Privacy Statement - Golden Arrow

PRIVACY STATEMENT GOLDEN ARROW

This is the Privacy Statement of ACT Commodities Group B.V., established at Strawinsklylaan 3127 (1077 ZX) in Amsterdam, the Netherlands. ACT Commodities Group B.V. is also the controller in respect of the processing of personal data by its affiliates and subsidiaries, which are also established at the above address. The companies are hereinafter jointly referred to as: “ACT Commodities”; personal data is shared between these group companies.

This Privacy Statement sets out how we handle personal data, which we do with all possible care. This Privacy Notice applies to the processing of personal data of our clients, prospective clients, applicants, and other people who visit our website or contact us.

If, after reading this Privacy Notice, you have any questions about how we handle your personal data, or if you wish to exercise your rights under the General Data Protection Regulation (“GDPR”) mentioned in this Privacy Statement, or under any other data protection legislation, or if you wish to make a complaint about our use of your personal data, you may contact us at telephone number +31(0)20-2199268 or by email at HStrikwerda@actcommodities.com. If you are not satisfied about the way we have handled your complaint, or if you prefer not to make your complaint to us, you may also submit a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), via the website autoriteitpersoonsgegevens.nl.

Which personal data do we process, for what purpose and on what legal basis?

Personal data of (contacts at) clients

We process the contact details (name, company name, phone number, email) of our contacts at our clients to execute orders for our clients, and to contact these people in the context thereof. We also use these details to bill our activities. The legal basis for this is that the data are necessary to perform the contract concluded with the client.

We also use the clients’ contact details in connection with relationship management, for instance to send Christmas cards or birthday wishes. For this purpose, we may also process the date of birth of our clients’ contact persons. This processing is necessary in view of ACT Commodities’ legitimate interest to maintain a good relationship with its clients.

Finally, we use the clients’ contact details to conduct customer satisfaction surveys from time to time. Naturally, clients are not obliged to participate in such surveys. This processing is necessary in view of ACT Commodities’ legitimate interest to improve its services.

Recording conversations in the trading room

We record telephone conversations made in the trading room and made by the operations team of our Fuels department with contacts of clients in order to register proof of trades and to improve our services. This processing is necessary in view of ACT Commodities’ legitimate interest to be able to prove that an order was given for the transaction and to ensure the transparency of our communication with the clients.

Personal data of prospects

We process the contact details (name, company name, telephone number, email) of contacts at prospective and former clients to contact them in order to offer our services to them, and to send them holiday wishes. We process this personal data in view of our legitimate interest to perform our activities and to obtain new orders. We also make use of publicly available sources to obtain the contact details of prospects. We do not send unsolicited commercial communications by email without the explicit consent of the intended recipient.

Contact

If we are contacted via the contact form on our website, by email, social media or telephone, we process the data that is provided to us. This typically includes the name, email and telephone number and the content of the contact (e.g. a question). We use this information, where relevant, to contact the person concerned, for instance to answer a question. We may add this data to our prospects’ files (please see above). We process this personal data in view of our legitimate interest to perform our activities and to obtain new orders.

Recruitment and application procedures

We process the personal data provided to us by prospective employees or obtained from a recruitment agency or via Linkedin. This may include name, address, email, telephone number, CV and all information it contains (including information about education and previous experience) and information posted on Linkedin.

If an applicant is invited for an interview, we process, in addition to the information mentioned above, all other information the applicant provides us with. This may include information about education, work experience and references.

For the purpose of the second round of the application procedure we may process data from a personality test, and data concerning motivation, talent and competences in order to decide whether the applicant would fit in with the organization.

During the final phase of the application procedure, we may instruct an external agency to screen the applicant within the context of an integrity review. Obtaining a Certificate of Conduct (Verklaring Omtrent het Gedrag) is part of this screening. We only conduct the screening if this is necessary for the position concerned. The screening is highly secure and is conducted with all possible care and consideration.

The legal basis for processing personal data within the context of recruitment and application procedures is that this processing is a necessary step to enter into an agreement, and in view of ACT Commodities’ legitimate interest to recruit and hire new staff.

