Privacy Policy
Controller
The controller responsible for data processing is:
Heatsupply B.V.Waardjesweg 69
5725 TB Heusden
The Netherlands
Email: mail@heatsupply.nl
We are pleased that you are interested in our website. Protecting your
privacy is very important to us. Below, we provide detailed information
about how we process your personal data.
1. Access data and hosting
You can visit our websites without providing any personal information about
yourself. Whenever you access a website, the web server automatically stores
a so-called server log file. This file contains, for example, the name of
the requested file, your IP address, the date and time of access, the amount
of data transferred and the requesting provider. This access data documents
the visit to the website.
This access data is evaluated exclusively to ensure the proper operation of
the website and to improve our services. This serves to protect our
legitimate interests, which prevail following a balancing of interests, in
the correct presentation of our services pursuant to Article 6(1)(f) of the
General Data Protection Regulation (GDPR).
All access data is deleted no later than thirty days after the end of your
visit to our website. Access data is not processed for longer than is
necessary to achieve the processing purposes stated above.
Hosting
The services for hosting and displaying the website are partly provided by
service providers who process personal data on our behalf.
Unless otherwise explained in this Privacy Policy, all access data and all
data collected through forms provided on this website are processed on the
servers of these service providers.
If you have any questions about our service providers or the legal basis for
our cooperation with them, please contact us using the contact details
provided in this Privacy Policy.
2. Data processing for contract performance and contacting us
2.1 Data processing for contract performance
For the purpose of performing the contract — including handling questions
relating to and claims arising from statutory warranty rights, defective
performance, the right of withdrawal and any statutory updating obligations
— we collect personal data when you voluntarily provide it to us in
connection with your order.
Mandatory fields are marked as such because we require this information to
process the contract. Without providing this information, we may not be able
to process or ship your order. The data collected is indicated in the
relevant input forms.
Further information about the processing of your data, including the
disclosure of data to our service providers for order, payment and shipping
processing, can be found in the following sections of this Privacy Policy.
After the contract has been fully performed, further processing of your data
will be restricted. Following expiry of the statutory retention periods under
tax and commercial law, your data will be deleted pursuant to Article
6(1)(c) GDPR, unless you have expressly consented to further use of your
data pursuant to Article 6(1)(a) GDPR or we have reserved the right to use
your data beyond this scope where legally permitted and where we inform you
of this in this Privacy Policy.
Inventory and order management system
For order and contract processing, we use inventory and order management
systems provided by external service providers. Our service providers
process personal data on our behalf as processors.
If you have any questions about our service providers or the legal basis for
our cooperation with them, please contact us using the contact details
provided in this Privacy Policy.
2.2 Customer account
If you have given your consent pursuant to Article 6(1)(a) GDPR by choosing
to create a customer account, we use your data to create your customer
account and store your data for future orders on our website.
You may delete your customer account at any time. You can do this by sending
a message to the contact details provided in this Privacy Policy or by using
the relevant function in your customer account.
After your customer account has been deleted, your data will be deleted
unless you have expressly consented to further use of your data pursuant to
Article 6(1)(a) GDPR or we have reserved the right to use your data beyond
this scope where legally permitted and where we inform you of this in this
Privacy Policy.
Contacting us
As part of customer communication, we collect personal data when you
voluntarily provide it to us when contacting us, for example via a contact
form, live chat or email.
The processing is carried out to handle your request and is based on
Article 6(1)(b) GDPR insofar as the processing is necessary for the
performance of a contract or for taking steps at your request prior to
entering into a contract.
Mandatory fields are marked as such because we require this information to
process your request. The data collected is indicated in the relevant input
forms.
Once your request has been fully handled, your data will be deleted unless
you have expressly consented to further use of your data pursuant to Article
6(1)(a) GDPR or we have reserved the right to use your data beyond this
scope where legally permitted and where we inform you of this in this
Privacy Policy.
3. Data processing for shipping
For the performance of the contract pursuant to Article 6(1)(b) GDPR, we
disclose your data to the carrier responsible for delivery insofar as this
is necessary to deliver the products you have ordered.
If you have any questions about our service providers or the legal basis for
our cooperation with them, please contact us using the contact details
provided in this Privacy Policy.
Disclosure of data to carriers for delivery notifications
If you have expressly consented to this during or after placing your order,
we will disclose your email address and telephone number to the carrier
selected by you on the basis of Article 6(1)(a) GDPR.
The carrier may use this information to contact you before delivery to
announce the delivery or coordinate the delivery time with you.
