Privacy statement Orion

Orion Complex Fleets B.V. (such as its subsidiary ‘OrionPartners B.V.’ and the trade names ‘Orion Fleet Management’, ‘OrionGrip’, ‘BusPartners’, WastePartners’ and AirportPartners’), hereinafter referred to as ‘ORION’, considers the protection of personal data to be essential. We therefore process your data with the greatest possible care.

This privacy statement illustrates how we deal with personal data.

1. Who is responsible for processing your data?
In this privacy statement, Orion Complex Fleets B.V. (hereinafter: “ORION or “we”) describes how, in its capacity as a data controller, it handles your personal data.

2. What is personal data?
Personal data is information about an identified or identifiable natural person. Whether certain information should be qualified as personal data partly depends on whether ORION has the legal means that it may reasonably be expected to use to identify a data subject. For example, we also consider your registration number and chassis number to be personal data.

3. Personal data that we process
We process personal data about you because you provide us with data when you enter into an agreement with us, but also when you use our services and in that way provide us with data or enable us to record data about your interests and preferences.

Data provided to us
When you enter into an agreement with ORION, we ask you to provide us with the following personal data:

• name and address;
• contact details (telephone numbers, email addresses);
• gender;
• customer number(s);
• financial data (bank account information, quotes, invoices);
• number ID document and citizen service number (where applicable).

In addition, ORION processes the following data as part of the performance of an agreement with you or the provision of a service to you, which may qualify as personal data:

• chassis number and model;
• technical data;
• registration numbers;
• maintenance history;
• ownership history of your vehicle (registration data);
• other data relevant to the agreement in question.

Information about your use of our services and/or products
When you use ORION’s services or come in contact with us in another way, in the context of our services (depending on exactly how you use them) we process the following information that can be regarded as personal data:

• data related to your device, such as a MAC address, IP address or other number;
• your communication preferences and settings;
• data that we link to certain patterns, such as a status in the profile that we create about you based on your consumption behaviour (for example, the frequency with which you make a purchase or use a service);
• browsing behaviour, based on our own observations or on cookies (see also Article 9 of this privacy statement);
• customer satisfaction data;
• data about your use of Customer Care.

4. We do not process the personal data of persons under the age of 16
It is not our intention to collect data from website visitors under the age of 16. We advise parents to be aware of the online activities of their children in order to prevent ORION from processing their personal data.

5. Processing: principles and legitimate interests
Personal data is processed on the basis of the following principles in Article 6 of the General Data Protection Regulation:

1. Permission
2. Implementation of an agreement with you
3. Legal obligation
4. Performance of a task in the public interest
5. Legitimate interest of ORION or a third party

Legitimate interests include marketing, advertising, security, (crime) prevention, IT management, research and analysis of our own products or services, business management, legal affairs, internal management.

6. Purposes for processing personal data
ORION processes your personal data for the purposes stated below. The number after each objective corresponds to the principle stipulated in Article 5 of this privacy statement.

• Building and maintaining the customer relationship, including maintaining a direct relationship between the responsible party and the related financial service providers – among other things, for commercial purposes [principle: 2, 5].
• Handling orders (such as invoicing), processing in a financial accounting administration and logistic handling [principle: 2, 5].
• Providing customer service (including service related to the purchase of services and products), fulfilling warranty obligations and product withdrawals for our own services, handling complaints and requests [principle: 2, 3, 4 or 5].
• Maintaining communications in certain cases in order to proactively contact users in relation to vehicle defects or malfunctions or to schedule service appointments, including facilitating mobility services [principle: 2 or 5].
• Conducting market research to improve our business, brands, services and products [principle: 5].
• Communicating with those involved and offering a loyalty programme [principle: 1 or 5].
• Contacting you with special offers or other commercial information. You always have the option to opt out by withdrawing your consent. All of our communication includes information about how you can do this [principle: 1 or 5].
• Improving the content of our communication by tailoring it to your personal preferences [principle: 5].
• Developing and improving new and existing products and services [principle: 5].
• Measuring customer satisfaction, supplying management information and determining the overall business strategy [principle: 1 or 5].
• Organising events for data analysis purposes in order to improve or develop products or services, where participants in these events work with personal data in (pseudo) anonymous format – not directly traceable to you as a natural person – insofar as this is permitted under applicable law [principle: 5].
• Providing services on the internet and by means of app functions, including relevant commercial messages in these apps [principle: 1, 2 or 5].
• Complying with legal obligations, resolving disputes and upholding our rights and agreements [principle: 3, 4 or 5].
• Improving data quality by means of address validation techniques [principle: 5].
• Linking and analysing cookies from our websites to customer data known to us. We do this to tailor the content of our communication as closely as possible to your personal preferences [principle: 1 or 5].
• Being able to offer a test drive or otherwise making a vehicle temporarily available. We can ask you to identify yourself with a valid identity document and/or, where necessary, we make a protected copy of your driving licence or identity card/passport for the duration of your use of the vehicle + 2 months. We do this to establish your identity and to make it possible to notify the authorities if there is a suspicion of theft or demonstrable damage or misconduct. [principle: 2].