Visitors of the website

Finally, we process information about the visitors of our website (or rather about their computer), by placing cookies every time they visit our website. The legal basis for this is the consent we ask each visitor upon their first visit to our website. You may withdraw this consent at any time. Please see our cookie statement for more information about the cookies we place.

How long do we keep your personal data?

Personal data of clients and their contacts

As a rule, we keep the personal data of our contact persons at clients for two years after the final transaction with that client is completed. We keep our administration, including invoices and other documents that include the personal data of parties, for a period of seven years after the end of the financial year, in order to comply with our statutory retention obligation for tax purposes.

Recordings of conversations in the trading room

The recordings of conversations in the trading room are kept until the information is no longer required, usually once the trades are closed.

Personal data of prospects

The personal data of prospects is deleted at the request of the data subject, or ultimately one year after the final communication with the person concerned.

Other contact details

We keep other contact details for one year after the final contact, or until you submit a request to us to delete them.

Recruitment and application procedures

Information about applicants that are not hired are kept for a period of one year after the end of the application procedure. This term is necessary for us to evaluate the applicant’s application, to create a talent pool which is of great value to us and to possibly contact the applicant about future opportunities consistent with this policy.

With whom do we share your data?

We share personal data with other group entities. Where necessary, we may also share personal data with our group entities who are located outside the EEA. We have concluded a model agreement with our group entities based on the standard contract clauses approved by the European Commission in Commission Decision of 4 June 2021 (EC 2021/914C) and other applicable laws.

Personal data is stored electronically and may be included in emails we send or receive and is consequently stored (and processed) by our ICT providers. We have concluded data processing agreements with these providers that stipulate at least the same level of security and reliability that you may expect from ourselves.

Our accountant may have access to the personal data of contact persons at clients. We may also share this data with firms that conduct customer satisfaction surveys for us.

We may also share the data of contact persons at clients with third parties where this is necessary in order to execute your order. We may for instance share your data with sellers and regulators.

Recruitment and application data is stored in our recruitment software from Greenhouse Software, Inc., a cloud services provider located in the United States of America and engaged by ACT to help manage its recruitment and hiring process on ACT’s behalf. Accordingly, if the applicant is located outside of the United States, the personal data will be transferred to the United States. We have concluded a data processing agreement with that party. Because the European Union Commission has determined that United States data privacy laws do not ensure an adequate level of protection for personal data collected from EU data subjects, the transfer will be subject to appropriate additional safeguards under the standard contractual clauses. When an applicant proceeds to the next phase in the application procedure, his/her personal data may also be shared with an assessment agency and if necessary, and in consultation, with CV-OK, the agency that conducts screenings for us. CV-OK has a license from the Dutch Data Protection Authority.

The data collected via cookies is processed by the providers of those cookies. Please see our cookie statement for more information.

Apart from the situations mentioned above, we do not share personal data with third parties, unless we are obliged to provide certain data under the applicable laws or regulations, for instance to the police under a warrant.

How is your data protected?

We have adopted a strict security policy, including appropriate technical and organizational measurements, to protect your personal data against loss, abuse and unauthorised access by third parties. We apply strict access authorization, both offline and online, and our servers are regularly backed up, and our connections are secure. Our servers are installed in the Netherlands.

What are your rights?

You have the following rights:

the right to access your personal data and to receive a copy thereof.
the right to have your personal data rectified if they are incorrect or incomplete.
the right to object to the processing and/or (in certain circumstances) to restrict the processing of your personal data.
in certain circumstances, the right to have your personal data erased (‘right to be forgotten’).
the right to receive your personal data in a structured, commonly used and machine-readable form and to transmit that data to another controller.

For more information about these rights and when you may exercise them, see Articles 15 – 20 of the GDPR.

You may exercise your rights by contacting us via the email or telephone number mentioned at the beginning of this Privacy Statement.

Changes

Sometimes changes may occur in the personal data we process or in the applicable legislation. In that event we may amend this Privacy Notice. In the event of major changes, we will post an announcement on the website or inform you of those changes by email.

Version October 2022