Privacy Statement

This privacy statement applies to the website www.ere-vergelijk.nl (hereinafter: "the Website"), operated by ERE-vergelijk.nl (hereinafter: "we", "us" or "our").

We attach great importance to the protection of your personal data and the respect of your privacy. In this privacy statement we explain which data we collect when you visit our Website, why we collect this data, how we use it and which rights you have.

We process personal data in accordance with the General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act.

The controller responsible for the processing of your personal data is:

ERE-vergelijk.nl

Email: privacy@ere-vergelijk.nl

For questions about this privacy statement or about the processing of your personal data, please contact us using the details above.

When you visit our Website, we automatically collect certain data to safeguard the functioning of the Website and to gain insight into the use of our Website. This concerns the following data:

Category:

• Technical data — IP address (anonymised), browser type and version, operating system, device type

• Usage data — Pages visited, date and time of visit, duration of visit, click behaviour, referring website

• Location data — Country and region (derived from anonymised IP address)

If you contact us via the contact form or by email, we collect the data you provide to us, such as:

• Name

• Email address

• Content of your message

In addition, we process data about the contact persons of booking service providers who have access to the closed provider portal:

• Name

• Business email address

• Password, stored in encrypted form

When you ask to be contacted by a booking service provider through our sign-up form ("Apply"), we collect the details you enter in that form:

• First and last name, email address and phone number

• Address (postcode, house number, street and city) and the EAN code of your electricity connection, looked up from your postcode and house number or entered by you

• Brand, model and (optionally) serial number of your charge point

• The offering you selected, the booking year(s) you want and any comment

You first confirm the sign-up via a link in your email (double opt-in); without that confirmation your sign-up is not forwarded and is erased after 30 days. Your phone number is passed on only to the provider you selected; we never call you ourselves.

We do not collect special categories of personal data, such as data on health, political opinions, religious beliefs or criminal records. Nor do we collect your citizen service number (BSN).

We process your personal data only for the purposes listed below and on the basis of the legal grounds stated:

• Purpose - Analysing website traffic – We analyse visitor numbers, popular pages and usage patterns to improve our Website and to make the Website attractive to booking service providers who want to be visible via our platform.

  • Categories of data - Technical data, usage data, location data

    • Legal ground - Legitimate interest

• Purpose - Ensuring the technical operation of the Website – We use certain data to make the Website function correctly and to detect security incidents.

  • Categories of data - Technical data

    • Legal ground - Legitimate interest

• Purpose - Answering questions and requests – When you contact us, we use your data to answer your question.

  • Categories of data - Name, email address, message content

    • Legal ground - Consent

• Purpose - Managing the provider portal – Contact persons of booking service providers sign in to manage their own listing on the website. The changes they submit are logged.

  • Categories of data - Name, business email address, password stored in encrypted form

    • Legal ground - Performance of the collaboration

• Purpose - Connecting you with a booking service provider – When you sign up for an offering through our sign-up form, we forward your sign-up, after your email confirmation, to the booking service provider you selected so they can complete your sign-up with you. If you tick the box asking to be reminded about renewal towards the end of your term, we keep only your first name, email address, the chosen provider and the end date of your term for that purpose.

  • Categories of data - Name, contact details, address and EAN code, charge-point details, selected offering and booking years

    • Legal ground - Consent

• Purpose - Complying with legal obligations – We may be required to retain or provide certain data to competent authorities.

  • Categories of data - The data to which the legal obligation relates

    • Legal ground - Legal obligation

Where we rely on our legitimate interest, we have weighed our interest against your privacy interests. Our interest consists of obtaining insight into the use of our Website so that we can improve it and make it attractive to booking service providers. We have taken measures to limit the impact on your privacy, including anonymising IP addresses. You can object to this processing at any time (see section 8).

See our cookie policy here

Recipients of your personal data

In principle we do not share personal data with other parties (third parties), unless this is necessary for the functioning of our website or the provision of our services. With all of these parties we have concluded a data processing agreement in which arrangements have been made for the protection of your data. We may share personal data with:

• Google Ireland Ltd., for keeping website statistics (Google Analytics 4) and ad management and conversion measurement (Google Ads). Google is established in Ireland (EU). Transfer to the United States may take place on the basis of the Standard Contractual Clauses (hereafter: SCCs) and the EU-US Data Privacy Framework;

• Render Services, Inc., for hosting our website. Render is established in the United States. Transfer takes place on the basis of the SCCs;

• Cloudflare, Inc., for DNS, CDN and protection against attacks on our website. Cloudflare is established in the United States. Transfer takes place on the basis of the SCCs;

• Fastmail Pty Ltd., for processing incoming emails via the contact form. Fastmail is established in Australia and the United States. Transfer takes place on the basis of the SCCs.