You may withdraw your consent at any time by sending a message to the
contact details provided in this Privacy Policy.
After withdrawing your consent, we will delete the data provided for this
purpose unless you have expressly consented to further use of your data or we
have reserved the right to use your data for another legally permitted
purpose about which we inform you in this Privacy Policy.
4. Data processing for payment processing
When processing payments in our online shop, we cooperate with the following
types of partners:
- technical service providers;
- banks;
- payment service providers.
4.1 Data processing for transaction processing
Depending on the payment method selected, we disclose the data required to
process the payment transaction to our technical service providers, the
relevant banks or the selected payment service provider.
This is done insofar as necessary to process the payment and perform the
contract pursuant to Article 6(1)(b) GDPR.
Some payment service providers collect the data required for payment
processing themselves, for example on their own website or through a
technical integration during the ordering process. In this case, the
privacy policy of the respective payment service provider applies.
Depending on the payment method selected, personal data may be transferred
to countries outside the European Union or the European Economic Area (EEA).
For some of these countries, the European Commission has determined that an
adequate level of data protection exists.
Where personal data is transferred to countries outside the EU or EEA for
which the European Commission has not adopted an adequacy decision, we base
the transfer on the European Commission’s Standard Contractual Clauses,
where applicable.
If you have any questions about our payment partners or the legal basis for
our cooperation with them, please contact us using the contact details
provided in this Privacy Policy.
4.2 Data processing for fraud prevention and optimisation of payment
processes
We may provide the service providers referred to above with additional data.
They may use this data together with the data required for payment
processing for fraud prevention and to optimise our payment processes.
Examples include:
- invoicing;
- handling disputed payments;
- supporting our accounting processes.
The processing is based on Article 6(1)(f) GDPR. Our legitimate interest
consists of protection against fraud and efficient payment management.
4.3 Identity and creditworthiness checks when using Klarna
Klarna Pay Later
If you choose payment services provided by Klarna Bank AB (publ),
Sveavägen 46, 111 34 Stockholm, Sweden — hereinafter referred to as
“Klarna” — we may ask for your consent pursuant to Article 6(1)(a) GDPR to
disclose the data necessary for payment processing, identity verification
and creditworthiness checks to Klarna.
In Germany, Klarna may use credit reference agencies referred to in Klarna’s
Privacy Policy for identity and creditworthiness checks.
Klarna uses the information received about the statistical probability of
payment default to make a balanced decision regarding the establishment,
performance or termination of the contractual relationship.
You may withdraw your consent at any time by sending a message to the contact
details provided in this Privacy Policy. This may mean that we can no longer
offer you certain payment options.
You may also withdraw your consent to this use of your personal data directly
with Klarna.
5. Advertising by email
5.1 Email newsletter with registration and tracking
If you subscribe to our newsletter, we use the data required for this
purpose or other data that you have separately provided to us to send you
our email newsletter regularly.
The newsletter is sent on the basis of your consent pursuant to Article
6(1)(a) GDPR.
You may unsubscribe from the newsletter at any time. You can do this by
sending a message to the contact details specified below or by using the
unsubscribe link provided in the newsletter.
After unsubscribing, we will delete your email address from the recipient
list unless you have expressly consented to further use of your data or we
have reserved the right to use your data for another legally permitted
purpose about which we inform you in this Privacy Policy.
Newsletter tracking
Please note that we may analyse your use of our newsletter. This may include
analysing your interaction with the newsletter by measuring, storing and
evaluating open rates and click rates.
We do this to improve the design of future newsletter campaigns.
For this analysis, the emails sent may contain one-pixel technologies, such
as web beacons or tracking pixels. These technologies may be stored on our
website.
For the analysis, we may process the following newsletter data:
- the page from which the page was requested, also known as the referrer URL;
- the date and time of access;
- the type and description of the web browser used;
- the IP address of the computer from which the website is accessed;
- the email address;
- the date and time of registration and confirmation;
- information from tracking technologies.
This data may be linked to your email address, IP address and, where
applicable, an individual identifier. Links contained in the newsletter may
also contain this identifier.
If you do not want newsletter tracking, you may unsubscribe from the
newsletter at any time as described above.
The data will be stored for as long as you are subscribed to the newsletter.
5.2 Newsletter delivery
The newsletter and the tracking described above may also be sent by service
providers who process personal data on our behalf.
If you have any questions about our service providers or the legal basis for
our cooperation with them, please contact us using the contact details
provided in this Privacy Policy.
