Privacy and cookies

This Privacy Statement is applicable to the processing of personal data by Invest-NL N.V. (Chamber of Commerce number 76635457) and its subsidiaries Invest-NL Capital N.V. (Chamber of Commerce number 76646971), Invest-NL Business Development B.V. (Chamber of Commerce number 76646998), INNL Publiek-Private Product Structurering B.V. (Chamber of Commerce number 90810872) and Beschermingsvoorziening Economische Veiligheid B.V. (KvK nummer 93327900) hereinafter collectively referred to as Invest-NL.

Invest-NL respects your privacy and treats your personal data with due care and confidentiality. Your personal data are processed in accordance with the applicable data privacy legislation. This Privacy Statement sets out the purposes and lawful bases for the processing of your personal data. We advise you to read this Statement carefully.

Personal data

Personal data means any information relating to an individual who can be directly or indirectly identified by reference to the information. A wide range of information constitutes personal data including name and e-mail address. Information about a sole proprietorship, general partnership or professional partnership is also considered personal data. This does not apply to the data regarding a legal entity such as a private limited company (Dutch: BV) or public limited company (Dutch: NV). Data regarding a contact person or representative of a legal entity, however, is considered personal data.

Processing

The processing of personal data means any interaction with the personal data, including collecting, storing, viewing, modifying, transferring, or deleting it for instance.

Invest-NL is responsible for the processing and storage of your personal data. To ensure that this is done as carefully as possible, we have appointed a Data Protection Officer (DPO) and any data protection questions that are not addressed in our Privacy Statement or Cookie Policy can be directed to the DPO at dpo@invest-nl.nl.

Invest-NL processes company information, including personal data, in order to provide services to companies and partners. This includes contact details, such as e-mail addresses and business telephone numbers. By law, we are permitted to do this only if 'there is a lawful basis processing'. Invest-NL will use your personal data if the following lawful bases for processing are provided for in the GDPR:

1. You have provided consent for the processing of your personal data
We may process your personal data because you have given us your explicit consent to do so, for example, you have subscribed to our newsletter. If you have provided consent for the processing of your data, you may withdraw that consent at any time. From that moment on, we will no longer process your personal data.

2. We use personal data to fulfil a contract with you
We need your personal data to process your applications for possible financing or advisory services, which may ultimately result in a contract between you and Invest-NL and thus the fulfilment of the contract by Invest-NL.

3. We need your personal data to comply with a legal obligation
The law lays down many rules that we have to comply with, such as taking measures to prevent and combat fraud, tax evasion, terrorist financing, and money laundering. That is why we ask you, among other things, to provide proof of identity so that we know who you are. We will keep a copy of your identity document.

 4. There is a legitimate business interest to use the personal data
Any data processing that goes beyond the scope of what is strictly necessary for Invest-NL to provide services, a legal obligation, or your consent, will be based on the legitimate interest. This interest must be balanced with your rights and interests.

These processing operations are necessary for the normal management and continuity of our business. For these processing purposes, we balance the interests of Invest-NL with your privacy interests. We then assess whether we can achieve the same goal through other means. And whether we really need all the data.

You have the right to object to our processing of your personal data at any time. More information on the right to object is provided below in this Privacy Statement.

We only use your personal data for the purposes for which they were provided by you and if there is a lawful basis for doing so. These purposes and the lawful bases are:

• Purpose: To finance a business
  Lawful basis: Fulfil a contract
• Purpose: Provision of advisory services by Invest-NL Business Development B.V.
  Lawful basis: Fulfil a contract
• Purpose: Purchase products from suppliers and procure services from parties we work with
  Lawful basis: Fulfil a contract
• Purpose: Screen clients and partners
  Lawful basis: Legal obligation: Invest-NL was established by law. The Enabling Act stipulates that Invest-NL must pursue the highest standards of integrity.
• Purpose: Maintain administrative (investment) records and handle investment management
  Lawful basis: Legal obligation: Record-keeping and retention obligations
• Purpose: Contact clients and prospects, and respond to their questions
  Lawful basis:Client: Fulfil a contract
  Prospect: Consent
• Purpose: Manage our relationship with you and our marketing activities such as delivering digital newsletters by e-mail and organising meetings for business clients
  Lawful basis: Consent
• Purpose: Improve the Invest-NL website and services for website visitors
  Lawful basis: Consent
• Purpose: Handle complaints lodged by clients and other parties
  Lawful basis: Client: Fulfil a contract
  Other parties: Consent
• Purpose: Recruit and hire new employees
  Lawful basis: Consent
• Purpose: Conduct audits
  Lawful basis: Legal obligation

Invest-NL may process your personal data for purposes not yet provided for in this Privacy Statement. In such cases, we will contact you before using your personal data for such purposes, to inform you of the changes to our Statement for the protection of personal data and to give you the opportunity to refuse participation in the same.

Invest-NL discloses personal data to law enforcement agencies and other government bodies to the extent that it may be legally required or strictly necessary for the prevention, detection, investigation, or prosecution of criminal offences and fraud.

