Privacy statement

Personal data is processed within the framework of the services provided by Exter Polak & Charlouis B.V. (hereinafter referred to as 'EP&C' or 'we').  We also process personal data when you visit our website. The term 'personal data' refers to all information about an identified or identifiable natural person. EP&C qualifies as data controller within the meaning of the General Data Protection Regulation (EU) 2016/679 ('GDPR') when processing personal data. Our contact details, including the e-mail address at which we can be contacted for privacy related issues, are set out below:

EP&C
Postbus 3241
2280 GE  RIJSWIJK
+31 (0)70 414 54 54
privacy@epc.nl

What personal data do we process?

Clients

EP&C may process the following (categories of) personal data of clients and their contact persons:

  • Name and address details (name, first names, initials, titles, gender, address, postal code, residence) as provided by the client;
  • Other contact details (telephone number, e-mail address and similar data required for communication) and if and when relevant: your license plate number, as provided by the client;
  • Data relating to the handling of a matter, including data concerning the counterparty and third parties, as provided by the client, a counterparty and/or a third party or obtained from a public source, see also below under “Third parties”;
  • Data for the purpose of calculating and recording fees and expenses, making payments and recovering claims, including the bank account number provided by the client;
  • Other data obtained from public sources (such as the Commercial Register, the Chamber of Commerce and the Land Register) or data provided to us by third parties in the context of the handling of a matter;
  • Other data of clients of which the processing is required by or necessary to comply with applicable laws or regulations, such as, under certain circumstances, the processing of certain data relating to proof of identity.

Suppliers

We may process the following (categories of) personal data of persons from whom EP&C purchases products or services or who work for these suppliers:

  • Name and address details (name, first names, initials, titles, gender, address, postal code, residence) as provided by the supplier;
  • Other contact details (telephone number, e-mail address and similar data required for communication) if and when relevant: your license plate number, as provided by the supplier;
  • Data for the purpose of placing orders or purchasing services; calculating and recording fees and expenses and making payments, including the bank account number as provided by the supplier;
  • Other data of suppliers of which the processing is required by or necessary to comply with applicable laws or regulations, such as, under certain circumstances, the processing of certain data relating to proof of identity.

Applicants

When you apply for a job at EP&C, we will process the following personal data when we consider your application:

  • Your name and address (surname, first names, initials, title, gender, address, post code, place of residence);
  • Other contact details (telephone number, e-mail address and similar information required for communication);
  • Bank account number and travel expenses data (distance from home to work);
  • Nationality, date and place of birth;
  • Availability, CV and employment history, educational background (copies of certificates), cover letter;
  • References, details of the job applied for, interview records and written communication with the applicant;
  • Other data of job applicants of which the processing is required by or necessary to comply with applicable laws or regulations, such as, under certain circumstances, the processing of certain data relating to proof of identity.

Third parties

EP&C may process the following (categories of) personal data of third parties (such as persons who are not clients and of whom personal data can be found in our records, lawyers and other advisors with whom EP&C is in contact):

  • Name and address details (name, first names, initials, titles, gender, address, postal code, residence), as far as known to EP&C;
  • Other contact details (telephone number, e-mail address and similar data necessary for communication) if and when relevant: your license plate number, as far as known to EP&C;
  • Data relating to electronic messages originating from or intended for third parties and data required to maintain contact with these third parties;
  • Other data from third parties obtained from public sources or provided to EP&C by clients, counterparties or third parties in connection with the handling of a matter or the settlement of a dispute;
  • Other data of third parties of which the processing is required by or necessary to comply with applicable laws or regulations, such as, under certain circumstances, the processing of certain data relating to proof of identity.