7. Sharing with third parties
ORION shares your personal data with third parties in the following cases, among others, and with the associated reasons. The number behind each objective corresponds with the basis stipulated in Article 5 of this privacy statement:

• with affiliated financial service providers aimed at providing related financial services [principle: 2];
• with authorised dealers or service partners from the ORION distribution network [principle: 1, 2 or 5]
• when we are legally obliged or authorised to provide personal data to third parties [principle: 3]
• when we suspect violations of the rights of third parties, criminal offences or abuse, we may provide personal data to third parties with a legitimate interest or to bodies that serve the public interest. This can include enforcement authorities such as the Public Prosecution Service or regulators [principle: 3, 4 or 5];
• ORION may also share your data with other business units in the ORION group for the performance of an agreement with you or for legitimate business interests, such as conducting central administration or providing customer service and analysing our services to you [principle: 5].
• with parties that assist ORION with its services and are not processors (such as accountants and (legal) advisers) [principle: 5];
• for commercial purposes (such as buy-ins/buy-outs or the sale of shares or a reorganisation) [principle: 5].

ORION also uses services from third parties that act as ‘processors’ (for example, hosting service providers, mobility service providers and research firms) for the purpose of conducting market research or customer satisfaction surveys. These service providers only process personal data in accordance with the instructions and under the control of ORION.

When personal data is sent to a recipient abroad, this usually only involves a recipient in a country that offers an appropriate level of protection for personal data according to the European Commission. If personal data is sent to a recipient in a country that does not offer an adequate level of protection, ORION will ensure that the statutory safeguards are in place. If you wish to receive further information about the transfer of your personal data to countries outside the European Economic Area, you can contact the ORION privacy officer (see Article 12).

8. How long we retain data
We retain personal data in accordance with our internal data retention policy and/or as long as (i) you are an ORION customer or continue to show an interest in ORION’s services, (ii) we are legally obliged to retain data, or (iii) we have good grounds believe that we are allowed to keep data insofar as is necessary.

9.Mapping website visits
When you visit or use our websites, services, applications, communication services (such as e-mail) and tools, we can use cookies, web beacons and other similar technologies to store information with the aim of personalising advertisements and giving you a better, faster and more secure customer experience. If you do not want cookies, you can refuse them. For more details about the use of cookies, we refer you to our cookie statement.

10. Your rights, including the right to object
You have the right to know which personal data we have recorded about you and to whom we have provided your personal data. o obtain this information, you can contact us through customer service. ORION will make every effort to respond within the statutory period. Excessive requests may be rejected by us.

Besides the right of access, you have the following rights with regard to our processing of your personal data:

• the right to withdraw your consent, insofar as our processing of your personal data is based on that consent;
• the right to submit a complaint to the Dutch Data Protection Authority;
• the right to have your personal data rectified or corrected;
• the right to have your personal data deleted;
• the right to restrict the processing that is relevant to you;
• the right to data portability;
• the absolute right to object to direct marketing;
• the right to object to processing activities that take place on the basis of the legitimate interests of ORION or a third party (depending on your personal circumstances).

You can only exercise your rights to the extent that the law grants you these rights. To ensure that the request for access was made by you, we ask that you enclose a copy of your identity document with this request. We also ask that the passport photo, MRZ (machine readable zone; the strip with numbers at the bottom of the passport), passport number and Citizen Service Number (BSN) be made unrecognisable on this copy.

11. Security and protection of data
ORION takes the appropriate security measures to prevent the misuse, loss, unauthorised access, unwanted disclosure and unauthorised modification of your personal data as much as possible. ORION has taken both technical and organisational measures to protect your personal data. These security measures are periodically reviewed on the basis of threats.

12. Contact
For questions and/or comments in relation to this privacy statement, please contact:

ORION
Attn.: “Privacy Officer”
Nijverheidsweg 50
3771 ME BARNEVELD
[email protected]

13. Modifications
Modifications can made to the way we process personal data and to the composition or the volume of data we process. For this reason, we reserve the right to adapt this privacy statement. Where necessary, you will be notified of any modifications. In this Privacy Statement, the last modification date is always specified. Last modification:

— Contact details

This statement was last revised on 10/24/2018 01-08-2021.