Privacy Policy

EventDock B.V. ("EventDock", "we", "us", "our") attaches great importance to the protection of personal data. In this Privacy Policy we explain which personal data we process, why we do so, on what legal basis, how long we retain data and which rights you have.

This Privacy Policy applies to our website (www.eventdock.nl) and to our services: rental of security systems, sale of equipment, installation and project work, and recurring services such as connectivity, cloud storage, monitoring, remote support and maintenance.

This Privacy Policy and our Data Processing Agreement are complementary. This Privacy Policy informs data subjects about the processing operations for which EventDock is itself the controller. The Data Processing Agreement governs the arrangements between EventDock and the business Client for the camera and detection data that EventDock processes on that Client's behalf.

We process personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable privacy legislation.

The allocation of roles under the GDPR is determined per processing operation.

EventDock as controller: EventDock is the controller for personal data it processes for its own business purposes, including client and contact administration, quotations and invoicing, account data, website use, marketing and newsletters, support and system logs, security, fraud prevention and its own business operations.

EventDock as processor: For camera images, detection data and related data that EventDock processes solely on behalf of a Client, EventDock acts in principle as processor and the Client is the controller. In that case the Client determines the purpose, the settings, the retention period and who has access. Those processing operations are covered by the Data Processing Agreement; see also article 7.

Contact details: EventDock B.V. Email: privacy@eventdock.nl Phone: +31 85 505 5059 Website: www.eventdock.nl

For questions about this Privacy Policy or about the processing of your personal data, you can contact us using the details above.

EventDock has not currently appointed a Data Protection Officer. For privacy questions you can contact us at privacy@eventdock.nl.

We periodically reassess whether the nature and scope of our processing activities require the appointment of a Data Protection Officer.

We process the following categories of personal data:

Account and contact data: - First and last name - Email address and telephone number - Job title and the organisation you work for - Company name, chamber of commerce and VAT number (where applicable)

Order, rental and sales data: - Delivery, installation and invoicing address - Payment and invoice data - Order, rental and purchase history - Rental periods, subscriptions and terms

Installation, service and maintenance: - Installation appointments, planning and on-site contact persons - Location data of equipment and installations - Serial numbers and system configurations linked to a Client - Service and maintenance history, fault reports and warranty claims - Remote support sessions, installation and maintenance reports

Technical data: - IP address, browser type and version, operating system and device information - Cookies and similar technologies (see our Cookie Policy)

Communication data: - Correspondence by email, telephone, WhatsApp or forms - Feedback, reviews and customer service requests

Camera and detection data (for security systems supplied, rented out, managed or supported by EventDock): - Camera images, video fragments and snapshots - Timestamps, location and camera identification data - Detection events and object classifications, such as person or vehicle - Motion and detection metadata - Licence plate data, if licence plate recognition (ANPR/LPR) is used - Biometric data, if facial recognition is used; see article 8

Platform and audit logs: - User ID, login moments and IP addresses - Images viewed, downloaded or exported - Changes to settings, users and permissions - Security and access logs

Source of personal data: We receive personal data directly from you, from the organisation you work for, from other users within your organisation, from business partners or from public business sources. Camera and detection data are collected via the systems installed at a location; for that data the Client is in principle the controller.

We process personal data for the following purposes:

Performance of the agreement: - Processing enquiries, quotations, orders and reservations - Delivering, positioning, installing, maintaining and collecting systems - Invoicing and payment processing - Support, fault investigation, remote management and customer service - Providing recurring services such as connectivity, cloud storage and monitoring

Legitimate interests, per purpose: - Security of our systems, accounts and platform: preventing unauthorised access and misuse, including keeping platform and audit logs - Combating fraud: detecting and preventing fraudulent orders, payments and enquiries - Product improvement: improving our products, website and services based on usage and fault information - Business operations: administration, reporting, quality assurance, insurance and substantiating or defending claims - Business communication with existing Clients about comparable products and services

For processing based on a legitimate interest, we weigh that interest against your interests, rights and freedoms. You may object; see article 11.

With your consent: - Sending newsletters and marketing communication to persons with whom we have no existing relationship - Placing non-essential cookies, if we use them in the future

Legal obligations: - Complying with tax and accounting obligations - Complying with statutory retention periods and information requests from competent authorities

We process your personal data on the basis of the following legal grounds:

Performance of the agreement (art. 6(1)(b) GDPR): Where processing is necessary for the performance of an agreement to which you are a party, or for the preparatory steps thereto, such as processing an enquiry, rental, purchase or installation.

Legitimate interest (art. 6(1)(f) GDPR): For the interests specified per purpose in article 5, provided that your interests, rights and freedoms do not override them.

Consent (art. 6(1)(a) GDPR): Where you have given express consent, for example for newsletters. You may withdraw your consent at any time.

Legal obligation (art. 6(1)(c) GDPR): Where processing is necessary to comply with a legal obligation.

