Privacy policy

1. Information on the Collection of Personal Data and Contact Details of the Controller

1.1

We are pleased that you are visiting our supplyswap.com presence (hereinafter referred to as the “Website”) and thank you for your interest. Below, we inform you about the handling of your personal data when using our website. Personal data includes all data that can identify you personally.

1.2

The controller for data processing in accordance with the General Data Protection Regulation (GDPR) is Vincent Janssen, Primesource B.V., Oude staat 15A, 6118AW Nieuwstadt, Netherlands, Tel.: +31 46 790 8091, Email: service@supplyswap.com. The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

2. Contacting Us

When you contact us (e.g., via contact form or email), personal data will be collected. Which data is collected can be seen from the respective contact form. This data is stored and used solely for the purpose of responding to your request or for contacting you and the associated technical administration. The legal basis for processing the data is our legitimate interest in responding to your request in accordance with Art. 6(1)(f) GDPR. If your contact aims at concluding a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR. Your data will be deleted after the final processing of your inquiry, provided that there are no legal retention obligations to the contrary.

3. Data Processing for Order Handling

3.1

To the extent necessary for the performance of the contract for delivery and payment purposes, the personal data collected by us will be passed on to the commissioned transport company and the commissioned credit institution in accordance with Art. 6(1)(b) GDPR.

If we owe you updates for goods with digital elements or for digital products based on a corresponding contract, we process the contact details you provided when placing the order (name, address, email address) to inform you personally about upcoming updates within the legally stipulated period via a suitable communication channel (e.g., postal or email) in accordance with our statutory information obligations pursuant to Art. 6(1)(c) GDPR. Your contact details will be used strictly for the purpose of notifications regarding updates owed by us and will be processed only to the extent necessary for this purpose.

To process your order, we work with the following service providers who support us in whole or in part in the execution of concluded contracts. Certain personal data will be transmitted to these service providers in accordance with the following information.

3.2

To fulfill our contractual obligations to our customers, we work with external shipping partners. We provide your name and delivery address to a selected shipping partner solely for the purpose of delivering the goods in accordance with Art. 6(1)(b) GDPR.

3.3

Payment processing is handled by Shopify, to whom we transmit your information disclosed during the order process along with the information about your order in accordance with Art. 6(1)(b) GDPR. Payment processing via PayPal, Sofortüberweisung, and Klarna is not conducted by Shopify itself but instead by transmitting your required payment data to the selected payment service provider in accordance with Art. 6(1)(b) GDPR:

  • PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg
  • SOFORT GmbH, Theresienhöhe 12, 80339 Munich, as part of the Klarna Group (Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden)
  • Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden

The transmission of your data takes place exclusively for the purpose of payment processing via supplyswap.com and only to the extent necessary for this purpose. 

4. Rights of the Data Subject

4.1

Applicable data protection law grants you comprehensive data subject rights (rights of access and intervention) towards the controller regarding the processing of your personal data, which we inform you about below:

  • Right of access pursuant to Art. 15 GDPR: You have the right to request information about your personal data processed by us, the purposes of the processing, the categories of personal data processed, the recipients or categories of recipients to whom your data has been or will be disclosed, the planned storage period, the criteria for determining the storage period, the existence of a right to rectification, erasure, restriction of processing, objection to processing, the right to lodge a complaint with a supervisory authority, the source of your data if not collected from you, the existence of automated decision-making including profiling and, if applicable, meaningful information about the logic involved as well as the significance and envisaged consequences of such processing, and your right to be informed about the appropriate safeguards pursuant to Art. 46 GDPR when your data is transferred to third countries.
  • Right to rectification pursuant to Art. 16 GDPR: You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you and/or to have incomplete personal data stored by us completed.
  • Right to erasure pursuant to Art. 17 GDPR: You have the right to request the erasure of your personal data where the conditions of Art. 17(1) GDPR are met. This right does not apply, in particular, where processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims.
  • Right to restriction of processing pursuant to Art. 18 GDPR: You have the right to request the restriction of the processing of your personal data as long as the accuracy of your data contested by you is being verified, if you oppose the erasure of your data due to unlawful data processing and instead request the restriction of the use of your data, if you need your data to establish, exercise, or defend legal claims, after we no longer need these data for the purpose of processing, or if you have objected to processing for reasons related to your particular situation, pending the verification whether our legitimate grounds override yours.
  • Right to be informed pursuant to Art. 19 GDPR: If you have asserted the right to rectification, erasure, or restriction of processing against the controller, the controller is obligated to communicate this rectification or erasure of data or restriction of processing to each recipient to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort. You have the right to be informed about these recipients.
  • Right to data portability pursuant to Art. 20 GDPR: You have the right to receive your personal data, which you have provided to us, in a structured, commonly used, and machine-readable format, or to request the transmission to another controller, where technically feasible.
  • Right to withdraw consent pursuant to Art. 7(3) GDPR: You have the right to withdraw your consent to the processing of data at any time with effect for the future. In case of withdrawal, we will delete the data concerned without delay unless further processing can be based on a legal basis for processing without consent. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
  • Right to lodge a complaint pursuant to Art. 77 GDPR: If you consider that the processing of your personal data infringes the GDPR, you have the right – without prejudice to any other administrative or judicial remedy – to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or place of the alleged infringement.

4.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA BASED ON OUR OVERRIDING LEGITIMATE INTEREST IN THE CONTEXT OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION, WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING REMAINS RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS, AND FREEDOMS, OR IF THE PROCESSING IS FOR THE ESTABLISHMENT, EXERCISE, OR DEFENSE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING. YOU CAN EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

5. Duration of Storage of Personal Data

The duration of the storage of personal data is determined based on the respective legal basis, the purpose of processing, and – if relevant – also based on the respective statutory retention period (e.g., commercial and tax retention periods).

When processing personal data based on explicit consent in accordance with Art. 6(1)(a) GDPR, the data concerned will be stored until you withdraw your consent.

If there are statutory retention periods for data processed in the context of legal or similar obligations based on Art. 6(1)(b) GDPR, this data will be routinely deleted after the retention periods have expired, provided that it is no longer necessary for the fulfillment or initiation of the contract and/or there is no legitimate interest on our part in continuing to store it.

When processing personal data based on Art. 6(1)(f) GDPR, this data will be stored until you exercise your right to object in accordance with Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights, and freedoms, or the processing is for the establishment, exercise, or defense of legal claims.

When processing personal data for direct marketing purposes based on Art. 6(1)(f) GDPR, this data will be stored until you exercise your right to object in accordance with Art. 21(2) GDPR.

Unless otherwise stated in the other information of this declaration regarding specific processing situations, stored personal data will be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.

Company Information

Website Name: SupplySwap
Address: Oude Staat 15A, 6118 AW Nieuwstadt, Netherlands
Email: service@supplyswap.com
Contact Form: here
Phone: +31 616821948
Company Number: 89243641
VAT Number: NL864921925B01

Customer Service Hours:
Monday to Friday from 09:00 to 17:00
We strive to respond within one business day.