PRIVACY POLICY GDPR

EdgeOpia Global Solutions VOF, effective date: 29 October 2026

1. Introduction
EdgeOpia Global Solutions VOF (hereinafter referred to as “EdgeOpia”, “we”, “us” or “our”) is a business-to-business (B2B) supplier of solutions, products and services.
We respect your privacy and are committed to protecting the personal data we process in connection with our business activities. This Privacy Policy explains what personal data we collect, why we use it, how we protect it, with whom we may share it and how you can exercise your rights under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Dutch data protection legislation.
This policy applies to personal data relating to customers, prospective customers, suppliers, business partners, professional contacts, website users and other individuals with whom we interact in a business capacity.
Personal data relating to employees and former employees may be subject to additional employment-related privacy information.
2. Who Is Responsible for Your Personal Data?
The data controller responsible for the processing described in this policy is as per our contact details on bottom of this webpage
For privacy-related questions, requests concerning your personal data or complaints about our handling of personal information, please see the contact details on bottom of this webpage
3. How We Obtain Personal Data
We may obtain personal data directly from you or from other sources in a professional or business context.
These sources may include:

Information you provide when contacting us, requesting a quotation, placing an order or entering into a business relationship.
Business communications with our customers, suppliers, distributors and other partners.
Industry exhibitions, conferences, trade fairs and other professional events.
Publicly available professional sources, including LinkedIn and business websites.
Referrals or introductions from customers, suppliers or business partners.
Information generated through our business relationship, such as correspondence, orders and service requests.

Where we obtain personal data from a source other than the individual concerned, we will provide the information required by the GDPR, subject to applicable exceptions.
4. Categories of Personal Data We Process
The categories of personal data we process depend on the nature of our relationship with you.
4.1 Customers and prospective customers
We may process:

First name and surname.
Professional title or form of address, where relevant.
Job title, department and employer.
Business email address.
Business telephone number.
Business address and work location.
Products, solutions or services of professional interest.
Quotations, orders, contracts and transaction details.
Business correspondence, support requests and service history.
Communication preferences and marketing opt-out records.

4.2 Suppliers and business partners
We may process:
Name and professional title.
Job title and employer.
Business email address and telephone number.
Business address and work location.

Contractual, purchasing and service-related information.
Business correspondence and relevant account or payment administration details.

4.3 Website users and professional contacts
Depending on the website features and services used, we may process:

Contact information submitted through forms or email.
Technical information, such as IP address, browser type and device information, where collected.
Website usage information and cookie-related data, where applicable.
Information about enquiries, communications and expressed business interests.

The actual information collected depends on the website's functionality, analytics tools and cookie settings.
4.4 Employees and former employees
Personal data relating to employees and former employees may include identification and contact details, employment records, payroll and tax information, contractual information, leave records and information required to administer employment benefits or comply with legal obligations.
Employee information is processed only where necessary for employment administration, contractual purposes or compliance with applicable law. Access is restricted to authorised persons.
5. Why We Process Personal Data and Our Legal Bases
We process personal data only where we have a valid legal basis under the GDPR.
Depending on the circumstances, these legal bases may include the following.
5.1 Contractual necessity
We process relevant personal data to prepare quotations, enter into contracts, fulfil orders, provide products and services, administer customer and supplier relationships, and provide after-sales support.
5.2 Legitimate interests
We may process business contact information where necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms.
These interests may include:

Managing professional relationships with customers, suppliers and business partners.
Identifying and contacting relevant business prospects.
Maintaining business records and correspondence.
Improving our products, services and business operations.
Protecting our systems, preventing fraud and ensuring information security.
Promoting relevant products and services to professional contacts where permitted by applicable law.

