At Haagsch Recherchebureau, we are committed to protecting your privacy. In this privacy statement, we explain what personal data we collect, how we use, store and protect it.
1. Data controller
Haagsch Recherchebureau, located at Alexanderveld 5, 2585 DB The Hague, is responsible for processing personal data as set out in this privacy statement.
We respect your privacy and handle your personal data carefully and confidentially. We comply with applicable privacy legislation, including the General Data Protection Regulation. Do you have any questions about this? Please feel free to contact our Data Protection Officer (DPO).
Contact details:
Haagsch Recherchebureau
Alexanderveld 5
2585 DB The Hague
070 20 42 7 42
dpo@haagschrecherchebureau.nl
2. Personal Data
Haagsch Recherchebureau processes your personal data because you use our services and/or because you provide them to us yourself.
Below is an overview of the personal data that we process:
- First and last name
- Gender
- Date of birth
- Birthplace
- Address details
- Phone number
- Email address
- IP address
- Cookies
- Residential address
- Location information
- Information about your activities on our website
- Internet browser, software version and device type
- Surveillance footage with date, time and location recording when you visit our office or one of our meeting locations
- Other personal data that you actively provide, in correspondence and by phone
3. Purposes of processing
The personal data is processed by us for the following purposes:
- Being able to screen you to prevent abuse and fraud
- To be able to call, text, WhatsApp and email you to carry out our services
- Being able to send you a quote and invoice
- Handling your payment
- Delivering your ordered goods and services to you
- Sending you the newsletter
- Informing you about changes to our services and products
- Analyzing your behavior on the website in order to improve the website
- Process your data if we are legally obliged to do so
4. Legal basis for processing
We only process personal data when there is a legal basis, such as:
- The person has given their explicit consent to the processing (Article 6 (1) (a) GDPR).
- Data processing is necessary to protect the legitimate interest of the controller or a third party to whom the data is provided, unless the interests or fundamental rights and freedoms of the person being investigated, in particular the right to privacy, prevail (Article 6 (1) (f) GDPR).
- Data processing is necessary to comply with a legal obligation to which the controller is subject (Article 6 (1) (c) GDPR).
- Data processing is necessary to protect the vital interests of the person being investigated or another natural person (Article 6 (1) (d) GDPR).
5. Retention periods
We do not keep personal data longer than necessary. The retention periods are as follows:
- Investigation data, at least 1 year and a maximum of 5 years after completion of the study, unless otherwise required by law.
- Financial administration, 7 years, in accordance with the legal fiscal retention obligation.
- Criminal records, destroyed immediately after completion of the investigation, unless otherwise required by legal proceedings.
- Correspondence and other communications, 1 year after completion of the investigation, unless this information is part of a procedure.
6. Sharing personal data
We only share personal data when it is necessary:
- With the client, insofar as relevant to the investigation.
- With legal authorities, in case of court orders or legal obligations.
- With involved third parties, external experts or specialists for specific tasks, within confidentiality.
- With lawyers, for legal proceedings or disputes.
In each of these cases, the personal data will only be shared to the extent necessary and with due regard to the confidentiality and security of the data. Sharing always takes place within the framework of the AVG and other relevant laws and regulations. We do not provide personal data to other third parties without explicit consent from the person concerned, unless this is required by law.
7. Personal data security
We take extensive technical and organizational measures to protect your personal data from loss, unauthorized access, unlawful processing, or disclosure. Some of the key security measures we apply include:
- Two-Factor Authentication (2FA): To access our systems, we use two-factor authentication. This means that, in addition to a password, an extra verification step is required, such as a code on your mobile device, to gain access.
- Single Sign-On (SSO): We utilize a Single Sign-On system, allowing employees to securely and efficiently log in with one set of credentials for multiple applications, while ensuring that access is strictly controlled and managed.
- Encryption (SSL): Sensitive information exchanged via our website is protected through Secure Sockets Layer (SSL) encryption. This ensures that data is securely transmitted between you and our servers.
- Data breach protocol: We have a strict data breach protocol in place that provides procedures for reporting, investigating, and addressing data breaches. If necessary, we will notify you and the relevant Data Protection Authority in a timely manner, in compliance with legal requirements.
- Password protocol: We enforce a stringent password protocol, requiring passwords to meet high-security standards such as minimum length, complexity, and regular updates. Employees only have access to the systems and data necessary for their specific tasks.
- Access to data limited to authorized employees: Access to personal data is strictly limited to employees authorized to process it. This is managed through authorization controls and the principle of least privilege, ensuring that employees only access the data they need for their specific duties.
- Regular data protection audits: We conduct regular audits and checks to ensure that our data protection measures comply with the latest security standards and to identify and address any vulnerabilities in our systems. This helps us continuously safeguard the confidentiality, integrity, and availability of your personal data.
Through these measures, we ensure the security of your personal data and prevent it from falling into the wrong hands or being unlawfully processed.
8. Rights
You have the following rights with respect to your personal data:
- Right to view, you can request a copy of the personal data that we hold about you.
- Right to rectification, you can have incorrect or incomplete information corrected.
- Right to deletion, in certain cases, you can ask us to delete your personal data.
- Right to restrict processing, you can ask us to restrict the processing of your data in specific situations.
- Right to object, you can object to the processing of your data based on legitimate interests.
- Right to data portability, you can request that your data be received in a structured, commonly used and machine-readable format.
You can exercise your privacy rights via our GDPR-request form. To ensure that the request for access is made by you, we ask you to perform an ID-check.
If you are not satisfied with how your personal data is or has been processed by Haagsch Recherchebureau, you can make use of our legal obligations complaints procedure.
If your complaint has not been dealt with satisfactorily, you can contact the national supervisor, Autoriteit Persoonsgegevens.