Our service providers are based in and/or use servers in countries for which
the European Commission has determined that an adequate level of data
protection exists, including the United States.
The adequacy decision for the United States serves as the basis for
transfers to a third country insofar as the relevant service provider is
certified under the applicable framework.
Until certification has taken place, the transfer may be based on the
European Commission’s Standard Contractual Clauses.
6. Cookies and other technologies
6.1 General information
To make visiting our website more attractive and to enable the use of
certain functions, we use technologies on various pages, including cookies.
Cookies are small text files that are automatically stored on your device.
Some of the cookies we use are deleted when your browser session ends, for
example when you close your browser. These are known as session cookies.
Other cookies remain on your device and enable us to recognise your browser
when you visit our website again. These are known as persistent cookies.
You can find the storage period for cookies in the cookie settings overview
of your web browser.
Privacy protection when using your device
When you use our online services, we use strictly necessary technologies to
provide the digital service expressly requested by you.
In this case, storing information on your device or accessing information
already stored on your device does not require consent insofar as this is
strictly necessary to provide the service.
For functions that are not strictly necessary, your consent is required to
store information on your device or access information already stored on
your device.
If you do not provide consent, parts of the website may not be fully
available.
Any consent you provide remains valid until you change or reset the relevant
settings on your device.
Subsequent processing of data through cookies and other technologies
We use technologies that are strictly necessary for the use of certain
functions of our website.
These technologies may collect and process the following data:
- IP address;
- time of access;
- device information;
- browser information;
- information about your use of our website.
This processing is based on our legitimate interest in displaying our
website as effectively as possible pursuant to Article 6(1)(f) GDPR,
insofar as the technology concerned is not subject to a consent requirement.
We also use technologies:
-
to comply with legal obligations, for example to demonstrate that consent
was given for the processing of personal data; - for web analytics;
- for online marketing.
Further information, including the legal basis for processing, can be found
in the following sections of this Privacy Policy.
What types of cookies are used?
An overview of the cookies and other technologies used can be found in our
cookie settings.
Cookie settings
You can find your browser’s cookie settings through the following links:
- Microsoft Edge;
- Safari;
- Google Chrome;
- Mozilla Firefox;
- Opera.
Where you have consented to the use of technologies pursuant to Article
6(1)(a) GDPR, you may withdraw your consent at any time by sending a message
to the contact details provided in this Privacy Policy.
You can also change your settings using the privacy or cookie button on our
website.
If you do not accept cookies, the functionality of our website may be
limited.
6.2 Cookiebot Consent Management Platform
We use Cookiebot on our website to inform you about the cookies and other
technologies we use. Cookiebot is also used to collect, manage and document
any consent required for the processing of personal data through these
technologies.
This is necessary pursuant to Article 6(1)(c) GDPR in order to comply with
our legal obligation under Article 7(1) GDPR to demonstrate your consent to
the processing of personal data.
Cookiebot is a service provided by Usercentrics A/S, Havnegade 39, 1058
Copenhagen, Denmark. Usercentrics processes your data on our behalf.
After you save your cookie preferences on our website, Cookiebot’s web
server stores, among other things:
- your anonymised IP address;
- the date and time of your declaration;
- browser information;
- the URL from which the declaration was sent;
- information about your consent preferences;
- an anonymous random key.
A cookie is also used to store information about your consent preferences
and the key.
Your data will be deleted after twelve months unless you have expressly
consented to further use of your data or we have reserved the right to use
your data for another legally permitted purpose about which we inform you in
this Privacy Policy.
Our service providers are based in and/or use servers in countries for which
the European Commission has determined that an adequate level of data
protection exists, including the United States.
The adequacy decision for the United States serves as the basis for the
transfer to a third country insofar as the relevant service provider is
certified.
Until certification, the transfer may be based on the European Commission’s
Standard Contractual Clauses.
6.3 Information about transfers to third countries
We use technologies on our website provided by service providers that may be
based in third countries outside the European Union or the European Economic
Area.
Where no adequacy decision has been adopted by the European Commission for a
country, an adequate level of protection must be ensured through other
appropriate safeguards.
Appropriate safeguards may include Standard Contractual Clauses adopted by
the European Commission or binding corporate rules. A prior assessment must
be carried out to determine whether these safeguards ensure an adequate
level of protection.
According to the case law of the Court of Justice of the European Union,
additional safeguards may be required.
With the technology providers we use that process personal data in a third
country, we have generally agreed on the Standard Contractual Clauses
adopted by the European Commission.