Special categories of personal data (art. 9 GDPR): Facial recognition processes biometric data for the purpose of uniquely identifying a person. Such processing requires an exception under article 9 GDPR, such as the explicit consent of the data subject or another basis provided by law. For systems that EventDock supplies or manages on behalf of a Client, that Client, as controller, is responsible for establishing and documenting a valid basis, for the required prior data protection impact assessment (DPIA) and for informing data subjects.

The following provisions apply to security systems supplied, rented out, managed or supported by EventDock.

Roles of the parties: For camera images and detection data, EventDock acts in principle as processor and the Client is the controller. This processing takes place solely on the Client's instructions and on the basis of a Data Processing Agreement. Suppliers that process camera or detection data on behalf of EventDock qualify as sub-processors; the Data Processing Agreement governs their engagement.

Forms of storage: - Local storage on EventDock equipment on site, for example in the mast or enclosure - Local storage in the Client's own systems or on the Client's own equipment - EventDock cloud storage, only where agreed - External third-party cloud or platform services, where the Client chooses this or it forms part of the agreed configuration

Which form of storage applies follows from the configuration and the arrangements made. For data in the Client's systems or with an external party chosen by the Client, that Client or that supplier respectively is responsible for security, access, retention and deletion.

Security: Camera and detection data are protected with appropriate technical and organisational measures, including, where appropriate, encryption in transit and at rest, access security, role-based user management and logging of access and export.

Retention periods: - The retention period for camera images is agreed with the Client and depends on the purpose of the processing and the technical configuration - As controller, the Client is responsible for setting an appropriate retention period that is as short as possible - EventDock deletes data in accordance with the Client's instructions and the Data Processing Agreement - Images stored solely locally on the equipment are erased on collection or dismantling - Images in EventDock's cloud storage are deleted within 30 days after the end of the rental period or the subscription, unless agreed otherwise or unless legal obligations require otherwise

Client responsibilities: - As controller, the Client is responsible for informing data subjects about the camera surveillance, including, where required, displaying clearly visible information or warning signs and making additional privacy information available - The Client assesses whether a DPIA is required and carries it out. EventDock reasonably assists the Client in doing so, in so far as the information required relates to the processing supplied by EventDock - The Client determines the settings, including camera orientation, privacy masks, detection features and access rights - The Client handles data subject requests relating to camera images; see article 11

Our security systems may use automated image analysis in order to detect and classify, for example, persons, vehicles, movement or other events. This analysis may be used to flag events or generate alerts. EventDock does not use this analysis for fully automated decision-making that has legal consequences for data subjects or otherwise significantly affects them.

AI object detection: Object detection recognises categories, such as person, vehicle, animal or object, and movement within an image. It does not use biometric features to uniquely identify a person. Detection is probabilistic: incorrect alerts (false positives) and undetected events (false negatives) may occur. Classifications are indicative and do not constitute proof of identity.

Licence plate recognition (ANPR/LPR): With licence plate recognition, licence plates are read and recorded, for example for access control or the registration of vehicle movements. A licence plate may constitute personal data. The Client determines whether this feature is used, for what purpose and how long the data are retained.

Biometric facial recognition: Our systems may include facial recognition. This involves processing biometric data for the purpose of uniquely identifying persons. This is processing of special categories of personal data within the meaning of article 9 GDPR and is subject to stricter requirements than ordinary object detection: a valid exception under article 9 GDPR must apply, a DPIA is in principle mandatory and data subjects must be clearly informed. For systems that EventDock supplies or manages on behalf of a Client, that Client is responsible for this as controller; EventDock processes solely on instruction and in accordance with the Data Processing Agreement.

Where EventDock itself introduces new AI, monitoring, licence plate or analysis functionality for which it determines the purposes and means, EventDock assesses in advance whether a DPIA is necessary and documents that assessment.

We may share personal data with the following categories of recipients, only in so far as necessary:

Service providers and processors: - Payment service providers - Hosting and cloud providers - Communication and email providers - Analytics providers - Logistics partners and carriers - Software suppliers and support tooling - Security and monitoring providers

Third parties: - Public authorities and supervisory authorities where legally required - Professional advisers, such as accountants and lawyers - Insurers, in connection with damage or claims

We never sell your personal data to third parties.

We conclude data processing agreements with processors so that they process data with an appropriate level of protection. An up-to-date list of relevant (sub-)processors can be provided on request via privacy@eventdock.nl. For camera and detection data for which EventDock is a processor, the engagement of sub-processors runs via the Data Processing Agreement with the Client.

We do not retain personal data for longer than necessary for the purposes for which they were processed.

General retention periods: - Account data: for as long as you have an account, plus 2 years after termination - Order, invoice and administrative data: 7 years (statutory tax retention obligation) - Communication data: 2 years after the last contact - Installation, service and maintenance data: for the duration of the services and thereafter for as long as necessary for warranty, liability and maintenance history, in principle no longer than 5 years - Newsletter subscription: for as long as you are subscribed, plus a maximum of 1 year after unsubscribing - Marketing preferences: for as long as those preferences apply - Unsubscribe and suppression data: we keep a minimal record of unsubscribes for as long as necessary to prevent you from being contacted again - Platform and audit logs: in principle no longer than 12 months, unless an incident justifies longer retention - Camera and detection data: in accordance with article 7 and the Client's instructions

Once the retention period has expired, data are deleted or anonymised.

