1. Introduction

Kooij B.V., registered at Kanonnenloods 24, 1505 RX Zaandam, the Netherlands (Chamber of Commerce / KvK: 76900576; VAT / BTW: NL860832259B01; EORI: NL860832259), hereinafter referred to as 'Kooij', 'we', 'us', or 'our', is a collectible design studio producing furniture and lighting from recycled materials.

​

Kooij is the controller of personal data processed in connection with its website, sales activities, trade programme, and employment administration, as described in this Privacy Policy.

​

We are committed to protecting the privacy of our website visitors, clients, trade partners, and employees, and to processing all personal data in full compliance with Regulation (EU) 2016/679 (the General Data Protection Regulation, 'GDPR'), the Uitvoeringswet AVG ('UAVG'), and all other applicable Dutch legislation.

​

Please note that our website is not intended for use by persons under the age of 16. We do not knowingly collect personal data from minors.

​

If you do not provide us with personal data that is necessary for the performance of a contract or the fulfilment of a legal obligation, we may be unable to deliver the requested products or services.

Questions regarding this Policy may be directed to:

​

Kooij B.V.

Kanonnenloods 24, 1505 RX Zaandam, the Netherlands

E-mail: office@kooij.com

Website: kooij.com

​

2. Scope of This Policy

​

This Privacy Policy applies to the processing of personal data of:

• Visitors to our website kooij.com

• Clients and prospective clients who request quotations, proforma invoices, or place orders

• Trade programme applicants and registered design professionals

• Newsletter subscribers (once this service is introduced)

• Job applicants

• Current and former employees

​

This Policy does not apply to third-party websites to which our website may contain links. We recommend that you review the privacy policies of any such third-party websites independently.

​

3. Personal Data We Collect and Process

​

3.1 Website visitors

​

Our website is hosted on and operated through the Odoo platform. In the ordinary course of operating our website and webshop, Odoo may process technical data including IP addresses, browser type 

and version, and session identifiers. This processing is carried out for the purpose of ensuring the stable and secure operation of our website.

We do not use Google Analytics, advertising networks, remarketing pixels, or any other third-party analytical or marketing tracking services. We do not engage in profiling of website visitors.

Where the Odoo platform places cookies on your device, these are strictly functional and technically necessary cookies required for the website and webshop to operate correctly (for example, to maintain a session). We do not place analytical or marketing cookies. A full cookie inventory will be confirmed and published following our new website launch; this section will be updated accordingly. Where any non-essential cookies are identified, we will request your prior consent in accordance with the Telecommunicatiewet and the GDPR before placing them.

​

3.2 Quotations, orders, and invoicing

​

When you request a quotation, place an order, or enter into a sales transaction with Kooij (whether via our website webshop or by email), we collect and process the following personal data:

• Full name and company name

• Business and delivery address

• Email address and telephone number

• Order details, product specifications, and correspondence

• Invoicing and payment information

​

This data is managed within Odoo, which we use as our integrated ERP, sales, and webshop platform. Odoo is used to generate quotations, proforma invoices, and final invoices.

​

3.3 Trade programme

​

Design professionals and trade buyers may apply for our trade programme in order to access preferential pricing. For this purpose we collect and process:

• Company name and trading name

• Business address

• Website & social media URL(s)

• VAT / tax identification number

• Contact person's name and email address

​

This information is processed exclusively to verify eligibility for the trade programme and to administer the trade account within Odoo. It is not shared with third parties for commercial or marketing purposes.

​

3.4 Newsletter (planned feature)

​

We intend to introduce an email newsletter in the future. No newsletter is currently active. When this feature is launched, we will update this Privacy Policy in advance to set out the relevant processing activities, legal basis, data categories, and unsubscribe mechanism. Subscription will be based on freely given, specific, and informed consent.

​

3.5 Job applications

​

We occasionally recruit via Indeed, where applicants submit data directly on the Indeed platform, subject to Indeed's own privacy policy. On rare occasions we also receive unsolicited applications by email. In both cases we process the personal data provided by the applicant (such as name, contact details, CV, and motivation letter) solely for the purposes of the relevant recruitment process.

​

3.6 Employees

​

We maintain an HR portal for the administration of employment relationships with current and former employees. Employee personal data is processed in accordance with Dutch employment law and for the purposes of payroll, HR administration, and compliance.

​

4. Legal Basis for Processing

​

All personal data processed by Kooij is processed on one or more of the following legal bases under Article 6 of the GDPR:

​

Performance of a contract (Art. 6(1)(b) GDPR)

Processing that is necessary to prepare or execute a sales agreement, issue a quotation or invoice, manage a trade account, or fulfil an order. Where you do not provide the necessary data, we may be unable to perform the contract.

