Privacy Policy

Effective Date: 1 January 2026

1. Data Controller Identification

The data controller responsible for personal information gathered through this website is Bundles Brimsy Continuity Facilities B.V., registered under trade registry code NL-84920481-B01, located at Keizersgracht 421, 1016 EK Amsterdam, Netherlands. Direct correspondence regarding privacy practices should be addressed to our designated Data Protection Officer at [email protected].

2. Categories of Information Collected

We adhere strictly to data minimization standards under the General Data Protection Regulation (Regulation (EU) 2016/679). We only collect information strictly required to deliver informational guidance and process business enquiries:

• Technical Access Logs: Standard HTTP server transmission records, including client IP address, timestamp, requested resource URL, user-agent string, and HTTP status response codes. These records are maintained for server security and fault diagnosis.
• Operational Enquiry Data: When you complete our contact terminal or initiate email correspondence, we record your name, corporate email address, corporate entity name, seating capacity requirements, geographic interests, and free-text technical specifications.
• Cookie Preference Records: A local browser key recording your acceptance or refusal of non-essential cookie storage categories.

3. Legal Bases and Processing Purposes

Your information is processed exclusively under defined legal bases set forth in Article 6 of the GDPR:

• Performance of Pre-Contractual Steps (Art. 6(1)(b)): To review your business continuity facility requirements, prepare feasibility analyses, and transmit relevant operational responses.
• Legitimate Interests (Art. 6(1)(f)): To safeguard the integrity and availability of our web infrastructure against automated intrusion attempts and denial-of-service traffic.
• Legal Obligation Compliance (Art. 6(1)(c)): To maintain corporate tax and statutory communications logs in accordance with Dutch commercial code requirements.
• Consent (Art. 6(1)(a)): For non-essential functional browser cookies, where granted explicitly via the consent terminal.

4. Data Retention Periods

Personal data is retained only for the duration necessary to satisfy the specific purpose for which it was gathered. Server access logs are rotated and permanently overwritten after 30 days. Contact and facility assessment requests that do not result in active contractual engagement are purged from our live communication systems after 24 months. Contractual records are retained for the statutory 7-year retention period required under Dutch fiscal legislation.

5. Third-Party Data Processors and Transfers

bundlesbrimsy.com does not sell, lease, or monetize personal details to data aggregators or marketing networks. Information is processed using infrastructure hosted inside the European Economic Area (EEA). If technical subcontractors or cloud providers outside the EEA are engaged, transfers are executed under European Commission Standard Contractual Clauses (SCCs) to ensure equivalent levels of protection.

6. Your Statutory Rights Under the GDPR

As a data subject within the European Union, you possess the following actionable rights regarding your personal information:

• Right of Access (Art. 15): Obtain confirmation as to whether your personal information is processed and receive a copy of that data.
• Right to Rectification (Art. 16): Require correction of inaccurate or incomplete corporate contact data.
• Right to Erasure (Art. 17): Request the permanent deletion of personal details when retention is no longer justified.
• Right to Restriction of Processing (Art. 18): Request temporary freezing of data processing during verification disputes.
• Right to Data Portability (Art. 20): Receive personal data provided to us in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21): Object to processing founded upon legitimate interest grounds on basis of your specific situation.

7. Data Protection Supervisory Authority

If you consider that our processing of personal data infringes applicable data protection law, you have the statutory right to lodge a complaint with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) via their official portal at autoriteitpersoonsgegevens.nl, or with the relevant supervisory body in your EU member state of residence.

8. Policy Revisions

We may amend this policy periodically to reflect evolving operational requirements or statutory amendments. Significant revisions will be reflected in the updated effective date at the top of this document.