Privacy statement

1. Who we are

Mason Pete Dynamics B.V. is a Dutch consultancy that helps organisations with Microsoft Dynamics 365, CRM adoption, digital transformation and business processes.

The data controller is Mason Pete Dynamics B.V., Jan van der Schoorstraat 2, 1943 NC Beverwijk, the Netherlands. Our Dutch Chamber of Commerce (KVK) number is 93861524.

For privacy questions, contact privacy@masonpete.com.

2. When this statement applies

This statement applies when we process personal data for our own purposes, for example when you:

• Visit our website or contact us.
• Represent your organisation as a client, prospective client, supplier or business partner.
• Request a quotation or enter into an agreement with us.
• Take part in business communications with us.
• Apply for a role with us or receive marketing communications from us.

During client assignments, we may also process personal data within a client's systems, applications or processes, such as CRM systems, Microsoft Dynamics 365, Microsoft 365 environments or project documentation. The client normally determines the purposes and means of that processing. In those situations, we generally act as a processor and follow our agreement with the client.

3. Our role in processing personal data

We are a data controller when we determine why and how personal data is processed. This applies, for example, to our own website, administration, communications, marketing, relationship management, recruitment and business operations.

We generally act as a processor when we process personal data on a client's behalf, within that client's environment or processes. Examples include implementation, support and work in the client's CRM or Microsoft 365 environment.

The client is generally responsible for informing the individuals concerned and determining the purposes, means and retention periods. Arrangements concerning confidentiality, subprocessors, retention and deletion are recorded in a data processing agreement or other contractual documentation.

If we and another party jointly determine the purposes and essential means of processing, we may be joint controllers. Where this applies, we record our respective responsibilities in writing.

4. Personal data we process

The personal data we process depends on your relationship with us.

4.1 Contact and business details

Name, business email address, business telephone number, job title, organisation, department, business address and communication preferences.

4.2 Communications

The contents of emails, website chat messages and contact forms; conversation notes; meeting arrangements; correspondence; and communication details such as dates, times and the contacts involved.

Website chat is currently switched off for visitors. Please use the contact form, telephone or email to contact Peter. If chat is enabled later, this statement will be updated to explain how conversation data is handled. Please describe the business problem without patient information or confidential client data.

4.3 Quotations, contracts and billing

Quotation details, order confirmations, contracts, purchase orders, invoices, payment details and details of authorised signatories or operational contacts.

4.4 Website information

When you visit our website, we may process your IP address, browser and device information, pages visited, referral source, visit date and time, cookie preferences where applicable, and information you submit through forms. See our Cookie policy for more information.

4.5 Marketing and relationship management

Name and business contact details, organisation and job title, areas of interest, newsletter or event subscription status, opening and click statistics where applicable, and unsubscribe records.

4.6 Job applications

If you apply for a role with us, we may process your name and contact details, CV, covering letter, education and employment history, a LinkedIn profile or portfolio you provide, interview notes, references where relevant and permitted, and other information you supply as part of your application.

4.7 Data in client environments

During client projects, we may encounter personal data relating to the client's employees, customers, prospective customers, suppliers or other contacts. This may occur in Microsoft Dynamics 365, Microsoft Dynamics CE, CRM systems, Microsoft 365 environments, service desk systems or project documentation.

When we process this data solely on the client's behalf, we do not use it for our own purposes. Processing takes place within the agreed assignment and according to the client's instructions.

5. Special categories of personal data

We do not deliberately process special categories of personal data, such as information about health, racial or ethnic origin, political opinions, religious beliefs or trade union membership, unless this is strictly necessary and lawful.

If such information is unexpectedly present in a client environment or project information, we process it only within the scope of the assignment and the applicable contractual and legal safeguards.

6. Why we process personal data

• Contact and communication: to answer questions, arrange meetings and maintain business contacts.
• Quotations and contracts: to prepare quotations, assess assignments, enter into agreements and fulfil our commitments.
• Consultancy assignments: to help clients with Microsoft Dynamics 365, CRM adoption, digital transformation and business processes.
• Service improvement: to improve our services, processes, communications and project approach.
• Administration and billing: to maintain financial records, issue invoices, process payments and meet tax obligations.
• Marketing and relationship management: to inform business contacts about relevant services, knowledge sharing, events or developments, where permitted.
• Recruitment: to assess applications, communicate with candidates and complete the recruitment process.
• Legal obligations and claims: to comply with the law and establish, exercise or defend the rights or claims of Mason Pete, clients or third parties.

7. Our legal grounds for processing

We process personal data only where a legal ground applies.

Contact and communication. We rely on our legitimate interest in answering questions, maintaining business relationships and communicating with clients, prospective clients, suppliers and other contacts. Where communication relates to entering into or performing a contract, processing may also be necessary for that contract.

Quotations and contract management. We process data to assess enquiries, prepare quotations, record arrangements and perform agreements. This is based on performing a contract or, before a contract is in place, our legitimate interest in handling business enquiries properly.

Client assignments. We process data as needed to deliver the agreed advice, implementation or consultancy services. Where we process data solely on a client's behalf, we generally act as a processor under our agreement with that client.

Administration and billing. We rely on legal obligations and, where relevant, performance of a contract for financial administration, invoicing, payment processing and tax obligations.

Marketing. We may rely on our legitimate interest when communicating with existing business contacts, where the law permits this. Where consent is required for newsletters, electronic marketing or tracking, we obtain it beforehand. You can always unsubscribe from marketing communications.

Cookies. Where consent is required for cookies or similar technologies, we rely on that consent. See our Cookie policy for the current website arrangements.