Any personal data we collect and use about you is usually because you have contacted us and voluntarily provided such personal details. For example, you have completed the QuickScan on our website in order to obtain financing and receive newsletters.

However, your personal data may also appear in our files without you having provided this information yourself. For example, because we are conducting a due diligence on your organisation due to an application for financing. We may also collect information from public sources.

The categories of data we process:

• Contact information:
  The information we need to contact you, such as your home address, telephone number, e-mail address
• Personal information:
  Personal information such as your name and surname, gender, title, country, place and date of birth, nationality
• Information about your (financial) situation and products we provide you:
  For example, bank account numbers and the products you have purchased from us, information about your company’s (financial) situation and information we use to identify and verify you as a client or supplier.
• Contractual information and transactional information
  Details about the products and services we provide you, such as financing or advisory services. Information about when a payment and/or repayment has been made.
• Data about the use of our website (see our Cookies, below)

While we routinely share data with third parties, we never sell or rent your personal data. Invest-NL has outsourced certain activities to third parties (read: (sub)processors), who process a part of your data on our behalf. Processes that are outsourced by Invest-NL include:

• Category: Administrative services
  Nature of work: Maintaining financial records, Maintaining investment records
• Category: Due diligence audits
  Nature of work:
  -Legal
  -Know Your Customer
  -Tax
  -Financial
• Category: ICT services
  Nature of work: Supplier of IT infrastructure for Invest-NL, service desk
• Category: Website
  Nature of workDeveloping, maintaining hosting the Invest-NL website
• Category: Recruitment and selection
  Nature of work: CVs and gamification for filling vacancies for Invest-NL Capital N.V.

Invest-NL enters into appropriate agreements with these data processors which provide for the protection of your personal data, and which oblige the processors to put in place appropriate measures to keep your data secure and only use your personal data according to our strict instruction. By signing this agreement, they agree to use the data only for the services and purposes described in the agreement. Thus, the (sub)processors will not use your personal data for any purpose other than the purposes for which they were collected by Invest-NL.

A complete list of data processors can be obtained from Invest-NL by sending an e-mail to dpo@invest-nl.nl. We will respond to your request within ten (10) business days.

Your personal data will be processed within the borders of the European Union. Invest-NL only engages data processors that are established in the European Economic Area (EEA). Sometimes these data processors engage subprocessors that process data in countries outside the EEA.

If and insofar as your personal data is processed outside the borders of the European Union, we will make sure that it is protected at the same level as within the EEA. Countries offer an adequate level of data protection if the European Commission has adopted an adequacy decision in respect of those countries. Click here for more information about the countries for which an adequacy decision has been adopted.

When the transfer cannot be based on an adequacy decision, Invest-NL will provide appropriate safeguards for the transfer of personal data to a country outside the EEA. Transfers to countries outside the EEA, which cannot be based on an adequacy decision, will only take place on the basis of binding corporate rules or standard contractual clauses.

Invest-NL does not use automated decision-making and/or profiling in the processing of personal data.

We do everything we can to protect your personal data. Invest-NL has in place appropriate technical and organisational security measures to protect the personal data we have under our control from alteration, loss, destruction and unauthorised access. We employ an internal policy framework and minimum standards (policies and procedures, IT security, etc.) across Invest-NL to ensure the confidentiality and integrity of your personal data and the manner in which it is processed. These standards are improved and aligned with new data privacy legislation and (technological) developments in the market.

In addition, Invest-NL employees are bound by confidentiality and may not disclose your personal data in an unlawful or unnecessary manner. All data are treated with due confidentiality in both organisational and technical areas and access to your data is provided on a need-to-know basis only.

To help us continue to protect your personal data, please contact Invest-NL any time you suspect that your personal data may have been compromised.

It is not always possible to delete personal data right away. The law stipulates certain retention periods. We are therefore required to retain specific personal data for a certain period. However, we will not use your personal data longer than necessary. When your personal data is no longer necessary for a process or activity for which it was originally collected, we will delete it within a reasonable period.

The retention period may vary from a few months to several years, depending on the applicable data privacy legislation and/or the term of the contract. A few examples of data retention periods are:

• Data that we are required to retain due to our record-keeping obligation will be retained for ten (10) years.
• If you are no longer an Invest-NL client, we will retain your customer data for a period six (6) years after our relationship has ended.

Recruitment & selection

Invest-NL does not keep personal data longer than necessary for the job application process. The data is only accessible to those directly involved in the process. After the completion of an application process, data is by default anonymised after 30 days. This means that data such as your CV will be removed from our database and that only data that cannot be traced back to an individual will be retained for reporting purposes. Personal data may be kept longer for future career opportunities within Invest-NL. With the consent of a potential candidate, we will retain data for up to twelve (12) months after the end of a job application process.