Where possible, we also agree on additional safeguards intended to ensure an
adequate level of data protection in third countries without an adequacy
decision.
Despite contractual and technical measures, the level of protection in a
third country may not be equivalent to the level of protection within the
European Union.
In such cases, where necessary, we may ask for your consent under Article
49(1)(a) GDPR as part of our cookie consent process to transfer your
personal data to a third country.
There is a particular risk that local authorities in the third country may
obtain access to your personal data that is not sufficiently restricted from
a European data protection perspective. It is also possible that we, as the
data exporter, or you, as the data subject, may not be informed of this, or
that sufficient legal remedies may not be available to prevent or challenge
such access.
Examples of third countries for which no adequacy decision by the European
Commission currently exists include:
- China;
- Russia;
- Taiwan.
The countries to which personal data is transferred can be found in the
privacy information of the relevant tool or consent management service used.
7. Use of cookies and other technologies
We use the cookies and other technologies from third parties described below
on our website.
Unless otherwise stated for a specific technology, this is based on your
consent pursuant to Article 6(1)(a) GDPR.
When the purpose of the processing has ended or we no longer use the relevant
technology, the data collected in this context will be deleted.
You may withdraw your consent at any time with effect for the future.
Further information about withdrawing your consent can be found in the
section “Cookies and other technologies”.
Further information, including the basis for our cooperation with the
individual providers, can be found in the sections relating to the
respective technologies.
7.1 Use of Google services
We use the technologies described below provided by Google Ireland Limited,
Gordon House, Barrow Street, Dublin 4, Ireland — hereinafter referred to as
“Google”.
The information automatically collected by Google technologies about your
use of our website is generally transferred to and stored on a server
operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043,
United States.
Unless otherwise stated for a particular technology, the processing of data
takes place on the basis of an agreement between joint controllers pursuant
to Article 26 GDPR or a data processing agreement with Google, depending on
the service concerned.
Further information about Google’s processing of data can be found in
Google’s privacy information.
Our service providers are based in and/or use servers in countries outside
the EU and EEA for which the European Commission has determined that an
adequate level of protection exists.
Our service providers may also be based in and/or use servers in countries
outside the EU and EEA for which no adequacy decision has been adopted by
the European Commission. Our cooperation with these service providers is
based on the European Commission’s Standard Contractual Clauses.
Google Analytics
For analytical purposes, Google Analytics automatically collects and stores
data, including:
- IP address;
- time of access;
- device information;
- browser information;
- information about your use of our website.
Based on this data, usage profiles may be created using pseudonyms. Cookies
may be used for this purpose.
If you access our website from within the EU, your IP address is processed on
a server located in the EU to derive location data. The IP address is then
deleted immediately before the data is forwarded to other Google servers for
further processing.
The processing of data takes place on the basis of a data processing
agreement with Google.
Google reCAPTCHA
To protect our web forms against misuse and spam from automated software,
such as bots, Google reCAPTCHA collects, among other things:
- IP address;
- time of access;
- browser information;
- information about your use of our website.
Google analyses your use of our website using JavaScript and cookies. Other
cookies stored in your browser by Google services may also be analysed.
The processing of data takes place on the basis of a data processing
agreement with Google.
According to Google, users who access websites protected by reCAPTCHA are
not directly subject to Google’s Privacy Policy and Terms of Use. This
section should be checked against Google’s current documentation, as the
legal wording and conditions may change.
Google Tag Manager
Google Tag Manager enables us to manage various codes and services on our
website.
When implementing individual tags, Google may also process personal data
under certain circumstances, such as:
- IP addresses;
- online identifiers;
- cookies.
The processing of data takes place on the basis of a data processing
agreement with Google.
The use of Google Tag Manager allows various services and technologies to be
integrated.
If you do not wish to use individual tracking services and have therefore
disabled them, the deactivation remains in place for all affected tracking
tags integrated through Google Tag Manager.
YouTube video plugin
To embed third-party content, the YouTube video plugin may collect and
transmit data to Google in the extended privacy mode used by us.
This may include:
- IP address;
- time of access;
- device information;
- browser information.
This data is collected and processed only when you play a video.
7.2 Use of Meta services
Meta Pixel
We use the Meta Pixel as part of technologies provided by Meta Platforms
Ireland Ltd., Block J, Serpentine Avenue, Dublin 4, Ireland — hereinafter
referred to as “Meta”.
The Meta Pixel automatically collects and stores data, including:
- IP address;
- time of access;
- device information;
- browser information;
-
information about your use of our website based on events defined by us,
such as visiting a webpage or subscribing to a newsletter.
