Privacy Policy

EventDock B.V. ("EventDock", "we", "us", "our") attaches great importance to the protection of your personal data. In this Privacy Policy, we explain which personal data we collect, why we do so, and how we protect your data.

This Privacy Policy applies to all services offered by us via our website (www.eventdock.nl) and our rental and sales services.

We process your personal data in accordance with the General Data Protection Regulation (AVG/GDPR) and other applicable privacy legislation.

EventDock B.V. is the data controller for the processing of your personal data.

Contact details: EventDock B.V. Email: privacy@eventdock.nl Website: www.eventdock.nl

For questions about this Privacy Policy or about the processing of your personal data, you can contact us via the above details.

Given the size of our organisation and the nature of the data processing, EventDock is currently not obliged to appoint a Data Protection Officer (FG/DPO) in accordance with article 37 GDPR.

For all questions and requests regarding privacy and data protection, you can contact our privacy team via privacy@eventdock.nl.

Should the nature or scope of our processing activities change, we will reassess whether the appointment of a DPO is necessary.

We collect the following categories of personal data:

Account Data: - Surname and first name - E-mail address - Telephone number - Company name (if applicable) - VAT number (if applicable)

Order and Rental Data: - Delivery address - Billing details - Payment details - Order history - Rental periods

Technical Data: - IP address - Browser type and version - Operating system - Device information - Cookies and similar technologies (refer to our Cookie Policy)

Communication Data: - Correspondence via e-mail, telephone or chat - Feedback and reviews - Customer service requests

Camera Data (if applicable): - Images stored via cloud services linked to rented cameras - Metadata of camera footage (timestamps, camera identification) - Access logs of the cloud platform

We process your personal data for the following purposes:

Performance of the agreement: - Processing orders and reservations - Delivery and collection of rented products - Invoicing and payment processing - Customer service and support

Legitimate interests: - Improvement of our services and website - Fraud prevention and security - Statistical analyses and reporting

With your consent: - Sending newsletters and marketing communications - Personalised offers

Legal obligations: - Compliance with tax and accounting obligations - Compliance with statutory retention periods

We process your personal data based on the following legal grounds:

Performance of a contract (Art. 6 lid 1 sub b GDPR): When processing is necessary for the performance of a contract to which you are a party, such as processing your order or rental agreement.

Legitimate interest (Art. 6 lid 1 sub f GDPR): When processing is necessary for our legitimate interests, such as fraud prevention or improvement of our services, provided that your interests do not outweigh them.

Consent (Art. 6 lid 1 sub a GDPR): When you have given explicit consent, for example for receiving newsletters. You may withdraw your consent at any time.

Legal obligation (Art. 6 lid 1 sub c GDPR): When processing is necessary to comply with a legal obligation.

When you use our camera rental services with cloud storage, the following specific provisions apply:

Role of EventDock: EventDock acts as a processor of the camera images within the meaning of the GDPR. The Customer remains the data controller for the images recorded with the rented cameras.

Storage and security: - Camera images are stored on secure servers within the European Economic Area (EEA) - All images are stored encrypted (AES-256 encryption) - Access to images is restricted to authorised users via the customer account

Retention periods: - Camera images are stored by default for the agreed storage period - After the end of the Rental Period, images are deleted within 30 days, unless otherwise agreed - The Customer can have images deleted earlier by contacting EventDock

Responsibility Customer: - The Customer is responsible for placing warning signs in accordance with the GDPR - The Customer must carry out a DPIA (Data Protection Impact Assessment) if required - The Customer is responsible for handling data subject access requests regarding camera images

We may share your personal data with the following parties:

Service Providers and Processors: - Payment processors (Stripe, iDEAL) - Delivery services and logistical partners - Hosting and cloud services - E-mail marketing services - Customer service software

Third Parties: - Government authorities when legally required - Professional advisors (accountants, lawyers)

We never sell your personal data to third parties.

We have entered into data processing agreements with all our processors to ensure that they protect your data in the same manner as we do.

We do not store your personal data longer than necessary for the purposes for which they were collected.

General retention periods: - Account data: As long as you have an account, plus 2 years after closing your account - Order and invoice data: 7 jaar (statutory fiscal retention period) - Communication data: 2 years after the last contact - Marketing data: Until withdrawal of your consent - Camera footage (cloud): In accordance with the agreed storage period, maximum 30 days after the end of the Rental Period

Upon expiry of the retention period, your data will be deleted or anonymised.

Pursuant to the GDPR, you have the following rights regarding your personal data:

Right of access: You have the right to know which personal data we process about you and to receive a copy thereof.

Right to rectification: You have the right to have inaccurate personal data corrected or incomplete data completed.

Right to erasure (right to be forgotten): You have the right to have your personal data erased, provided we have no legal obligation to retain the data.

Right to restriction of processing: You have the right to restrict the processing of your data in certain circumstances.

Right to data portability: You have the right to receive your data in a structured, commonly used, and machine-readable format.

Right to object: You have the right to object to the processing of your data based on our legitimate interests.

Right to withdraw consent: If the processing is based on your consent, you may withdraw it at any time.

To exercise your rights, you can contact us via privacy@eventdock.nl. We will respond to your request within 30 days.

EventDock does not make use of fully automated decision-making that has legal consequences for you or otherwise affects you significantly, as referred to in article 22 GDPR.

We may, however, make use of automated processes for:
- Calculating the availability and prices of products
- Generating quotes based on your selection
- Detecting fraudulent transactions

These processes do not lead to decisions based solely on automated processing. Human intervention is always possible.

If we were to employ automated decision-making in the future, we will inform you accordingly and implement the required safeguards in accordance with the GDPR.

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or destruction.

Our security measures include: - SSL/TLS encryption for all data transfers - Encrypted storage of sensitive data - Access management and authentication - Regular security audits - Employee training in the areas of privacy and security - Incident response plan for data breaches

In the event of a data breach that is likely to pose a high risk to your rights and freedoms, we will notify you and the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) thereof in accordance with the legal requirements.

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA).

We ensure that such transfers are in accordance with the GDPR by:
- Only transferring data to countries with an adequacy decision from the European Commission
- Using Standard Contractual Clauses (SCCs) where necessary
- Implementing supplementary security measures where necessary

You can request more information about the safeguards we apply to international transfers by contacting us.

Our services are not directed at children under the age of 16. We do not knowingly collect personal data from children under this age.

Should you discover that we have collected personal data from a child without the consent of a parent or guardian, please contact us so that we may delete this data.

We may amend this Privacy Policy from time to time. Significant changes will be announced via our website or by e-mail.

The "Last updated" date at the top of this policy indicates when it was last revised.

We recommend that you consult this Privacy Policy regularly to stay informed about how we protect your data.

If you have a complaint regarding the processing of your personal data, you may contact us via privacy@eventdock.nl.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Dutch Data Protection Authority (Autoriteit Persoonsgegevens)):

Dutch Data Protection Authority (Autoriteit Persoonsgegevens) PO Box 93374 2509 AJ DEN HAAG Website: www.autoriteitpersoonsgegevens.nl Phone: 088 - 1805 250

For questions about this Privacy Policy or about the processing of your personal data, you can contact us:

EventDock B.V. Email: privacy@eventdock.nl Website: www.eventdock.nl

We aim to process your requests as quickly as possible and to respond within 30 days at the latest.