Miscellaneous

When you receive our newsletter or an invitation to, for example, a workshop or other EP&C event, we process the following (categories of) personal data:

  • Your e-mail address;
  • Whether or not you received an EP&C newsletter or invitation;
  • Whether or not you opened the newsletter or invitation (open ratio) and the activity 'in' the newsletter or invitation (click ratio), which website pages you visited via the links in the newsletter or invitation and the name of the campaign in question (e.g. which newsletter or event);
  • An internal e-mail ID number. On the basis of this ID number we can find out which EP&C newsletter or invitation you opened;
  • If you opened the newsletter or invitation:
    • The time at which the newsletter or invitation was opened;
    • The e-mail client you use (the computer program you use to receive and send e-mails, e.g. Outlook, Apple Mail or Gmail).

When your register to participate in one of our webinars, we process the following (categories of) personal data:

  • Your e-mail address;
  • Your name;
  • Your company name
  • Your phone number
  • Your IP-address;
  • Data regarding the visitor behavior of registration pages and receiving e-mails in the context of the registration process for the webinar and follow-up of the webinar;
  • Viewing behavior during webinars and the interactions that a viewer has during a webinar.

For more information about the possible processing of personal data through the use of cookies when you visit our websites, we kindly refer you to our Cookie Statement.

On the basis of what principles do we process your personal data?

We process your personal data on the basis of one or more of the following legal principles:

  1. When this is necessary for the performance of an agreement to which you are a party or to perform pre-contractual acts at your request;
  2. When this is necessary in order to comply with a legal obligation;
  3. When this is necessary to protect our legitimate interests or the interests of a third party;
  4. With your consent.

If we process your personal data on the basis of your consent, we will ask you for this separately. You may withdraw your consent at any time. Please note that the withdrawal of your consent does not affect the lawfulness of the processing of your personal data prior to the withdrawal of your consent.

 For what purposes do we process your personal data?

EP&C uses the above personal data for the purposes stated below, in respect of which we have indicated for each purpose on the basis of which of the abovementioned legal processing grounds (a through d) EP&C does so. If the processing is based on the principle of ‘legitimate interest’, we briefly explain this interest. If you have any specific questions in this respect, please do not hesitate to contact us.

    • to provide the requested services, including identifying the client, the execution of the assignment agreement, advising and referring our clients (a, b and c: being able to offer and improve our services);
    • for the administration of EP&C, including the calculation or recording of fees or benefits, income and expenses, the payment and collection of claims (including the use of collection agencies or bailiffs) (a, b and c: the importance of keeping proper records);
    • to be able to deal with any complaints and disputes about the service (a, b and c: to defend rights, to maintain and improve existing relationships by means of proper handling of complaints, to improve the quality of the service);
    • to maintain contact and communicate with you; (a, b, c: the interest in bringing EP&C services to the attention of existing clients, d);
    • to handle your job application (more specifically: recruitment and selection, to assess your suitability for a current or future vacancy at EP&C, if applicable: to settle the expenses incurred by you for your application, internal control and business security, to improve the job application process, to deal with any questions/ remarks/complaints relating to the job application process, to make analyses and draw up reports on questions/ remarks/complaints (a, b, c: our legitimate interest in assessing whether you are suitable for the job opening, to secure our buildings and employees, improving our job application procedure, among other things, by analyzing questions/remarks and complaints and d: consent if you wish to remain in our portfolio, see the header: “How long do we retain your personal data?);”
    • for placing orders or purchasing services (a, b and c: our interest in being able to keep proper records);
    • for conducting audits and other internal controls and if and when relevant: to reserve a parking spot for you (a, b and c: our interest in being able to keep proper (visitor’s) records);
    • to comply with our legal and statutory obligations (b, c: the interest of being able to meet these obligations).

To whom do we disclose your personal data? 

We do not disclose your personal data to third parties ('recipients' within the meaning of the privacy legislation), unless this is necessary for the proper execution of the purposes described in this Privacy Statement, if this is required by law or if you have given your consent to this. The third parties to whom the personal data is made available are obliged to treat your personal data confidentially. If these parties are regarded as 'processors' within the meaning of the privacy legislation, we will ensure that a processing agreement is concluded with these parties that meets the requirements described in the GDPR. For example, we may share your personal data with another patent attorney to handle your matter during absence or leave or if we engage a third party to provide services to EP&C, such as an IT-provider. We may also (be required to) provide your personal data in the context of any (judicial or other) proceedings or in relation to correspondence with the counterparty. Finally, EP&C may provide personal data to other third parties, such as a supervisory authority or other public body, but only if required by law or with your consent.