​

Compliance with a legal obligation (Art. 6(1)(c) GDPR)

Processing required to comply with applicable Dutch and EU law, including fiscal record-keeping obligations under the Algemene wet inzake rijksbelastingen (AWR) and applicable labour and employment legislation..

​

Legitimate interests (Art. 6(1)(f) GDPR)

Processing carried out in the legitimate interests of Kooij, including client relationship management, the prevention of fraud and misuse, IT and network security, dispute resolution, and the efficient administration of our business. We conduct a balancing test to ensure that our legitimate interests do not override the interests or fundamental rights of the data subject.

​

Consent (Art. 6(1)(a) GDPR)

Where processing is based on your consent (for example, newsletter subscriptions or other direct marketing activities), consent is obtained freely, specifically, and informed. You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

​

5. Retention Periods

​

We do not retain personal data for longer than is necessary for the purposes for which it was collected, or for longer than required by applicable law. After the relevant retention period expires, data is securely deleted or anonymised. The following indicative retention periods apply:

​

Financial and transactional records (quotations, invoices, orders)

Retained for seven years from the end of the financial year in which the transaction occurred, in accordance with the fiscal record-keeping obligation under Article 52 AWR.

​

Trade programme accounts

Retained for the duration of the trade relationship and for a reasonable period thereafter to manage any outstanding queries, disputes, or warranty matters.

​

Job applications (unsuccessful)

Retained for a maximum of four weeks following notification of the outcome. With explicit consent, retained for up to twelve months for future consideration. Withdrawn applications are deleted within four weeks of withdrawal.

​

Employee records

Retained in accordance with applicable Dutch employment, tax, and social security legislation, which may require retention for up to seven years following the end of the employment relationship.

​

Website technical data and session logs

Retained in accordance with Odoo platform defaults; typically limited to active session duration or short-term operational logs.

​

Newsletter subscriber data

Retained until the subscriber unsubscribes or withdraws consent (once the newsletter is active). Will not be retained beyond one year following the last active communication if no re-confirmation of consent is obtained.

​

6. Sharing of Personal Data

​

Kooij does not sell, rent, or otherwise make personal data available to third parties for monetary or other consideration.

​

We may share personal data with the following categories of recipients, strictly to the extent necessary for the purposes set out in this Policy:

​

• Odoo S.A. / Odoo B.V.: as the provider of our ERP, webshop, and website hosting platform, acting as a data processor on our behalf pursuant to a data processing agreement.

• Pay.nl (Pay.nl B.V): as our payment service provider, processing payment transaction data (such as name, billing address, and payment details) on our behalf for the purpose of processing payments for our webshop orders. Pay.nl acts as a data processor under a processor agreement and is itself subject to applicable financial regulation.

• Shipping and logistics providers: name, address, and order data shared to the extent necessary to fulfil and deliver orders (such as name, address and order details).

• Accountant and tax advisor: financial and transactional data disclosed for the purpose of statutory accounting, invoicing and tax compliance.

• HR  and recruitment service providers: employee data processed on our behalf for HR administration purposes and candidate date for the administration of job applications.

• Competent authorities: personal data disclosed only where disclosure is required by law, court order, or other lawful request from a regulatory or enforcement authority, including Dutch Tax and Customs Administration( Belastingdienst).

​

All third-party processors are contractually bound to process personal data solely on our documented instructions and to implement appropriate technical and organisational security measures.

Where personal data is transferred to a recipient located outside the European Economic Area (EEA), Kooij ensures that an adequate level of protection is maintained by means of appropriate safeguards, including Standard Contractual Clauses (SCCs) as approved by the European Commission under Article 46 GDPR.

​

7. Security of Personal Data

​

Kooij implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include, but are not limited to:

​

• Encrypted communications via HTTPS for all website and webshop transactions

• Access controls ensuring that personal data is accessible only to employees who require it for their role

• Contractual confidentiality and security obligations imposed on all third-party processors

• Regular review of our IT infrastructure and security posture

• Secure data transfer protocols for inter-system communication

​

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, Kooij will notify the Autoriteit Persoonsgegevens (AP) within 72 hours of becoming aware of the breach, in accordance with Article 33 GDPR. Where the breach is likely to result in a high risk to the rights and freedoms of affected individuals, those individuals will also be notified without undue delay, in accordance with Article 34 GDPR.

If you become aware of or suspect a security incident or personal data breach involving Kooij, please notify us immediately at office@kooij.com.

