Chatbot privacy statement

Enreach Holding B.V. (‘Enreach’, ‘we’, ‘us’, or ‘our’) is strongly committed to privacy and data protection. This privacy statement (‘Privacy Statement’) explains how we process your Personal Data in accordance with the applicable data protection legislation (‘Data Protection Legislation’) in order to enable you to use our Enreach Virtual Agent (‘Chatbot’). 

Enreach is the data controller (‘Data Controller’) of the processing of all Personal Data that fall within the scope of this Privacy Statement. This Privacy Statement indicates what Personal Data are collected and used (processed) by Enreach for what purpose, and to which persons or entities the data will or may be provided. 

Without the processing of your Personal Data, you will not be able to access the Chatbot. By using the Chatbot and submitting any Personal Data, you agree to the use of such data in accordance with this Privacy Statement.

We did our best to provide you with all the necessary information in a clear and readable format in this Privacy Statement. However, if you have any questions about our use of your Personal Data after reading this Privacy Statement, you can of course always contact us through the contact details provided below.

The capitalised words in this Privacy Statement have the meanings ascribed to them in this Privacy Statement and in the Definitions provided below.

You can contact us here:  

Enreach Holding B.V. 

Address: Verlengde Duinvalleiweg 102, 1361 BR Almere 

Email: info@enreach.com 

Phone: +31 088 889 0889 

We have a dedicated Data Protection Team and a Data Protection Officer (‘DPO’). If you have any questions relating to the processing of your Personal Data or want to contact our DPO, feel free to use the contact details provided below:

Enreach Data Protection Team 

Email: dataprotectionteam@enreach.com 

Phone: +31 088 889 0889

Below are some key terms relevant to this Privacy Statement:

• Personal Data: Any information directly or indirectly relating to an identified or identifiable natural person, such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

• Data Subject (You): Natural person(s) whose Personal Data is processed, specifically in this case, the Chatbot user.

• Data Controller (We): Natural or legal entity that determines the purpose and means for the processing of Personal Data. In the context of this Privacy Statement, this is Enreach.

• Data Processor: Natural or legal entity processing data on behalf of the Data Controller.

• Sensitive Personal Data: Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a Data Subject’s sex life or sexual orientation.

• Data Protection Legislation: Data Protection Legislation refers to the applicable laws that govern the protection of Personal Data and privacy. This includes the legislation applicable to the processing of Personal Data in the EU, such as the General Data Protection Regulation (‘GDPR’) and the ePrivacy Directive (‘ePD’), as well any national laws implemented in connection with the aforementioned legislation.

We collect only Personal Data that is specifically and voluntarily provided by you to our Chatbot. Enreach can receive Personal Data such as name, title, address, e-mail address, cookies, IP-addresses, location, and telephone number. Enreach also receives the content submitted by Chatbot users voluntarily.

The Personal Data that we collect through our Chatbot will only be used for the specific purposes for which it was provided. We process your Personal Data for the following purposes: 

• providing our services; 
• providing information about Enreach and our services and products; and
• improving our website, Chatbot, and customer experience.

Our intention is not to collect sensitive Personal Data through the Chatbot. We therefore ask that you do not provide any type of Sensitive Personal Data. If you do wish to provide such Personal Data for any reason, Enreach accepts your explicit consent to use that Personal Data in the ways described in this Privacy Statement or as described at the point where you choose to provide us with such data.

Personal Data obtained via the Chatbot is used only for the purpose stated at the time that the data is collected. Enreach makes every effort to avoid any excessive or irrelevant collection of Personal Data. If you believe the Chatbot has collected excessive Personal Data, we encourage you to contact us via our Contact Information above.

In addition to a purpose, every processing activity must also have a legal ground. We process your Personal Data relying on one of the following legal grounds: 

In addition to a purpose, every processing activity must also have a legal ground. We process your Personal Data relying on one of the following legal grounds: 

Legitimate interest 

We process your Personal Data based on our legitimate interests, such as: 

• maintaining a lasting relationship; 
• offering you products and services; 
• improving the effectiveness of our services and Chatbot through analytics;
• preventing fraud and abuse; and 
• answering your questions.

Consent 

In some cases, we process your Personal Data on the basis of your consent, for example when you willingly and voluntarily submit Sensitive Personal Data to us, or when you consent to the use of certain cookies. For more information about our use of cookies please see our Cookie Banner.