Based on this data, usage profiles may be created using pseudonyms.
As part of so-called advanced matching, hashed data may also be collected and
stored for matching purposes. This data may be used to identify individuals
and may include:
- names;
- email addresses;
- telephone numbers.
When you visit our website, the Meta Pixel may automatically place a cookie.
This cookie enables your browser to be recognised through a pseudonymous
cookie ID when you visit other websites.
Meta Platforms Ireland may combine this information with other data from your
Meta or Facebook account. Meta may use this information to create reports
about website activity and provide other services related to website use,
including personalised and group-based advertising.
The information automatically collected by Meta technologies about your use
of our website is generally transferred to and stored on a server operated
by Meta Platforms, Inc., 1601 Willow Road, Menlo Park, California 94025,
United States.
Further information about data processing by Meta can be found in Meta’s
privacy information.
Our service providers are based in and/or use servers in countries for which
the European Commission has determined that an adequate level of data
protection exists, including:
- Brazil;
- the United States;
- Canada;
- Japan;
- South Korea;
- New Zealand;
- the United Kingdom;
- Argentina.
For the United States, the adequacy decision serves as the basis for
transfers to a third country insofar as the relevant service provider is
certified. According to the original text, such certification is in place.
Our service providers are also based in and/or use servers in:
- Australia;
- Hong Kong;
- India;
- Indonesia;
- Malaysia;
- Singapore;
- Thailand;
- Taiwan;
- Mexico.
No adequacy decision by the European Commission exists for these countries.
Our cooperation with these service providers is based on the European
Commission’s Standard Contractual Clauses.
Meta Ads Manager
Through Meta Ads Manager, we advertise this website on Facebook and other
Meta platforms.
We determine the parameters of the relevant advertising campaign. Meta
Platforms Ireland is responsible for the specific implementation, including
the decision as to which users see advertisements.
Unless otherwise stated for the individual technologies, data processing is
carried out on the basis of an arrangement between joint controllers
pursuant to Article 26 GDPR.
The joint controllership is limited to the collection of data and its
transfer to Meta Platforms Ireland. The subsequent processing by Meta
Platforms Ireland is not covered by this joint controllership.
Based on visitor activity statistics created through the Meta Pixel, we may
use group-based advertising through Custom Audiences. We determine the
characteristics of the relevant target group.
In the context of advanced matching for determining the target group, Meta
Platforms Ireland acts as our processor.
Based on the pseudonymous cookie ID placed by the Meta Pixel and the data
collected about your use of our website, we may use Custom Audiences to
display personalised advertising.
Through conversions — measured, for example, via the Meta Pixel or
Conversions API — we may measure your subsequent behaviour when you have
reached our website via an advertisement from Meta Ads Manager.
The processing of data takes place on the basis of a data processing
agreement with Meta Platforms Ireland.
7.3 Other providers of web analytics and online marketing services
Use of AWIN for online marketing
Through our advertising partner AWIN AG, Otto-Ostrowski-Straße 1A, 10249
Berlin, Germany — hereinafter referred to as “AWIN” — we provide advertising
space for third-party advertisements.
These advertisements may be displayed in various places on our website.
Using cookies, AWIN can track the course of an order. In particular, AWIN
may determine that you clicked on an advertisement and subsequently ordered
a product.
For this purpose, the following data may be collected, transmitted to AWIN
and processed by AWIN:
- IP address;
- time of access;
- device information;
- browser information;
- information about your use of our website.
We have no influence over this data processing.
The processing of data takes place on the basis of an arrangement between
joint controllers pursuant to Article 26 GDPR.
Our service providers are based in and/or use servers in countries outside
the EU and EEA for which the European Commission has determined that an
adequate level of data protection exists.
Our service providers may also be based in and/or use servers in countries
outside the EU and EEA for which no adequacy decision has been adopted by
the European Commission. Our cooperation with these service providers is
based on the European Commission’s Standard Contractual Clauses.
8. Integration of the Trusted Shops Trustbadge and other widgets
Trusted Shops widgets are integrated into this website to display Trusted
Shops services, such as a trustmark and collected reviews. These widgets may
also be used to offer Trusted Shops products to buyers after an order has
been placed.
This serves to protect our legitimate interest in optimal marketing and
enabling secure shopping pursuant to Article 6(1)(f) GDPR.
