Last Mile Division Privacy Policy
A careful processing of personal data is of great importance to BlueRock TMS Last Mile Division. In doing so, we comply with the requirements of the General Data Protection Ordinance (AVG). In this privacy statement, we explain which personal data we collect and use and for what purpose.
ISO/IEC 27001 certified
BlueRock TMS Last Mile Division is ISO 27001 (information security) certified.
Customers can expect us to handle their data with care and that this data is protected. By being certified, we can also demonstrate that we have set up, monitor and continuously improve Information Security Management in a professional manner.
ISO/IEC 27001 is an ISO standard for information security that describes how information security could be organised in a process-based way in order to implement security measures. The standard specifies requirements for establishing, implementing, executing, controlling, assessing, maintaining and improving a documented Information Security Management System (ISMS) within the framework of the general business risks for the organization. The ISMS is designed to ensure the choice of adequate and proportionate security measures that protect the information and provide confidence to stakeholder.
Responsibility
The customer is the legal entity that decides whether, and if so, what data will be processed, for what purpose and in what way. The customer of BlueRock TMS Last Mile Division is therefore – according to the definition of the AVG – the Responsible Party. BlueRock TMS Last Mile Division is deemed to be a Processor that processes personal data on behalf of the Responsible Party without BlueRock TMS Last Mile Division being under the direct authority of the Customer. BlueRock TMS Last Mile Division has no knowledge of what other legislation its Customers must comply with and cannot take any responsibility for this or surrender it.
BlueRock TMS Last Mile Division lays down the mutual rights and obligations between it and its Customers within the framework of the GDPR in a separate agreement.
Network and Information Systems Security Act (Wbni)
BlueRock TMS Last Mile Division offers its product as a SaaS service and qualifies as an online cloud service provider. However, according to the guidelines of the Wbni, we are not regarded as a digital service provider within the meaning of the law. This does not exclude the fact that we will not do everything in our power to meet security requirements as much as reasonably possible.
Recording and processing of data
BlueRock TMS Last Mile Division will process the data of its Customers properly and carefully in accordance with the AVG. We only store and use those personal details that are entered directly into our systems, either manually or automatically, by or on behalf of our Customers. These personal details will not be manipulated, processed or linked by BlueRock TMS Last Mile Division to other data than is necessary for the proper functioning of the system, unless explicitly requested otherwise by our Customers. In principle, we only record data that is necessary for the delivery of goods and services between supplier and customer. No so-called special personal data are recorded. BlueRock TMS Last Mile Division does not provide data to third parties. The storage periods of the data will be agreed separately with each customer. BlueRock TMS Last Mile Division will not store any data outside the agreed storage periods. As the personal data are necessary for the distribution of goods, we assume that there is unambiguous consent of the person(s) concerned. BlueRock TMS Last Mile Division maintains no relationship with individual addressees. Requests for modification or deletion of data (the right to forgetfulness) by addressees must be addressed to the Customer. The customer can then make a request to delete data of an addressee. There is a standard procedure for this.
By default, all data from our products is stored on our own servers in the Netherlands. No Cloud services are used outside the EEA. Deviations from this may be made per customer by mutual agreement. Such a deviation will be laid down contractually.
Registration system
Data is stored and managed within BlueRock TMS Last Mile Division’s SaaS system on behalf of its Customers. This also includes usernames and passwords. The management of usernames and passwords is the Customer’s responsibility. To this end, it must appoint a so-called super-user or application manager. After registration BlueRock TMS Last Mile Division saves the username and personal data, such as name, email address and password. We keep these data so that they do not have to be filled in again and again. We will not pass on the data linked to a user name to third parties unless this is required by law or expressly requested by the customer. In all cases, the provision to third parties will only take place via the customer. Within the system data of Customers and sub-contractors can be stored. This data is only used for (self)billing and financial settlement within the system or via an interface agreed by the customer. C.O.D. data can be recorded within the system. This recording is purely for the proper settlement of the C.O.D. payment. Bank details are not known within the system. At the customer’s request, this financial data can be made available to another system via an interface in order to ensure correct settlement.
Username and password
A username is linked to a password. Users are responsible for handling the password with care. Customers of BlueRock TMS Last Mile Division are responsible for the correct use and establishment of a security policy in this area. We assume that a person who logs in with a user name and password is authorised to use the user name. If it is suspected that the password is known to unauthorized persons, the super-user can block the account and/or set a new password. Usernames are personal, the use of so-called functional usernames for use by more than one person is discouraged but is the responsibility of the customer.
Security of personal data
We use strict security procedures, among other things to prevent unauthorized access to personal data. In particular, we use secure connections (Secure Sockets Layer or SSL) which shield all information between users and our web applications from the moment the user logs on (with username and password).
Duty to report data leaks
In the event of a data breach, the personal data is exposed to loss or unlawful processing. A data breach must be reported to the Personal Data Authority if it poses a risk to the rights and freedoms of data subjects. We assume that the data recorded in our systems for distribution does not fall under these criteria and therefore does not have to be reported to the Authority Personal Data nor to data subjects. Where appropriate, we will always inform our customers.
Capturing visit behavior
Within the applications of BlueRock TMS Last Mile Division, general visit data are maintained and are used for statistical analyses of visit and user interaction on the site/application. In this context, only part of the IP address of the user’s computer is recorded and the remaining data is anonymized as far as possible. This data may be shared with our Customers under certain conditions, but will not be passed on to others or used for commercial purposes.
Use of cookies
Cookies are used within the web applications. A cookie is a simple small file that is stored on the hard disk of the computer. We use temporary cookies. These cookies contain no personal data and are only used to make the use of the web application easier. After logging in with the username and password, our server sends a cookie to recognize the user during the rest of a session. Through this cookie we can also keep track of which pages are requested. Cookies are not used for other (commercial) purposes.
Third party websites
This statement does not apply to web applications or third party sites linked to our applications.
Mobile apps
The way in which we record and process data applies in full to our mobile apps. In order to log in, you may be asked for your e-mail address. This e-mail address will only be used for access to the system and in any communication from the system to users. This is at the customer’s discretion.
The mobile app will not use data, including data that can be made available from the device such as GPS data and photos, other than that required for the proper operation of the system.
Privacy statement changes
We reserve the right to make changes to this statement.
Inspection and modification of data
Questions about our privacy policy or questions regarding inspection and changes (or removal of) personal data can only be submitted to us by the customer.
ii Special personal data are all personal data that provide information about a person’s: religion or belief; race; political affiliation; health; sexual life; membership of a trade union; personal data under criminal law; and personal data about unlawful or obnoxious acts for which a prohibition has been imposed (e.g. a restraining order).