Where we rely on legitimate interests, we consider the purpose of the processing, its necessity and its potential impact on the individuals concerned.
5.3 Legal obligations
We process personal data where necessary to comply with applicable legal obligations, including accounting, taxation, employment and regulatory requirements.
5.4 Consent
Where consent is required by law, we will obtain it before processing the relevant personal data. You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
5.5 Vital interests and other legal bases
In exceptional circumstances, we may process personal data where necessary to protect the vital interests of an individual or where another legal basis expressly permitted by the GDPR applies.
We do not rely on a legal basis merely because it is listed in this policy. The appropriate basis depends on the specific processing activity and circumstances.
6. Business Communications and Marketing
As a B2B organisation, EdgeOpia may wish to keep professional contacts informed about relevant products, services, technical developments, exhibitions, trade fairs and company news.
We may send such communications where we have an appropriate legal basis and comply with applicable electronic marketing and privacy rules.
Depending on the circumstances, this may require consent or may be permitted under an applicable exception for existing customers. A person's professional role or the public availability of their business email address does not, by itself, establish permission to send every type of marketing communication.
You may opt out of direct marketing communications at any time by:

Using the unsubscribe mechanism provided in the communication, where available; or
Emailing EDGEOPIA@EDGEOPIA.COM with your request.

We will stop using your personal data for the relevant direct marketing purposes as required by law. We may retain a limited suppression record where necessary to respect your opt-out and prevent further unwanted marketing.
Opting out of marketing does not affect necessary contractual communications, service messages or other processing that has a separate lawful basis.
7. Sharing Personal Data with Third Parties
We do not sell personal data to third parties.
We may share personal data with third parties where necessary for the purposes described in this policy, including:

Accountants and professional advisers.
IT support providers, hosting providers and other technology service providers.
Email, communications and business software providers.
Suppliers and business partners where necessary to fulfil orders, provide services or manage a business relationship.
Payment, logistics or administrative service providers, where applicable.
Public authorities, regulators or law enforcement bodies where required by law.

Third parties receive access only to the personal data necessary for their relevant role, subject to applicable law and appropriate safeguards.
Where a service provider processes personal data on our behalf, we will put the required contractual arrangements in place, including a data processing agreement where required by the GDPR.
Where another organisation independently determines the purposes and means of processing, its own responsibilities and privacy information may also apply.
8. International Transfers of Personal Data
Where personal data is transferred outside the European Economic Area (EEA), we will ensure that the transfer complies with applicable data protection law.
Depending on the circumstances, this may involve a European Commission adequacy decision, appropriate safeguards such as Standard Contractual Clauses, and supplementary measures where necessary.
Further information about relevant international transfers and the safeguards applied may be requested using the contact details in Section 2.
9. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, taking account of our business needs, applicable legal obligations, limitation periods and the rights of individuals.
Retention periods depend on the type of information and the reason for processing.
In general:

Customer and supplier records: retained for the duration of the business relationship and for any additional period required for contractual, legal, accounting or dispute-related purposes.
Prospective customer and professional contact records: reviewed periodically and deleted or anonymised when no longer reasonably necessary, subject to applicable marketing rules and any required suppression records.
Marketing preferences and opt-out records: retained as necessary to manage communication preferences and demonstrate compliance.
Employment records: retained in accordance with applicable employment, tax, payroll and other legal requirements.
Website technical and analytics data: retained according to the purpose of collection, the relevant technology settings and applicable legal requirements.
CCTV recordings, if used: retained only for a documented, justified period proportionate to the security purpose, unless a longer period is necessary to investigate or document a specific incident or is otherwise permitted by law.

We do not retain all personal data indefinitely merely because a previous or future business relationship is possible.
We periodically review stored information and delete, anonymise or securely archive it when it is no longer required for its original purpose, subject to any continuing legal obligations.
10. Data Security
EdgeOpia takes appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, alteration or disclosure.
Depending on the processing activity and the level of risk, these measures may include:

Access restrictions and individual user accounts.
Password protection and appropriate authentication measures.
Encryption of devices and removable storage where appropriate.
Secure storage of physical records.
Regular data backups and recovery arrangements.
Security updates and protective measures for IT systems.
Appropriate confidentiality obligations and staff awareness.
Assessment of third-party service providers and their access to personal data.
Secure handling and transmission of confidential information.