The Trustbadge and the services offered through it are provided by Trusted
Shops SE, Subbelrather Straße 15C, 50823 Cologne, Germany — hereinafter
referred to as “Trusted Shops”.
We are joint controllers with Trusted Shops pursuant to Article 26 GDPR.
Below, we inform you about the main aspects of this joint controllership.
When you interact with Trustbadge AI+, session cookies may be placed to store
your login status and display a so-called welcome layer. This layer may
contain information about the relevant online shop, such as:
- company information;
- reviews;
- information about the availability of buyer protection;
- the so-called #trstd secret.
To recognise logged-in users, a cookie is placed and stored for a maximum of
400 days after login.
Session cookies may also be placed to send push notifications when using the
app, provided that you have allowed this.
This is necessary to provide the digital service requested by you from
Trusted Shops. Trusted Shops is responsible for data processing when you
interact with Trustbadge AI+.
Joint controllership with Trusted Shops
For questions about data protection and to exercise your rights, you should
preferably contact Trusted Shops using the contact details provided in its
privacy information.
However, you may always contact either controller of your choice. Your
request may, where necessary, be forwarded to the other controller for a
response.
8.1 Data processing when integrating the Trustbadge and other widgets
The Trustbadge is provided through a US-based content delivery network
provider.
An adequate level of protection is ensured through an adequacy decision of
the European Commission, where applicable.
Service providers in the United States are generally certified under the
EU-U.S. Data Privacy Framework. If a service provider is not certified under
this framework, Standard Contractual Clauses have been agreed as an
appropriate safeguard.
When the Trustbadge is loaded, the web server automatically stores a server
log file. This may include:
- IP address;
- date and time of access;
- amount of data transferred;
- internet service provider.
The IP address is anonymised immediately after collection so that the stored
data cannot be associated with you.
The anonymised data is used in particular for statistical purposes and error
analysis.
8.2 Data processing after completion of an order
After an order has been completed, the Trustbadge may access order
information stored on your device, such as:
- order amount;
- order number;
- any product purchased;
- your email address.
This is necessary to provide Trusted Shops services and, where applicable,
automatically protect your order.
For this purpose, your email address is hashed using a cryptographic
one-way function and transmitted to Trusted Shops.
The legal basis is Article 6(1)(f) GDPR.
This serves to check whether you are already registered for Trusted Shops
services. The processing is necessary to protect the legitimate interests of
us and Trusted Shops in providing buyer protection and transaction-related
review services linked to the specific order.
If you are already registered, further processing takes place in accordance
with the agreement between you and Trusted Shops.
If you are not yet registered for the services, you will be given the
opportunity to register for the first time.
Further processing after registration is also governed by the agreement with
Trusted Shops.
If you do not register, Trusted Shops will automatically delete all data
transmitted. After that, it will no longer be possible to associate the
data with you.
Trusted Shops uses service providers for hosting, monitoring and logging.
The legal basis is Article 6(1)(f) GDPR, for the purpose of ensuring the
proper operation of the services.
Processing may take place in third countries, including:
- the United States;
- the United Kingdom;
- Israel.
An adequate level of protection is ensured through adequacy decisions of the
European Commission, where applicable.
Service providers in the United States are generally certified under the
EU-U.S. Data Privacy Framework. If a service provider is not certified under
this framework, Standard Contractual Clauses have been agreed as an
appropriate safeguard.
9. Social media
9.1 Social media buttons from Facebook and Instagram
Our website uses social media buttons from social networks.
These buttons are integrated into the website solely as HTML links. As a
result, no connection to the servers of the relevant provider is established
when you open our website.
When you click on a button, the website of the relevant social network opens
in a new browser window. There, you may use a Like or Share button, for
example.
9.2 Our online presence on social media
We maintain online profiles on the following social media platforms:
- Facebook;
- X;
- Instagram;
- YouTube;
- Pinterest;
- LinkedIn.
Where you have given your consent to the relevant social media operator
pursuant to Article 6(1)(a) GDPR, your data may be automatically collected
and stored when you visit our profiles on these platforms for market
research and advertising purposes.
Based on this data, usage profiles may be created using pseudonyms.
These profiles may be used to display advertisements within and outside the
platforms that are presumed to correspond to your interests.
Cookies are generally used for this purpose.
Detailed information about the processing and use of data by the relevant
social media operator, as well as contact details and information about your
rights and privacy settings, can be found in the privacy policies of the
relevant providers.
If you require assistance with this, you may contact us.
Facebook is a service provided by Meta Platforms Ireland Ltd., Block J,
Serpentine Avenue, Dublin 4, Ireland.