In order to access and communicate with the Chatbot, and other services that the Chatbot offers, we may share your Personal Data with Data Processors affiliated with or contracted by Enreach. These Data Processors are contractually obliged to implement appropriate technical and organisational measures to ensure that your Personal Data is processed in accordance with our instructions.

Your Personal Data may be transferred to third-party service providers who process Personal Data on Enreach's behalf, including providers of information technology, identity management, website hosting and management, data analysis, data back-up, security, and storage services. Your Personal Data is not shared with any legal entity within the Enreach group of undertakings, or shared with any third party, for any secondary or unrelated purpose unless otherwise disclosed at the point of collection.

Where necessary for the processing purposes described above or where required by law, your Personal Data may be transferred to regulators, courts and other authorities, independent external advisors, and internal or external compliance and investigation teams.

We try to process Personal Data as much as possible within the EU/EEA. However, sometimes it is necessary for us to provide your data to organisations located outside the EU/EEA in order to provide our services. Whenever we transfer your personal information outside of the EU to countries not deemed by the European Commission to provide an adequate level of personal information protection, the transfer will be based on safeguards that allow us to conduct the transfer in accordance with the GDPR, such as the standard contractual clauses approved by the European Commission.

We will retain your Personal Data in order to provide you with a high-quality service, in accordance with the Data Protection Legislation and for as long as it is necessary to fulfil the purposes for which we collected the data, including for the purposes of satisfying any legal, accounting, or reporting requirements. 

We retain your Personal Data for 12 (twelve) months. To determine the appropriate retention period we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means. After the expiration of the retention period, we will delete all Personal Data.

Enreach attaches great importance to your privacy. We therefore take security measures to prevent theft, loss, or otherwise unlawful use of your Personal Data. We have implemented generally accepted standards of technology and operational security in order to protect your Personal Data. Only authorised Enreach personnel are provided access to Personal Data and these employees are contractually or statutory obliged to ensure confidentiality of the data.

Enreach will also implement appropriate technical and organisational measures to ensure that the processing of your Personal Data is performed in accordance with the Data Protection Legislation, in particular ensuring an appropriate level of security.

Under the Data Protection Legislation, you have a number of rights regarding our processing of your Personal Data, as below:

You have the right to be informed about the collection and use of your Personal Data. We ensure we uphold this right with our internal data protection policies and through this and other privacy statements. These are regularly reviewed and updated to ensure these are accurate and reflect our data processing activities.

You have the right to access the information we process about you.

You have the right to have incorrect or outdated information about yourself corrected.   

In exceptional cases you have the right to have information about you deleted before the expiry of our retention period. 

In some cases, you have the right to have the processing of your Personal Data restricted. If you exercise this right, we may only process your Personal Data with your consent, or for the purpose of establishing, asserting, defending, protecting, a significant public or private interest, except when we process your data for storage. 

In certain cases, you have the right to object to our otherwise lawful processing of your Personal Data.

In certain cases, you have the right to receive your Personal Data in a structured, commonly used, and machine-readable format and to have that Personal Data transferred from one Data Controller to another without hindrance.

You have the right to withdraw your consent at any time in the circumstances where you have given us consent to process your Personal Data. 

An automated decision is one that is made by our systems rather than a person. You have the right to express your concerns and object to a decision taken by purely automated means under some laws such as the GDPR. You also have a right to request that a person review that decision.

This right is unlikely to apply to Enreach’s use of your data, as any automated processing we carry out is unlikely to make decisions and would include human intervention. If you would like to discuss this in further detail, please contact us as set out above.

You can invoke any of the above rights by reaching out to us on the Contact Information provided above. When you submit a request, we will ask you some additional questions to verify your identity. We will respond to your request as soon as possible, but at the latest within one month.

In case you have any questions with respect to the processing of your Personal Data as described within this Privacy Statement, you can contact the Enreach Data Protection Team and/or our DPO via the Contact Information above. 

Please note that you also have the right to lodge a complaint with the competent supervisory authority for the Enreach entity that is acting as the Data Controller regarding how we process your Personal Data. However, we hope that you would consider raising any issue or complaint you have with us first (using the contact details above). Your satisfaction is extremely important to us, and we will always do our very best to solve any problems you may have. If you have any questions regarding which supervisory authority is applicable to your recruitment process at Enreach, please contact us via the Contact Information above. 

Enreach reserves the right to modify or amend this Privacy Statement at any time. The effective date will be displayed below. It is the user's responsibility to check this document regularly for changes.

Thank you for taking the time to read our Privacy Statement.

Version 2.0; October 2023