Invest-NL uses your personal data to provide you services. We handle this with due care. Needless to say, you have control over this information. You also have the following rights in respect of your personal data:

• The right to access your personal data
  If you would like to know what data we use and would like to receive an overview of your data, please contact us. You have the right to ask about the personal data we process about you. We will respond to this request in writing within four business weeks. This period may be extended if your request proves to be complex or subject to a specific right. You will be informed of any extension to the deadline.
  
  Good to know: before providing access to your personal data, we will ask you to verify your identity to protect you from identity theft and financial crime. We may also need to ask you some questions to ensure we have understood your request correctly.

• The right to rectification of mistakes and inaccuracies
  It is important that any personal data we use is accurate, up-to-date, and relevant. If you think your personal data is incorrect or incomplete and you wish to correct it, please contact us. You have the right to access, correct and/or update your personal data at any time.

• The right to deletion of your personal data
  You have the right to request that we delete certain personal data if, for example:
  - your personal data is no longer needed in relation to the purposes for which it was processed;
  - you withdraw your consent and there are no other lawful bases to process your personal data;
  - you feel that your personal data is not being processed lawfully; and
  - your personal data needs to be deleted to comply with legal requirements.

• The right to restrict processing
  You have the right to request the restriction or ‘freezing’ of the processing of your personal data for a limited time, if you feel that the personal data held by Invest-NL is inaccurate or has not been used correctly.

• The right to object to processing
  You have the right to object to the processing of your personal data for:
  - direct marketing purposes;
  - the legitimate interests of Invest-NL. You may unsubscribe from the e-mailing service at any time, for example.

• The right to data portabolity
  You have the right to request that your data be transferred to another party that has the role of data controller in a structured, commonly used and machine-readable format.

If you wish to exercise any of the aforementioned rights, please send an e-mail to dpo@invest-nl.nl.

If you have any concerns about how we have processed your personal data and would you like to lodge a complaint, please visit the compaints page for further details on how to do this. Privacy complaints are brought to the attention of our Data Protection Officer.

If the complaint is not resolved to your satisfaction or you do not agree with how Invest-NL has handled your complaint, you may file a complaint with the regulatory body. The Dutch Data Protection Authority is the regulatory body responsible for enforcement of the privacy legislation. Please visit www.autoriteitpersoonsgegevens.nl for more information on this and how you can contact the Dutch Data Protection Authority.

Invest-NL may review and update its Privacy Statement from time to time. If and when such updates are made, they will be incorporated in the Privacy Statement as soon as possible and the new version will be posted on our website, so please check our Privacy Statement periodically for updates. This version is from 2-2-2022.

If you have any questions about our privacy policy, Privacy Statement or wish to exercise any of your legal rights, please contact us using the information below:

Invest-NL N.V.
Kingsfordweg  43-117 (Q-Port)
1043 GP Amsterdam
The Netherlands
e-mail: dpo@invest-nl.nl

Please find below an explanation and the cookies:

1. __prepr_uid
This cookie stores a unique anonymous ID to recognize users across multiple visits within Prepr.
Type of cookie: Statistics
Cookie duration: 2 year

2. __prepr_ed
This cookie collects user behavior on the site to display personalized content via Prepr.
Type of cookie: Marketing
Cookie duration: Session (expires when the browser is closed)

3. _ga
This cookie registers a unique ID to track website usage statistics in Google Analytics.
Type of cookie: Statistics
Cookie duration: 2 years

4. ga#
This cookie is used to store session data per user for Google Analytics 4.
Type of cookie: Statistics
Cookie duration: 2 years

5. CookieConsent
This cookie stores whether and which cookie consent a user has given.
Type of cookie: Necessary
Cookie duration: 1 year

6. __cf_bm (hcaptcha.com & vimeo.com)
This cookie protects the website from bots and malicious traffic via Cloudflare.
Type of cookie: Necessary
Cookie duration: 1 day

7. _cfuvid
This cookie is used by Cloudflare to identify legitimate visitors during a session.
Type of cookie: Necessary
Cookie duration: Session (expires when the browser is closed)

8. articles-read-status
This cookie keeps track of which articles a user has already read.
Type of cookie: Functional
Cookie duration: Persistent

9. mp_2_pageviews
This Mixpanel cookie counts how many pages a user views during a session.
Type of cookie: Statistics
Cookie duration: Session (expires when the browser is closed)

10. mp_2_timerstart
This cookie records the time when a user started the session or page.
Type of cookie: Statistics
Cookie duration: Session (expires when the browser is closed)

11. mp_2_blocked
This cookie indicates whether tracking for a user is blocked in Mixpanel.
Type of cookie: Necessary
Cookie duration: Session (expires when the browser is closed)

12. mp_1_pageviews
This cookie tracks how many pages were viewed in a previous session or project version.
Type of cookie: Statistics
Cookie duration: 1 year

13. mp_1_timerstart
This cookie records when a session or page started for usage duration analysis.
Type of cookie: Statistics
Cookie duration: 1 year

14. mp_1_blocked
This cookie marks whether tracking in Mixpanel is disabled for a user.
Type of cookie: Necessary
Cookie duration: 1 year