EVA Optic B.V. is responsible (the “controller”) for the personal data processed through evaoptic.com and in our sales and customer contact. We handle your data in line with the EU General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act (UAVG).
We have not appointed a Data Protection Officer, as this is not required for our activities. Send any privacy question to info@evaoptic.com with “Privacy” in the subject line.
We collect only the data you give us and a limited set of technical data from your visit.
| Situation | Personal data |
|---|---|
| Contact form | First and last name, email address, phone number, company name, country, city, subject, your message, and your consent |
| Project submission | Contact details as above, plus project details, drawings and other files you upload |
| Test swim booking (EVA Experience Center) |
Name, contact details, preferred date and time, and any notes you add |
| Partner application | Name, company name, job title, contact details, business address, and information about your business |
| Customers, partners and suppliers | Business contact details, order and project history, correspondence, and invoicing data |
| Email, phone and WhatsApp contact | Your contact details and the content of the conversation |
| Website visit | IP address, browser and device type, pages visited, and cookie identifiers (see section 7) |
We do not ask for special categories of personal data, such as health data. Please do not include these in messages or uploads.
We use your data only for the purposes below, each with a legal basis under Article 6 GDPR.
| Purpose | Legal basis |
|---|---|
| Answering your question, request or project submission |
Steps at your request before a contract (Art. 6(1)(b)) or our legitimate interest in responding to enquiries (Art. 6(1)(f)) |
| Preparing quotes, delivering products, providing support and warranty |
Performance of a contract (Art. 6(1)(b)) |
| Scheduling and hosting test swims at the EVA Experience Center |
Steps at your request before a contract (Art. 6(1)(b)) |
| Assessing and managing partner and dealer relationships |
Performance of a contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)) |
| Managing leads and customer relationships in our CRM |
Legitimate interest in organised, efficient follow-up of business contacts (Art. 6(1)(f)) |
| Sending product news and updates to business contacts |
Legitimate interest for existing customers (Art. 6(1)(f)), otherwise your consent (Art. 6(1)(a)); you can opt out at any time |
| Invoicing and accounting | Legal obligation (Art. 6(1)(c)) |
| Website analytics and improvement | Your consent via the cookie banner (Art. 6(1)(a)) |
| Website security and preventing misuse, including spam protection on forms with Google reCAPTCHA |
Legitimate interest (Art. 6(1)(f)) |
Where we rely on consent, you can withdraw it at any time. This does not affect processing that took place before you withdrew. We do not use automated decision-making or profiling that has legal or similarly significant effects on you.
Forms on our website send your details automatically to our customer relationship management (CRM) system, which we use to follow up enquiries. This happens through a secure API connection between our website and the CRM system.
Our CRM provider acts as our processor under a data processing agreement. The provider may only process your data on our instructions and must keep it secure and confidential.
Our CRM data is stored in data centres within the European Economic Area (EEA). If the provider accesses data from outside the EEA, for example for support, section 6 explains how those transfers are protected.
e never sell your personal data. We share it only with the parties below, and only as far as needed.
| Recipient | Role | Why |
|---|---|---|
| CRM provider | Processor | CRM for managing enquiries, leads and customer contacts (section 4) |
| Hosting and IT service providers | Processor | Hosting our website and form submissions |
| Google (Google Tag Manager, reCAPTCHA, and analytics if you consent) |
Processor or independent controller |
Managing website scripts, protecting forms against spam, and measuring website use (section 7) |
| Vimeo | Independent controller | Playing videos embedded on our website |
| Email and office software providers | Processor | Sending and receiving email |
| EVA partners and dealers | Independent controller | Following up your request in your region, only when you ask for a partner or we tell you first |
| Carriers and installers | Independent controller | Delivering and installing products you ordered |
| Accountant and tax authorities | Independent controller | Meeting our legal and tax obligations |
We sign a data processing agreement with every processor. We may also disclose data when the law or a court order requires it.
We store your data within the European Economic Area (EEA) where possible. Some providers, such as our CRM provider and Google, may access or process data from countries outside the EEA, for example for support or maintenance.
We allow this only with appropriate safeguards: an EU adequacy decision (including the EU-US Data Privacy Framework for certified US companies) or the EU Standard Contractual Clauses with additional measures where needed. Contact us for a copy of the relevant safeguards.
We use functional cookies that our website needs to work. We place analytics and marketing cookies only after you agree in the cookie banner.
You can change or withdraw your consent at any time through the cookie settings link on our website or in your browser. See our cookie policy for the full list of cookies and retention periods.
We keep personal data no longer than needed for the purpose we collected it for, or than the law requires.
| Data | Retention period |
|---|---|
| Form entries stored on our website | 3 months after transfer to our CRM system, then deleted from the website |
| Leads in our CRM system that did not become customers | 2 years after our last contact |
| Customer and partner records in our CRM system | Duration of the relationship plus 2 years |
| Project drawings and files | Duration of the project plus 2 years, longer if needed for warranty |
| Invoices and accounting records | 7 years (Dutch fiscal retention obligation, Article 52 AWR) |
| Analytics data | Maximum 14 months |
After these periods we delete or anonymise the data.
We take appropriate technical and organisational measures to protect your data against loss and unauthorised access.
If a data breach occurs that poses a risk to you, we report it to the Dutch Data Protection Authority within 72 hours and inform you where required.
You have the following rights over your personal data:
Send your request to info@evaoptic.com. We may ask you to confirm your identity; please do not send a copy of your ID. We respond within one month.
You can also file a complaint with a data protection authority, in particular in the EU country where you live or work, or where the alleged infringement took place. Our lead authority is the Dutch Autoriteit Persoonsgegevens. We appreciate it if you contact us first so we can try to resolve it.
Our website and services are aimed at businesses and adults. We do not knowingly collect data from children under 16 without consent from a parent or guardian.
We may update this privacy policy when our services or the law change. The date at the top shows the latest version. We will inform customers directly of significant changes.
Questions about this policy? Contact EVA Optic B.V. at info@evaoptic.com or +31 (0)38 337 50 67.