The information automatically collected by Meta Platforms Ireland about your
use of our Facebook page is generally transferred to and stored on a server
operated by Meta Platforms, Inc., 1601 Willow Road, Menlo Park, California
94025, United States.
Data processing when visiting our Facebook page is based on an arrangement
between joint controllers pursuant to Article 26 GDPR.
Further information, including information about Insights data, can be found
in Meta’s privacy information.
Our service providers are based in and/or use servers in countries for which
the European Commission has determined that an adequate level of protection
exists, including:
- Brazil;
- the United States;
- Canada;
- Japan;
- South Korea;
- New Zealand;
- the United Kingdom;
- Argentina.
For the United States, the adequacy decision serves as the basis for
transfers to a third country insofar as the relevant service provider is
certified.
Our service providers are also based in and/or use servers in:
- Australia;
- Hong Kong;
- India;
- Indonesia;
- Malaysia;
- Singapore;
- Thailand;
- Taiwan;
- Mexico.
No adequacy decision by the European Commission exists for these countries.
Our cooperation with these service providers is based on the European
Commission’s Standard Contractual Clauses.
X
X is a service provided by X Internet Unlimited Company, One Cumberland
Place, Fenian Street, Dublin 2, D02 AX07, Ireland.
The information automatically collected by X about your use of our presence
on X is generally transferred to and stored on a server operated by X Corp.,
FM 1209, Building 2, Bastrop, Texas 78602, United States.
Our service providers are based in and/or use servers in countries outside
the EU and EEA for which the European Commission has determined that an
adequate level of protection exists.
Our service providers may also be based in and/or use servers in countries
outside the EU and EEA for which no adequacy decision has been adopted by
the European Commission. Our cooperation with these service providers is
based on the European Commission’s Standard Contractual Clauses.
Instagram is a service provided by Meta Platforms Ireland Ltd., Block J,
Serpentine Avenue, Dublin 4, Ireland.
The information automatically collected by Meta Platforms Ireland about your
use of our Instagram page is generally transferred to and stored on a server
operated by Meta Platforms, Inc., 1601 Willow Road, Menlo Park, California
94025, United States.
Data processing when visiting our Instagram page is based on an arrangement
between joint controllers pursuant to Article 26 GDPR.
Further information, including information about Insights data, can be found
in Meta’s privacy information.
Our service providers are based in and/or use servers in countries for which
the European Commission has determined that an adequate level of protection
exists, including:
- Brazil;
- the United States;
- Canada;
- Japan;
- South Korea;
- New Zealand;
- the United Kingdom;
- Argentina.
For the United States, the adequacy decision serves as the basis for
transfers to a third country insofar as the relevant service provider is
certified.
Our service providers are also based in and/or use servers in:
- Australia;
- Hong Kong;
- India;
- Indonesia;
- Malaysia;
- Singapore;
- Thailand;
- Taiwan;
- Mexico.
No adequacy decision by the European Commission exists for these countries.
Our cooperation with these service providers is based on the European
Commission’s Standard Contractual Clauses.
YouTube
YouTube is a service provided by Google Ireland Limited, Gordon House,
Barrow Street, Dublin 4, Ireland.
The information automatically collected by Google about your use of our
presence on YouTube is generally transferred to and stored on a server
operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043,
United States.
Our service providers are based in and/or use servers in countries outside
the EU and EEA for which the European Commission has determined that an
adequate level of protection exists.
Our service providers may also be based in and/or use servers in countries
outside the EU and EEA for which no adequacy decision has been adopted by
the European Commission. Our cooperation with these service providers is
based on the European Commission’s Standard Contractual Clauses.
Pinterest is a service provided by Pinterest Europe Ltd., Waterloo Exchange,
3rd Floor, Waterloo Road, Dublin 4, Ireland.
The information automatically collected by Pinterest about your use of our
presence on Pinterest is generally transferred to and stored on a server
operated by Pinterest, Inc., 505 Brannan Street, San Francisco, CA 94107,
United States.
Our service providers are based in and/or use servers in countries outside
the EU and EEA for which the European Commission has determined that an
adequate level of protection exists.
Our service providers may also be based in and/or use servers in countries
outside the EU and EEA for which no adequacy decision has been adopted by
the European Commission. Our cooperation with these service providers is
based on the European Commission’s Standard Contractual Clauses.
LinkedIn is a service provided by LinkedIn Ireland Unlimited Company, Wilton
Place, Dublin 2, Ireland.
