Privacy statement

Odin QHSE B.V. respects your privacy. This statement explains which personal data we process via this website and in our services, why, for how long, and what rights you have. We process personal data in line with the General Data Protection Regulation (GDPR) and the Dutch implementation act.

Data controller

The data controller under the GDPR is:

Odin QHSE B.V.
Pastoriestraat 1
3195 HT Pernis Rotterdam, the Netherlands
Dutch Chamber of Commerce: 42015253
Phone: +31 6 23 66 08 42

What data we process

Depending on how you interact with our website, we process the following categories of personal data:

• Contact details: name, email, phone number and the content of your message when you fill in the contact form.
• Application data: name, email, phone number, motivation and, when provided, your CV when you apply for a vacancy.
• Quick scan: your answers in the QHSE quick scan are not stored on the website. If you ask for the report by email or for a call with a consultant, we receive your email address, your answers and, if you fill them in, your name, company and phone number by email. We keep these as a request. The report (PDF) is generated on our own server and sent to you straight away; we do not keep a copy.
• Technical data: standard server log data (IP address, browser type and timestamp) briefly retained by our hosting provider for security and error diagnostics. Usage statistics (Google Analytics 4) are processed only after your consent and with anonymised IP.
• Cookie preferences: the choice you make in our cookie banner.

Purposes

• Responding to questions and requests submitted through the contact form.
• Handling job applications and staying in touch about the vacancy.
• Sending you the QHSE quick scan report and contacting you about it once by email, or arranging a call about your result.
• Securing the website against abuse, fraud and attacks (using Google reCAPTCHA).
• Improving the website based on anonymous usage statistics (only with your consent).
• Complying with legal obligations.

Legal basis

We process your data based on your consent (cookie preferences, the quick scan report by email), the performance of a contract or pre-contractual step (contact form, applications, a call about the quick scan), our legitimate interest (security), and, where applicable, a legal obligation.

Business relations and assignments

Besides the data you leave on this website, we process personal data in our work as a consultancy and secondment firm. For that data we are the controller:

• Contacts at clients, prospects and suppliers: name, job title, business contact details, our correspondence, appointments, proposals and invoices.
• Employees of our clients we meet during an assignment: name and job title in reports, training attendance lists, interview notes and incident investigations, only as far as the assignment requires.
• Professionals and candidates: CV, certificates and business details of the employees and contractors we deploy or put forward for an assignment.

We use this data to carry out the assignment, to manage the relationship and prepare proposals, for invoicing and administration, to evaluate our services for quality and certification purposes, and to meet legal obligations. The legal basis is the performance of the contract, our legitimate interest in running our business, and, where applicable, a legal obligation. Within Odin QHSE, each team member only has access to the data their role requires; this is defined per role. We do not make decisions with legal effects for you based solely on automated processing. Where we process personal data on a client's instructions, for example in our SIA platform, we act as a processor and enter into a data processing agreement; see also articles 15 and 16 of our general terms and conditions.

Retention periods

We do not keep your personal data longer than necessary for the purposes for which it was collected or as required by law. Concrete retention periods per data category are set out in our internal retention procedure. Want to know how long we keep specific data about you? Get in touch via our contact form.

Recipients and processors

We do not share your data with third parties unless it is necessary for our services or to comply with the law. We work with the following processors:

• Laravel Cloud / hosting provider: for hosting the website (EU region).
• Postmark / Resend: for sending transactional emails (contact form, application form and quick scan).
• Google reCAPTCHA (Google Ireland Limited): for protecting forms against abuse.
• Google Analytics 4 (Google Ireland Limited): for anonymous usage statistics, only after your consent. IP addresses are truncated, advertising features are disabled.
• Microsoft 365 (Microsoft Ireland Operations Limited): email, calendar and document storage for our services (EU region).
• Anthropic (Anthropic Ireland, Limited): AI assistance for research, analysis and documents, as described in article 16 of our general terms and conditions. The data we process is not used to train models.

Transfers outside the EEA

Google and Anthropic may process personal data in the United States. For Google, transfers take place on the basis of the EU-US Data Privacy Framework and the European Commission Standard Contractual Clauses; for Anthropic on the basis of those Standard Contractual Clauses. We use Google services in IP-anonymising mode and with advertising features disabled.

Your rights

Under the GDPR you have, among others, the following rights:

• Right of access to your personal data.
• Right to rectification of inaccurate data.
• Right to erasure (the 'right to be forgotten').
• Right to restriction of processing.
• Right to object to processing based on legitimate interest.
• Right to data portability.
• Right to withdraw consent at any time, without giving a reason.

Would you like to exercise any of these rights? Get in touch via our contact form. We will respond within 4 weeks. If you disagree with how we handle your data, you can file a complaint with the Dutch Data Protection Authority.

Security

We take appropriate technical and organisational measures to protect your data, including encrypted connections (TLS), access control and regular security reviews. Odin QHSE B.V. is ISO 27001 certified.

Changes

We may update this privacy statement from time to time. The most recent version is always on this page, with the date of the last change.

Contact and questions

Questions about this statement or your data? Reach out via our contact form or call +31 6 23 66 08 42.