We never sell your personal data to third parties for their own purposes; forwarding to the provider you selected happens only at your own request. Beyond that we do not provide your data to other parties unless this is necessary for the performance of our services or if we are legally required to do so.

In addition, for our sign-up form: if you sign up with a booking service provider through ERE-Vergelijk, we share your sign-up details – only after your explicit consent and email confirmation – with that one provider you selected. This provider is not a processor acting for us but an independent controller of the data it receives; the provider's own privacy statement applies to that use. We may receive a fee from the provider for this service. The provider may use your details only to contact you about your own sign-up; access or erasure requests that reach us are forwarded to the provider.

To look up the EAN code of your electricity connection we consult the EAN code book of EDSN (eancodeboek.nl, Netherlands). We send only your postcode and house number, never your name or contact details. EDSN is not a processor acting for us; the code book is a publicly searchable register.

We do not retain your personal data longer than necessary for the purposes for which it was collected. The following retention periods apply:

• Category of data - Website statistics (aggregated and anonymised)

  • Retention period: Unlimited

• Category of data - IP addresses (anonymised)

  • Retention period: 14 months

• Category of data - Contact form data

  • Retention period: 1 year after handling your question

• Category of data - Server log files

  • Retention period - 6 months

• Category of data - Provider portal account data

  • Retention period - For as long as the account exists; deleted afterwards

• Category of data - Sign-ups via the sign-up form (unconfirmed)

  • Retention period - 30 days, then erased

• Category of data - Sign-ups via the sign-up form (forwarded to the provider)

  • Retention period - 90 days after forwarding, then anonymised. If you opted for a reminder towards the end of your term, after those 90 days we keep only your first name, email address, the chosen provider and the end date of your term, until at most 90 days after that term ends

• Category of data - Sign-ups via the sign-up form (confirmed but not forwarded)

  • Retention period - 6 months, then anonymised

After the retention period has expired, your data is deleted or anonymised.

Under the GDPR you have the following rights regarding your personal data:

1. Right of access — You have the right to know which personal data we process about you and to receive a copy of this data.

2. Right to rectification — You have the right to have inaccurate or incomplete data corrected.

3. Right to erasure ("right to be forgotten") — You have the right to request that we delete your personal data, if it is no longer necessary or if you withdraw your consent.

4. Right to restriction of processing — You have the right to have the processing of your data temporarily restricted, for example when you contest the accuracy of the data.

5. Right to data portability — You have the right to receive your data in a structured, commonly used and machine-readable format and to transfer it to another controller.

6. Right to object — You have the right to object to the processing of your data based on our legitimate interest. We will cease the processing unless we can put forward compelling legitimate grounds.

7. Right to withdraw consent — If processing is based on your consent, you have the right to withdraw this consent at any time. This does not affect the lawfulness of the processing prior to the withdrawal.

You can exercise your rights by contacting us via:

• Email: privacy@ere-vergelijk.nl

We respond to your request within one month. If your request is complex or we receive a large number of requests, we may extend this period by two months. In that case we will inform you within one month.

In order to verify your identity, we may ask you to provide additional information.

We take appropriate technical and organisational measures to protect your personal data against loss, unauthorised access, alteration or disclosure. These measures include, among other things:

• Encrypted connections (HTTPS/TLS) for all communication with the Website

• Access security to our systems on the basis of the "need-to-know" principle

• Regular back-ups of our systems

• Security updates and patches

Our Website may contain links to third-party websites, including the websites of booking service providers. We are not responsible for the privacy policy or the content of these external websites. We recommend that you consult the privacy policy of these websites before providing personal data.

Our Website is not aimed at persons under the age of 18 and we do not knowingly collect personal data from minors. If you believe that we have collected personal data from a minor, please contact us so that we can delete this data.

If you have a complaint about how we process your personal data, we would like to hear it. You can contact us using the details in section 2.

You also have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), the supervisory authority for privacy protection in the Netherlands:

Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag. Phone: 088 - 1805 250. Website: www.autoriteitpersoonsgegevens.nl

We may amend this privacy statement from time to time, for example following new functionality on the Website or changes in laws and regulations. We recommend that you consult this privacy statement regularly.

In the event of substantial changes that affect how we process your personal data, we will inform you about this through a clear notice on the Website.

The date of the most recent change can be found at the top of this privacy statement.