The information automatically collected by LinkedIn about your use of our
presence on LinkedIn is generally transferred to and stored on a server
operated by LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085,
United States.
Our service providers are based in and/or use servers in countries for which
the European Commission has determined that an adequate level of protection
exists, including the United States.
For the United States, the adequacy decision serves as the basis for
transfers to a third country insofar as the relevant service provider is
certified.
10. Contact details and your rights
10.1 Your rights
As a data subject, you have the following rights:
Right of access
Under Article 15 GDPR, you have the right to request access to the personal
data we process about you within the limits specified in that provision.
Right to rectification
Under Article 16 GDPR, you have the right to request without undue delay the
rectification of inaccurate personal data or the completion of incomplete
personal data.
Right to erasure
Under Article 17 GDPR, you have the right to request the deletion of your
personal data stored by us unless further processing is necessary:
- for exercising the right to freedom of expression and information;
- for compliance with a legal obligation;
- for reasons of public interest;
- for the establishment, exercise or defence of legal claims.
Right to restriction of processing
Under Article 18 GDPR, you have the right to request restriction of the
processing of your personal data where:
- you contest the accuracy of the personal data;
- the processing is unlawful but you do not want the data to be erased;
-
we no longer need the data, but you require it for the establishment,
exercise or defence of legal claims; - you have objected to processing pursuant to Article 21 GDPR.
Right to data portability
Under Article 20 GDPR, you have the right to receive the personal data you
have provided to us in a structured, commonly used and machine-readable
format.
You also have the right to request that we transmit this data directly to
another controller, where technically feasible.
Right to lodge a complaint
Under Article 77 GDPR, you have the right to lodge a complaint with a
supervisory authority.
In the Netherlands, you can contact the Dutch Data Protection Authority:
Autoriteit PersoonsgegevensP.O. Box 93374
2509 AJ The Hague
The Netherlands
Website:
www.autoriteitpersoonsgegevens.nl
You may also contact the supervisory authority of your habitual residence,
place of work or the place where the alleged infringement occurred.
Right to object
Where we process your personal data to protect our legitimate interests,
which prevail following a balancing of interests, you may object to this
processing with effect for the future.
Where the processing is carried out for direct marketing purposes, you may
object at any time.
Where the processing is carried out for other purposes, you may object only
where you have grounds relating to your particular situation.
After you exercise your right to object, we will no longer process your
personal data for these purposes unless we can demonstrate compelling
legitimate grounds for the processing that override your interests, rights
and freedoms, or the processing serves the establishment, exercise or
defence of legal claims.
This does not apply where the processing is carried out for direct marketing
purposes. In that case, we will no longer process your personal data for
these purposes.
10.2 Contact details
Do you have questions about the collection, processing or use of your
personal data? Would you like to request access, rectification, restriction
or erasure? Would you like to withdraw previously given consent or object to
a specific processing activity?
Please contact us directly at:
Heatsupply B.V.Waardjesweg 69
5725 TB Heusden
The Netherlands
Email:
mail@heatsupply.nl
Important points to check before publication
This is a translation, but the following points should be verified before
publication:
-
Add the city:
the city is missing from the address “5725 TB”. -
Check all services actually used:
remove sections relating to Klarna, AWIN, Trusted Shops, Google, Meta,
Cookiebot, Pinterest, LinkedIn or other services that are not actually
used on the website. -
Align the Privacy Policy with the cookie banner:
the cookies listed in the banner must correspond to the cookies actually
placed. -
Check Google Analytics:
confirm whether Google Analytics 4 is being used, whether IP-related
settings are correctly configured and whether Google Analytics is loaded
only after consent where required. -
Check Meta Pixel and Conversions API:
in particular, verify the roles of the parties, advanced matching and the
legal basis for international transfers. -
Check newsletter tracking:
newsletter tracking may require additional attention, particularly where
tracking technologies are placed on or read from the recipient’s device. -
Update third-country information:
the lists of countries and transfer mechanisms should be aligned with the
actual processors and subprocessors used. -
Specify retention periods:
where possible, specify a concrete retention period for each category of
data or clearly explain the criteria used to determine the retention
period. -
Adapt the template to the applicable jurisdiction:
concepts such as statutory warranty rights, defective performance and tax
and commercial retention periods should be reviewed against the applicable
laws in the countries where Heatsupply operates. -
Obtain a legal review:
have the final version reviewed by a privacy lawyer, particularly because
the Privacy Policy covers an online shop, tracking technologies,
advertising platforms and international data transfers.
