so by law, court order, or other legal process, for example with law enforcement agencies or other governmental agencies, to establish or exercise our legal rights or in connection with a corporate transaction.
- With other third parties, if you have given your consent or if this results from a legal provision.
We have adopted a strict security policy, including appropriate technical and organizational measurements, to protect your personal data against loss, abuse and unauthorised access by third parties. We apply strict access authorisation, both offline and online, and our servers are regularly backed up, and our connections are secure. Our servers are installed in the Netherlands
.6. What are your rights?
As a data subject, you have a number of rights that you may exercise in the context of our processing of your personal data:
- Right of access. You are entitled to a copy of the personal data we hold about you and to learn details about how we use it. Your personal data will usually be provided to you digitally or we might offer you the possibility of viewing your personal data on premise. We may require proof of your identity before providing the requested information.
- Right to rectification. We take reasonable steps to ensure that the information we hold about you is accurate and complete. However, if you believe this is not the case, you have the right to request that any incomplete or inaccurate personal data that we process about you is amended.
- Right to erasure. You have the right to ask us to erase your personal data, for example where the personal data is no longer necessary for the original purpose for which they were collected, where personal data has become obsolete or where you withdraw your consent to the grounds on which data is processed. However, this will need to be balanced against other factors. For example, we may not be able to comply with your request due to certain legal or regulatory obligations.
- Right to restriction of processing. Under certain circumstances you are entitled to ask us to (temporarily) stop using your personal data, for example where you think that the personal data we hold about you may be inaccurate or where you think that we no longer need to use your personal data.
- Right to data portability. You may have the right to ask that we transfer personal data that you have provided to us to a third party of your choice. This right can only be exercised when you have provided the personal data to us, and when we are processing that data by automated means based on your consent or in order to perform our obligations under a contract with you.
- Right to object. You have the right to object to processing which is based on our legitimate interests. For purposes based on our legitimate interests, we will no longer process the personal data on that basis when you file an objection, unless we have a compelling legitimate ground for the processing.
- Rights relating to automated individual decision-making. You have the right not to be subjected to a decision based solely on automated decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you. If you have been subject to an automated decision and do not agree with the outcome, you can contact us using the details below and ask us to review the decision.
- Right to withdraw your consent. We may ask for your consent to process your personal data in specific cases. When we do this, you have the right to withdraw your consent at any time. ACT will stop the further processing as soon as possible after the withdrawal of your consent. However, this does not affect the lawfulness of the processing before consent was withdrawn.
If you are not satisfied about the way we have handled your complaint, or if you prefer not to make your complaint to us, you may also submit a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), via the website www.autoriteitpersoonsgegevens.nl.
7. Contact information
If, after reading this Privacy Statement, you have any questions about how one or more entities in the ACT group handle your personal data, or if you wish to exercise your rights under the Data Protection Laws, or if you wish to make a complaint about our use of your personal data, you may contact our ACT group central point of contact at telephone number +31(0)20-2199268 or by email at HStrikwerda@actcommodities.com.
Sometimes changes may occur in our processing of your personal data or the applicable legislation. In that event we may amend this Privacy Statement. In the event of major changes, we will post an updated version on the website and/or (insofar possible) inform you of those changes by email.
Version August 2023