Recruitment. We rely on our legitimate interest, steps taken before entering into a contract or, when retaining application information for future roles, your consent.

Legal claims. We rely on our legitimate interest in establishing, exercising or defending our legal position.

When relying on a legitimate interest, we weigh that interest against the privacy interests of the people concerned. Examples include business communication, relationship management, service improvement and establishing, exercising or defending legal claims.

8. Marketing and newsletters

Our services are mainly for business clients. We may contact clients, prospective clients and business contacts with information about our services, knowledge sharing or events, where legally permitted.

Where consent is required, we obtain it first. You can unsubscribe using the option in the message or by emailing privacy@masonpete.com.

After you unsubscribe, we retain limited information to make sure we do not contact you again for the same communication.

9. Cookies and website technologies

Our website uses cookies and similar technologies. Some are necessary for the website to work. Where required by law, we obtain consent for analytics, marketing or tracking cookies.

Our Cookie policy explains the current website setup and how you can manage cookies.

10. Where we obtain personal data

We usually receive personal data directly from you, for example when you contact us, become a client, sign up for communications or apply for a role.

We may also receive data from:

• Your employer or the organisation commissioning our work.
• Colleagues or business contacts.
• Public business sources, such as the Dutch Business Register, LinkedIn or company websites.
• Clients or project partners.
• Client systems or environments in which we carry out our work.

When we act as a processor, the client is generally responsible for informing the people concerned.

11. Who we share personal data with

We do not sell personal data. We share data only where needed for the purposes in this statement, where required by law or where consent has been given.

Recipients may include:

• Hosting and website providers, IT service providers, and providers of CRM, communication, email and marketing tools.
• Microsoft and other cloud or software providers.
• Bookkeepers, accountants and administrative service providers.
• Legal advisers, insurers or external experts.
• Clients, where data forms part of project deliverables or reports.
• Public authorities or regulators where disclosure is legally required.

Where a third party processes personal data on our behalf, we enter into a data processing agreement where required. When we act on a client's behalf, arrangements for subprocessors are included in our contractual documentation with that client.

An up-to-date list of relevant processors and subprocessors is available on request from privacy@masonpete.com.

12. International transfers

We aim to process personal data within the European Economic Area (EEA) wherever possible. Suppliers or subprocessors may process data outside the EEA, for example when using international cloud, software or marketing providers.

Where personal data is processed outside the EEA, we ensure an appropriate transfer mechanism applies. This may be a European Commission adequacy decision, the European Commission's standard contractual clauses or additional measures where needed.

For information about the suppliers and transfer arrangements relevant to your data, contact privacy@masonpete.com.

13. How long we keep personal data

We keep personal data only for as long as it is needed for the purpose for which it was collected, unless a longer period is legally required or justified. We apply the following principles:

• Contact and communication details: for as long as needed for the business relationship, and afterwards for a reasonable period for relationship management, follow-up or evidential purposes.
• Quotation details: for as long as needed to handle the quotation, follow up on the enquiry or retain evidence after the last contact, rejection or expiry of the quotation.
• Contract and project information: throughout the agreement and afterwards for as long as needed for administration, evidence, legal obligations or handling questions, complaints or disputes.
• Billing and administrative records: generally seven years where tax or administrative retention obligations apply.
• Marketing information: until you unsubscribe or object. We may then retain limited unsubscribe details so that we can respect your choice.
• Job applications: generally no longer than four weeks after the recruitment process ends. With your consent, we may retain your details for future roles for up to one year, unless you withdraw consent sooner.
• Cookie information: for the periods explained in our Cookie policy.

Where we process personal data on a client's behalf, the retention periods agreed with that client apply.

14. Automated decision-making

We do not make decisions about individuals based solely on automated processing that produce legal effects or otherwise significantly affect them. If this changes, we will inform the people concerned.

15. Your rights

Subject to the conditions in the General Data Protection Regulation (GDPR), you have the right to:

• Access your personal data.
• Correct inaccurate or incomplete data.
• Request deletion of your data.
• Restrict processing.
• Data portability.
• Object to processing based on legitimate interests.
• Object to direct marketing.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

To exercise your rights, email privacy@masonpete.com.

We may request additional information to verify your identity. We normally respond within one month. For complex or extensive requests, we may extend this by up to two months and will inform you within the first month.

If we process your data solely on a client's behalf, we may refer your request to that client or handle it in consultation with them.

16. Withdrawing consent

Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing that took place before you withdrew consent.

17. Objecting to legitimate interests or marketing

You can object when we process personal data on the basis of a legitimate interest. We will stop unless we have compelling legitimate grounds to continue or need the data for legal claims.

You can always object to direct marketing. We will then stop using your data for that purpose.

18. Complaints

If you believe we have not handled your personal data appropriately, you can contact us at privacy@masonpete.com. You also have the right to complain to the Dutch Data Protection Authority.

Autoriteit Persoonsgegevens, PO Box 93374, 2509 AJ The Hague, the Netherlands. Website: autoriteitpersoonsgegevens.nl.

19. Changes to this statement

We may update this statement when our services, systems, suppliers or legal obligations change. The latest version is available on our website. For significant changes, we update the date at the top and inform the people concerned where appropriate.

20. Contact

For questions about this statement or the processing of personal data, contact Mason Pete Dynamics B.V.

Jan van der Schoorstraat 2, 1943 NC Beverwijk, the Netherlands. KVK number: 93861524.

Email: privacy@masonpete.com. Telephone: +31 6 24 73 37 67.