1. Who we are
HEK bv (also trading as HEK automotive) is the controller for the processing of your personal data as described in this privacy statement. It applies to our website www.hekbv.nl and to our workshop services.
- HEK bv, Het Lentfert 80, 7547 SP Enschede, the Netherlands
- Chamber of Commerce (KvK) number: 06050380
- Email: info@hekbv.nl
- Phone: +31 53 431 88 18
HEK bv has not appointed a data protection officer, as this is not required for our business. For privacy questions, please contact info@hekbv.nl.
2. What data we process and why
We only process data that is needed for the purpose for which you provide it. Below, you can see for each situation which data is involved, what we use it for, the legal basis under the GDPR and how long we keep it.
Booking an appointment on the website
- Data: name, phone number, email address (optional), registration number, vehicle make and model, selected service, preferred date and your comments.
- Purpose: to schedule and confirm your appointment and to contact you about it.
- Legal basis: preparing and performing a contract with you.
- Retention: the request is deleted automatically after 6 months. If the appointment leads to an order, we keep the data with the work order (see below).
Contact by phone, email or WhatsApp
- Data: name, phone number or email address and the content of your message.
- Purpose: to answer your question and help you.
- Legal basis: performing a (future) contract, or our legitimate interest in answering questions.
- Retention: as long as needed to handle your question, up to 2 years, unless the message becomes part of an order or our records.
If you contact us via WhatsApp, WhatsApp (Meta) also processes data under its own terms and privacy policy. If you prefer not to use WhatsApp, please contact us by phone or email.
Work on your vehicle
- Data: name, address, phone number, email address, registration number, vehicle data (such as VIN and mileage), the work carried out and parts used, and invoice and payment details.
- Purpose: carrying out the order, preparing quotes and invoices, warranty and meeting legal obligations.
- Legal basis: performing the contract and legal obligations.
- Retention: we keep invoices and related records for 7 years, as required by Dutch tax law. Other data is kept as long as needed for warranty and service.
Tachographs and SCM inspections
- Data: vehicle and tachograph data, such as registration number and VIN. A calibration certificate contains the data required by law; in most cases this is only the business address of the owner or user. An SCM certificate only shows the registration number and VIN, no name or address.
- Purpose: installing, calibrating and repairing tachographs, and issuing certificates.
- Legal basis: legal obligations and performing the contract.
- Retention: as long as laws and regulations require.
When we download tachograph or driver card data on behalf of a transport company, we do so for that company. The transport company is then the controller for this data; we only process it on its instructions.
Online vehicle status
- Data: registration number, work order number and the status of the work. If you choose, also your email address or phone number, so that we can let you know your vehicle is ready.
- Purpose: showing you online how far we are with your vehicle.
- Legal basis: performing the contract.
- Retention: the status is deleted automatically 7 days after the work is completed, and after 120 days at the latest.
The status can only be viewed with the combination of registration number and work order number. It contains no names or addresses.
Job applications
- Data: the information in your cover letter and CV, and anything else you tell us about yourself.
- Purpose: assessing your application.
- Legal basis: preparing an employment contract.
- Retention: up to 4 weeks after the application procedure ends. With your consent, we keep your data for up to 1 year in case a suitable vacancy arises later.
Camera surveillance
- Data: camera footage of our premises and workshop, which may show visitors, vehicles and registration numbers.
- Purpose: protecting our business, our employees and our customers' vehicles, and preventing and recording theft, burglary and damage.
- Legal basis: our legitimate interest in protecting people and property.
- Retention: up to 4 weeks. In the event of an incident, we keep the relevant footage until the incident has been dealt with, and we may share it with the police or an insurer.
Signs indicate where cameras are in use. Only authorised persons can view the footage.
Visiting our website
- Data: your IP address and technical data from your browser.
- Purpose: running and securing the website and preventing misuse of forms.
- Legal basis: our legitimate interest in a secure, working website.
- Retention: to prevent misuse of forms, we keep your IP address for up to 1 hour. Our hosting provider briefly processes technical data for security.
3. Cookies and similar technologies
Our website does not place cookies and does not use analytics or tracking services. No advertising or social media cookies are placed either, so we do not ask for cookie consent. Fonts and images are loaded from our own website, so no data is sent to other parties when you visit.
Our website does contain links to WhatsApp, Google Maps (directions), Facebook, Instagram, YouTube and our online shops, among others. If you click such a link, you go to that party's website or app, and its privacy rules apply.
4. Who we share your data with
We never sell your data. We only share it when this is necessary to provide our services or when the law requires it:
- Service providers that process data for us (processors): our hosting and security provider (Cloudflare), our email provider (Strato), the service that sends emails about your vehicle status, and the suppliers of our workshop and accounting software. We have agreements with them on security and confidentiality.
- Organisations where this is legally required or needed for the order: such as the RDW (Netherlands Vehicle Authority) when registering tachographs, the certification body for SCM inspections, manufacturers and suppliers for warranty claims, and our accountant.
- Government: if we are legally required to, for example at the request of the tax authorities or the police.
5. Data outside the European Union
Some service providers, such as Cloudflare and WhatsApp (Meta), are US companies and may also process data outside the European Union. This only happens with the safeguards required by the GDPR, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
6. Automated decision-making
HEK bv does not make decisions about you that are taken solely by a computer. An employee is always involved in any decision about you.
7. How we protect your data
We take appropriate measures against misuse, loss and unauthorised access. Our website uses a secure connection (https), our admin and work order systems are protected with passwords and additional access controls, and only employees who need the data for their work have access. If you believe your data is not properly secured or has been misused, please contact us immediately at info@hekbv.nl.
8. Your rights
You have the right to:
- access your data;
- have incorrect data corrected;
- have your data deleted, if we are no longer legally required to keep it;
- restrict processing;
- object to processing based on our legitimate interest;
- receive your data in a common file format or have it sent to another party (data portability);
- withdraw any consent you have given at any time.
Send your request to info@hekbv.nl. We will respond within one month. To make sure the request comes from you, we verify your identity using data we already hold, for example by calling or emailing you back on a known number or address. We do not routinely ask for a copy of your ID. If this is exceptionally necessary, we will ask you to cover your photo, citizen service number (BSN) and document number.
9. Complaints
If you are not satisfied with how we handle your data, please let us know first; we are happy to resolve it with you. You also always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl, or with the supervisory authority in your own country.
10. Children
Our website and services are not intended for children under 16. We do not knowingly process data of children without the consent of a parent or guardian. If you believe this has happened, please contact us and we will delete the data.
11. Changes
We may update this privacy statement, for example when our services or the law change. The latest version is always on this page. The date of the last change is shown at the top.