Privacy Policy

2 Personal Data We Collect

We collect the following personal data, from you directly, from your employer or from public business sources:

• Contact details: name, job title, company, email address and telephone number.
• Correspondence: emails, letters and messages you send us, including the website contact form (name, email address, company, service of interest, subject and message).
• Contract and project records: names, roles and signatures in quotations, orders, reports, certificates and other project documents.
• Subcontractor personnel: qualification and certification records needed to confirm competence for the work, such as NDT and safety certificates.
• Job applications: CV, cover letter, certificates and correspondence you send us.
• Website technical data: IP address, browser type, pages requested and time of the request, recorded in our hosting provider's server logs.
• Website usage data (only with your consent): pages visited, how you arrived, time on the site and approximate location, device and browser, collected by analytics cookies (section 3).

We do not ask for special categories of personal data (for example health data) or for citizen service numbers in an enquiry or application. Please do not send them.

4 How We Use Personal Data and the Legal Basis

We use personal data only for the purposes below. The legal basis is the GDPR article given for each purpose.

• Answering enquiries and contact form messages: steps at your request before a contract (article 6(1)(b)), or our legitimate interest in answering business enquiries (article 6(1)(f)).
• Quotations, contracts and project delivery, including reports and certificates: performance of a contract (article 6(1)(b)) where you are the contracting party; otherwise our legitimate interest in performing the contract with your employer (article 6(1)(f)).
• Confirming the competence of subcontractor personnel: legal obligation (article 6(1)(c)) where the law requires it; otherwise our legitimate interest in meeting client and management system requirements (article 6(1)(f)).
• Invoicing, bookkeeping and tax: legal obligation (article 6(1)(c)).
• Complaints, appeals and disputes, and establishing or defending legal claims: legitimate interest (article 6(1)(f)).
• Assessing job applications: steps at your request before an employment contract (article 6(1)(b)); keeping your application after the procedure only with your consent (article 6(1)(a)).
• Operating and securing the website (server logs): legitimate interest (article 6(1)(f)).
• Website analytics: your consent (article 6(1)(a)), given in the cookie notice.
• Showing the Tree-Nation badge and counting page views for it: our legitimate interest in offsetting the carbon emissions of our website and showing that we do (article 6(1)(f)).

You are not legally required to give us personal data, but without contact details we cannot answer an enquiry or perform a contract. We do not sell personal data, do not pass it to others for their marketing and do not use it for automated decision-making or profiling.

6 How Long We Keep Personal Data

We keep personal data no longer than needed for the purpose for which it was collected:

• Bookkeeping records, including contracts and invoices: seven years (Dutch tax law, Algemene wet inzake rijksbelastingen, article 52); for Smart Veritas Ltd, as long as UK company and tax law require.
• Project records, reports and certificates: as long as the contract, the applicable standard or the law requires.
• Complaints and appeals: with our quality records, as long as the related project records.
• Enquiries and correspondence that do not lead to a contract: up to two years after the last contact.
• Job applications: deleted within four weeks after the procedure ends or, with your consent, kept for up to one year.
• Website server logs: for the limited period our hosting provider keeps them for security and operation.
• Website analytics data: up to 14 months in the analytics service.

After that we delete the data securely or make it anonymous.

8 Contact and Complaints

For questions about this policy or about how we handle your personal data, contact us at info@smartveritas.com or write to Smart Veritas B.V., Vasteland 38E, 3011 BM Rotterdam.

If you are not satisfied with our response, you can complain to the supervisory authority:

• Netherlands: Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, autoriteitpersoonsgegevens.nl.
• United Kingdom (Smart Veritas Ltd): Information Commissioner's Office, ico.org.uk.

You may also complain to the supervisory authority of the EU country where you live or work.

10 Changes to This Policy

We review this policy regularly and whenever our processing changes. The current version is published at smartveritas.com/privacy-policy.