abeta ABETA
nl flag

Compliance

Privacy Policy for Abeta PunchOut

#1. Introduction

This is the privacy policy of Abeta B.V. We are committed to protecting your privacy and ensuring that your personal information is handled in a safe and responsible manner while providing our services. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our PunchOut Middleware services.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Dutch GDPR Implementation Act (Uitvoeringswet AVG) and other applicable data protection and privacy legislation, including the Dutch Telecommunications Act (Telecommunicatiewet) with regard to cookies.

#Who is responsible for your data

Abeta B.V. is the controller for personal data we process for our own purposes, such as managing customer accounts, contracts, invoicing, support and our website.

When we process personal data on behalf of our customers as part of the PunchOut Middleware services (for example order data passed between buyers' procurement systems and suppliers' webshops), our customer is the controller and Abeta B.V. acts as processor. In that case we process the data only on our customer's documented instructions and under a data processing agreement as required by Article 28 GDPR. If you are an end user of one of our customers, please also consult that customer's privacy policy, and address requests about those data to that customer in the first instance; we will assist them in handling your request.

#2. Information We Collect

We may collect the following types of information:

  • Personal Information: This includes information such as names, email address, phone numbers, and shipping and billing information.
  • Usage Data: Information about how you use our services, including your IP address, browser type, pages visited, and other usage statistics.
  • Transactional Data: Details about transactions you carry out through our middleware, including order details, payment information, shipping and billing addresses.

We only collect personal data that is adequate, relevant and limited to what is necessary for the purposes described in this policy (data minimisation). We do not intentionally process special categories of personal data (such as health data) and our services are not directed at children under 16.

#3. How We Use Your Information and Our Legal Bases

We use the information we collect for various purposes, including:

  • To provide, operate, and maintain our PunchOut Middleware services. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
  • To process transactions and send related information, such as order confirmations. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
  • To communicate with you, including responding to your inquiries and providing customer support. Legal basis: performance of a contract or our legitimate interest in providing good service (Article 6(1)(b) and (f) GDPR).
  • To improve our services, including troubleshooting, data analysis, and testing. Legal basis: our legitimate interest in maintaining secure and well-functioning services (Article 6(1)(f) GDPR). Where possible we use anonymised or pseudonymised data for this purpose.
  • To comply with legal obligations and protect our legal rights and interests. Legal basis: compliance with a legal obligation, such as tax retention requirements (Article 6(1)(c) GDPR), and our legitimate interest in establishing or defending legal claims (Article 6(1)(f) GDPR).

Where we rely on your consent (for example for non-essential cookies or marketing emails), you may withdraw that consent at any time, without affecting the lawfulness of processing before withdrawal. We do not use your personal data for automated decision-making, including profiling, that produces legal or similarly significant effects for you.

#4. Sharing Your Information

We do not sell your information. However, we may share your information in the following circumstances:

  • With Service Providers: We may share your information with third-party service providers who perform services on our behalf, such as payment processors, hosting providers, and email service providers. These providers act as (sub-)processors, are bound by a data processing agreement, and may only use your data on our instructions. A list of our sub-processors is available on request.
  • For Legal Reasons: We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or a government agency).
  • With Business Partners: In case they provide a (partial) service to support our services, e.g. platform integration partners. We only share the data needed for that service, under appropriate contractual safeguards.
  • Business Transfers: If we are involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction. In that case we will ensure the recipient continues to protect your data in line with this policy and the GDPR, and we will inform you where required.

#International transfers

We aim to store and process personal data within the European Economic Area (EEA). If personal data is transferred to a country outside the EEA that does not have an adequacy decision from the European Commission, we ensure appropriate safeguards, such as the European Commission's Standard Contractual Clauses (Article 46 GDPR) or, for the United States, certification under the EU-U.S. Data Privacy Framework. You can request a copy of the relevant safeguards by contacting us.

#5. Data Security

We implement a variety of appropriate technical and organisational security measures (Article 32 GDPR) to maintain the safety of your personal information. These measures include encryption, access controls (including Two-Factor Authentication (2FA)), and secure server environments. Access to personal data is limited to staff who need it for their work and who are bound by confidentiality. For more detailed information about our security measures please contact our security officer at info@abeta.io, with the subject SECREQ - 'Your title here'.

In the event of a personal data breach, we will notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours where required, and inform affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms. Where we act as processor, we will notify the relevant customer without undue delay.

#6. Data Retention

We do not keep personal data longer than necessary for the purposes for which it was collected. In general:

  • Account and contract data are kept for the duration of the agreement up to as long as required to meet all our legal obligations.
  • Transactional and invoicing data are kept for 7 years to meet the Dutch statutory tax retention obligation.
  • Logs and usage data are deleted on request after termination of the contract.

Where we act as processor, we delete or return the data at the end of the agreement in line with our customer's instructions.

#7. Your Rights and Choices

Under the GDPR you have the following rights regarding your personal information:

  • Access and Correction: You can request access to the personal information we hold about you and request corrections to any inaccuracies (Articles 15 and 16 GDPR).
  • Deletion: You can request that we delete your personal information (Article 17 GDPR), unless we are required to keep it, for example to comply with a legal obligation, to perform a contract with you, or to establish or defend legal claims.
  • Restriction: You can ask us to restrict the processing of your personal information in certain circumstances (Article 18 GDPR).
  • Data Portability: You can request to receive the personal information you provided to us in a structured, commonly used and machine-readable format, or to have it transferred to another party (Article 20 GDPR).
  • Objection: You can object to processing based on our legitimate interests, and you can always object to direct marketing (Article 21 GDPR).
  • Withdrawal of Consent: Where processing is based on consent, you can withdraw it at any time.
  • Complaint: You have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (www.autoriteitpersoonsgegevens.nl). We would appreciate the chance to address your concern first.

To exercise your rights, contact us at info@abeta.io. We may ask you to verify your identity. We will respond within one month of receiving your request; this period may be extended by two further months for complex or numerous requests, in which case we will let you know. Exercising your rights is free of charge.

#8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on our website and updating the effective date above. For material changes we will also inform our customers directly, for example by email. You are advised to review this Privacy Policy periodically for any changes.

#9. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, or wish to exercise your rights, please contact us at:

Abeta B.V., Onder de Bogen 12, 1251 ME Laren (NH), The Netherlands | KvK: 89634462 | Email: info@abeta.io

We will handle any requests or complaints confidentially. Our representative will contact you to address your concerns and outline the options regarding how these may be resolved. We aim to ensure that complaints are resolved in a timely and appropriate manner and, for requests regarding your rights, within the GDPR's one-month period.