We may share your personal data with:

  • EP&C employees;
  • Suppliers (e.g. software suppliers, payment service providers, bailiffs, courier services, translation agencies, accountants, etc);
  • Counterparties (such as the infringer), lawyers or advisors in the context of the provision of services;
  • Other parties, such as regulators and other agencies where required by law or with your consent.

In order to provide our services, EP&C might need to transfer your personal data to a recipient in a country outside the European Economic Area with a lower degree of protection of personal data than the European law offers. In that case, EP&C will ensure that such a transfer of personal data is in accordance with the applicable laws and regulations, for example by concluding a model contract prepared and approved for that purpose by the European Commission.

How long do we keep your personal data?

EP&C will not retain your personal data in an identifiable form for longer than is necessary to achieve the purposes set out in this Privacy Statement. More specifically, we use the following retention periods:

We retain certain personal data in order to comply with statutory retention obligations, such as the retention of certain accounting data for 7 years (from the end of the year in which the data in question have lost their current importance for (fiscal) business operations) in connection with the tax retention obligation incumbent upon us pursuant to Article 52 of the State Taxes Act (AWR). 

The personal data that you provide to EP&C for your application will be kept for up to four weeks after the end of the application procedure. With your consent, we will keep your personal data on file for one year after the end of the application procedure. This gives us the opportunity to contact you for any future vacancies at EP&C. When you join EP&C, your personal data will become part of your personnel file.

Please refer to our Cookie Statement for the retention periods of the information obtained via cookies on our website.

The specific retention periods referred to above may be extended if statutory retention obligations apply or become applicable. We may also retain personal data for longer if this is necessary for the settlement of incidents and/or legal disputes.

Security 

EP&C has taken appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing and against loss, destruction, damage, modification or disclosure. Our employees are bound to secrecy and are bound by instructions aimed at the adequate protection of your personal data. If you have any questions about the security of your personal data, or if you have any suspicions or indications of improper use, please get in touch with us via the contact details above. 

Your privacy rights 

You have the following rights with regard to the processing of your personal data by EP&C:

      • the right to ask whether we process personal data about you and, if so, to have access to your personal data;
      • the right to have your personal data rectified if it is incorrect or incomplete;
      • the right to have your personal data deleted ('right to be forgotten');
      • the right to object to the processing of your personal data or to limit the processing of your personal data;
      • the right to withdraw consent to the processing of your personal data, if the processing is based on your consent;
      • the right to obtain or hand over your personal data to a third party designated by you in a structured, common and machine-readable format ('right to data portability');

To exercise your rights, please contact us at privacy@epc.nl or by post using the above-mentioned contact details.

EP&C will only handle requests relating to your own personal data. In order to prevent us from providing information to the wrong person, we may ask you for additional information to verify your identity. We will, in principle, inform you no later than one month after receipt of your request if we are able to comply with your request. This period may be extended by two months in specific cases, e.g. in the case of a complex request. We will inform you about such an extension at the latest within one month after receipt of your request. Under the privacy legislation, we may refuse your request under certain circumstances. If this is the case, we will explain why. If you object to the processing of your personal data for direct marketing purposes, we will always respect your request. More information about your privacy rights can be found on the website of the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Complaints

If you have a complaint about the processing of your personal data by EP&C, we will try to arrive at a solution together with you. If this does not lead to the desired result, you have the right to submit a complaint to the competent regulator. In the Netherlands, this is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).  If you live or work in another country of the European Union, you can submit a complaint to the regulator in that country.

Changes

This Privacy Statement was last updated on 24 august 2020. We reserve the right to amend this Privacy Statement and will always post the most recent version of this Privacy Statement on our website.  In the event of substantial changes that could have a significant impact on one or more of the parties concerned, we will endeavour to inform these parties immediately.