Under the GDPR you have the following rights with regard to your personal data:

Right of access: You have the right to know which personal data we process about you and to receive a copy of them.

Right to rectification: You have the right to have inaccurate personal data corrected or incomplete data completed.

Right to erasure (right to be forgotten): You have the right to have your personal data erased, provided we have no legal or contractual ground to retain them.

Right to restriction of processing: You have the right to have the processing of your data restricted in certain circumstances.

Right to data portability: You have the right to receive your data in a structured, commonly used and machine-readable format.

Right to object: You have the right to object to processing based on a legitimate interest, and to direct marketing.

Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time.

Exercising your rights: You can send your request to privacy@eventdock.nl. EventDock may request additional information where this is reasonably necessary to establish the identity of the person making the request; for requests concerning camera images this is almost always the case. We will in principle respond within one month of receiving your request. This period may be extended by up to two months in the cases where the GDPR permits this. If we extend the period, we will inform you accordingly.

Requests concerning camera images: For requests relating to camera images for which a Client is the controller, the data subject should in principle contact that Client, for example the organisation operating the camera surveillance at the location. If EventDock receives such a request, EventDock will handle it in accordance with the Data Processing Agreement and, where necessary, forward it to the Client or assist the Client with it.

EventDock does not use fully automated decision-making that has legal consequences for you or otherwise significantly affects you, within the meaning of article 22 GDPR.

We do use automated processes for:
- Calculating the availability and prices of products
- Generating quotations based on your selection
- Flagging potentially fraudulent transactions

These processes do not result in decisions based solely on automated processing; human intervention is always possible.

Article 8 applies to the automated analysis of camera images, detection, licence plate recognition and facial recognition.

If in future we were to use automated decision-making within the meaning of article 22 GDPR, we will inform you and implement the required safeguards.

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or destruction.

Our measures include: - Encryption in transit (TLS) and, where appropriate, encryption of stored data - Access management, authentication and role-based permissions - Logging of access, changes and data exports - Periodic review of security measures and suppliers - Awareness and instruction of staff regarding privacy and security - A procedure for handling security incidents and data breaches

Data breaches: - For processing operations for which EventDock is the controller, we report a data breach to the Dutch Data Protection Authority where legally required, and inform data subjects where the breach is likely to result in a high risk to their rights and freedoms. These are two separate assessments with different thresholds - For processing operations for which EventDock is a processor, including camera and detection data, EventDock informs the Client as controller without undue delay after becoming aware and assists the Client with its notification obligation. In that case the Client decides on notification to the supervisory authority and to data subjects

Personal data may be transferred to and processed in countries outside the European Economic Area (EEA), for example where a supplier is established there or provides support from there.

This may in particular apply to the following types of services: cloud and hosting services, support and helpdesk tooling, email and communication services, analytics and other SaaS suppliers.

We ensure that such transfers comply with the GDPR by:
- Transferring data to countries covered by an adequacy decision of the European Commission, or
- Using the European Commission's Standard Contractual Clauses (SCCs), and
- Taking additional technical and organisational measures where necessary

Because the GDPR applies throughout the EU and EEA, we maintain a single privacy policy for all countries in which we operate, including the Netherlands, Belgium, Germany and Austria.

You can request further information about the safeguards applied to international transfers via privacy@eventdock.nl.

Our services are not directed at children under the age of 16. We do not knowingly collect personal data from children below that age via our website or our sales process.

If you discover that we have processed personal data of a child without the consent of a parent or guardian, please contact us so that we can delete such data.

We may amend this Privacy Policy from time to time, for example in the event of new functionality, new suppliers or amended legislation. Significant changes will be announced via our website or by email.

The "Last updated" date at the top of this policy indicates when it was last revised.

We recommend that you consult this Privacy Policy regularly.

If you have a complaint about the processing of your personal data, you can contact us at privacy@eventdock.nl. We would be glad to discuss the matter with you first.

You also have the right to lodge a complaint with the Dutch Data Protection Authority or, where applicable, with another competent supervisory authority within the European Economic Area, for example the authority of the country where you live or work.

The Dutch supervisory authority is:

Autoriteit Persoonsgegevens Postbus 93374 2509 AJ DEN HAAG, the Netherlands Website: www.autoriteitpersoonsgegevens.nl Telephone: +31 88 1805 250

For questions about this Privacy Policy, about the processing of your personal data or about our Data Processing Agreement, you can contact us:

EventDock B.V. Email: privacy@eventdock.nl Phone: +31 85 505 5059 Website: www.eventdock.nl

We will in principle respond within one month of receiving your request. This period may be extended by up to two months in the cases where the GDPR permits this; we will inform you of any such extension.