Access to personal data is limited to persons who need it for authorised business purposes.
No method of electronic storage or transmission can be guaranteed to be completely secure. However, we seek to maintain a level of security appropriate to the risks associated with the personal data we process.
11. Personal Data Breaches
EdgeOpia maintains procedures for identifying, assessing, documenting and responding to personal data breaches.
Where required by the GDPR, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
Where a breach is likely to result in a high risk to the rights and freedoms of individuals, we will also inform the affected individuals without undue delay where required by law.
All personal data breaches will be assessed and documented as appropriate, including incidents that do not require notification to the supervisory authority.
12. CCTV
Where EdgeOpia uses CCTV at its premises, images of identifiable individuals will be processed in accordance with applicable data protection law.
CCTV will be used only for specified and legitimate purposes, such as premises security and the prevention or investigation of incidents, where its use is necessary and proportionate.
We will provide appropriate information to staff and visitors, including signage where required. Access to recordings will be restricted to authorised persons.
Recordings will be retained only for as long as necessary for the documented purpose, taking account of applicable law and the circumstances. Where an incident requires investigation, relevant footage may be retained for longer where legally justified.
Information about the specific purposes, retention period and contact arrangements for CCTV may also be provided in a separate CCTV notice.
13. Your Rights Under the GDPR
Subject to the conditions and limitations set out in applicable law, you may have the right to:

Access: request confirmation of whether we process your personal data and obtain a copy.
Rectification: request correction of inaccurate or incomplete personal data.
Erasure: request deletion of personal data where the legal requirements are met.
Restriction: request restriction of processing in certain circumstances.
Data portability: receive certain personal data in a structured, commonly used and machine-readable format and, where technically feasible and legally applicable, have it transmitted to another controller.
Object: object to processing based on our legitimate interests, on grounds relating to your particular situation.
Object to direct marketing: object at any time to the processing of your personal data for direct marketing, including related profiling.
Withdraw consent: withdraw consent where processing is based on consent, without affecting processing carried out before withdrawal.
Complain: lodge a complaint with the competent data protection supervisory authority.

To exercise your rights, contact EDGEOPIA@EDGEOPIA.COM.
We may need to verify your identity before responding to a request. We will handle requests within the time limits required by law, generally within one month of receipt. Where the GDPR permits an extension, we will inform you within the applicable period.
Some rights are subject to legal conditions and exceptions. We will explain where we cannot fully comply with a request.
14. Right to Object to Direct Marketing
You have the right to object at any time to the processing of your personal data for direct marketing purposes.
If you object, we will stop processing your personal data for those purposes as required by law. This right is unconditional in relation to direct marketing and does not depend on demonstrating particular personal circumstances.
To exercise this right, email EDGEOPIA@EDGEOPIA.COM or use the unsubscribe facility in the relevant communication.
15. Complaints and Supervisory Authority
If you have concerns about how EdgeOpia processes your personal data, we encourage you to contact us first so that we can review and address your concerns.
You also have the right to lodge a complaint with the competent supervisory authority.
In the Netherlands, the supervisory authority is:
Autoriteit Persoonsgegevens
Website: https://autoriteitpersoonsgegevens.nl/
You may contact the supervisory authority in accordance with its published procedures.
16. Automated Decision-Making and Profiling
EdgeOpia does not intend to make decisions about individuals based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect them.
If this practice changes, we will provide the information required by applicable data protection law and implement any necessary safeguards.
17. Cookies and Website Technologies
Our website may use cookies or similar technologies to support essential functionality, remember preferences, analyse website usage or provide other features.
The use of cookies and similar technologies is subject to applicable data protection and electronic communications rules. Where prior consent is required, the relevant technologies will not be activated before valid consent is obtained, subject to applicable exceptions.
Further details about the cookies and technologies actually used, their purposes, providers and retention periods should be provided in a separate Cookie Policy or equivalent cookie information.
You may be able to manage your preferences through the website's cookie settings and your browser settings.
18. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our business activities, data processing practices or legal requirements.
The latest version will be published on our website with its effective date. Where required by law, we will provide additional information or notification about material changes.
19. Contact Us
If you have questions about this Privacy Policy, our processing of personal data or your rights under the GDPR, please check our contact details below