​

8. Your Rights

​

As a data subject under the GDPR, you have the following rights in relation to the personal data we hold about you:

​

Right of access (Art. 15 GDPR)

You have the right to obtain confirmation of whether we process personal data concerning you and, if so, to receive a copy of that data together with information on the purposes, categories, recipients, and retention periods applicable to such processing.

​

Right to rectification (Art. 16 GDPR)

You have the right to request the correction of inaccurate personal data and the completion of incomplete personal data without undue delay.

​

Right to erasure (Art. 17 GDPR)

You have the right to request the deletion of your personal data where: (i) the data is no longer necessary for the purposes for which it was collected; (ii) you withdraw consent and there is no other legal basis for processing; (iii) you object to processing and there are no overriding legitimate grounds; (iv) the data has been unlawfully processed; or (v) erasure is required to comply with a legal obligation. We reserve the right to decline erasure requests where processing is required for compliance with a legal obligation or the establishment, exercise, or defence of legal claims.

​

Right to restriction of processing (Art. 18 GDPR)

You have the right to request restriction of processing where: (i) you contest the accuracy of the data, pending verification; (ii) the processing is unlawful and you prefer restriction over erasure; (iii) we no longer require the data for processing purposes, but you require it for the establishment, exercise, or defence of legal claims; or (iv) you have objected to processing pending verification of whether our legitimate grounds override yours.

​

Right to data portability (Art. 20 GDPR)

Where processing is based on consent or on the performance of a contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller. Where technically feasible, we will transmit the data directly on your request.

​

Right to object (Art. 21 GDPR)

You have the right to object at any time to the processing of your personal data where that processing is based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless the processing is necessary for the establishment, exercise, or defence of legal claims.

​

Right to withdraw consent

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

​

Right not to be subject to automated decision-making

Kooij does not carry out automated decision-making, including profiling, that produces legal or similarly significant effects in relation to data subjects.

​

To exercise any of the above rights, please submit a written request to office@kooij.com, stating clearly which right you wish to exercise and providing sufficient information to identify yourself. We will respond to your request within one calendar month of receipt. Where a request is complex or numerous, we may extend this period by a further two months, in which case we will notify you within the initial one-month period.

We reserve the right to verify your identity before fulfilling any request and to charge a reasonable administrative fee where requests are manifestly unfounded or excessive.

You will not be subject to any discrimination as a result of exercising your rights under the GDPR.

If you have a concern about our privacy practices, we encourage you to contact us first so that we may endeavour to resolve the matter directly. You also have the right at any time to lodge a complaint with the competent supervisory authority:

​

Autoriteit Persoonsgegevens (AP)

P.O. Box 93374, 2509 AJ The Hague, the Netherlands

Telephone: +31 70 888 85 00

Website: www.autoriteitpersoonsgegevens.nl

​

9. Cookies

​

Our website is built and hosted on the Odoo platform. Odoo may place technically necessary cookies on your device that are strictly required for the website and webshop to function correctly (for example, to maintain a user session during a visit). These cookies do not track your behaviour across other websites and are not used for analytical or marketing purposes.

We do not use Google Analytics, advertising cookies, remarketing cookies, social media tracking pixels, or any other non-essential cookies.

We are currently conducting a full cookie inventory in connection with our new website launch and will update this section upon completion. Where any non-essential cookies are identified, we will obtain your prior, freely given consent before placing them, in accordance with Article 11.7a of the Telecommunicatiewet and the GDPR.

You may at any time adjust your cookie preferences through your browser settings or delete cookies already stored on your device. Please note that disabling functional cookies may affect the correct operation of certain features of our website.

​

10. Links to Third-Party Websites

​

Our website may contain hyperlinks to the websites of third parties, including resellers, design platforms, or partner organisations. Kooij exercises care in selecting such links; however, we have no control over and accept no responsibility for the content, privacy practices, or security measures of third-party websites. We recommend that you review the privacy policy of any third-party website you visit via a link on our website.

​

11. Amendments to This Policy

​

Kooij reserves the right to amend this Privacy Policy at any time in response to changes in applicable law, new processing activities, or other relevant developments. The current and most recent version of this Policy will always be published on our website, together with the date of the last amendment.

Where amendments are material, we will take reasonable steps to draw them to your attention. In particular, we will update this Policy prior to the introduction of any newsletter service and prior to any significant change in our processing activities.

​

12. Contact

​

For any questions, comments, or requests relating to this Privacy Policy or to the processing of your personal data by Kooij B.V., please contact us at:

​

Kooij B.V.

Kanonnenloods 24

Zaandam, the Netherlands

E-mail: office@kooij.com

Website: kooij.com

​

We aim to respond to all privacy-related requests as soon as possible and in any event within the timeframes required under applicable data protection law.

​