Privacy Statement Pro Luca B.V.

1. Introduction
In the context of our services, we process personal data. We usually receive this data from you, for example via our website, e-mail, telephone or app. With this privacy statement we inform you how we handle these personal data.

We are: Pro Luca B.V.
Chamber of Commerce: 77534239
Naarderstraat 30
1251 BC Laren

2. Personal data to be processed
Which personal data we process depends on the exact service and circumstances. Usually it concerns the following data:

• Name and address details;
• Gender;
• Contact details (email addresses, phone numbers) and name and position of contacts at business customers;
• Financial data;
• Any data you share on the social media account you link with us;
• CV data in the case of job applicants;
• External data when visiting our boutique, due to camera surveillance.

3. Purposes of and bases for processing
In some cases we process personal data in order to comply with a legal obligation, but mostly we do so in order to be able to carry out our services. There may also be a legitimate interest to process personal data, as in the case of a job application.

Some data are recorded for practical or efficiency reasons, which we (may) assume will also be in your interest, such as:

• Communication and information provision, e.g. sending the newsletter;
• Providing our services as efficiently as possible;
• Invoicing and debt collection.

Finally, we may also use your personal data to protect our own and our users' rights or property and, if necessary, to comply with legal proceedings.

4. Applicants
We would like to remindapplicantsof the following. You are asked never to include your citizen service number or religious affiliation in your application letter, nor do you have to attach a passport photo or a copy of your ID. Should this be relevant, it will be addressed during the application process. Your application will be kept for the duration of the application process by the employee responsible, and then destroyed. The lead time is usually about 3 months. Should we be interested in your profile, but are unable to invite you directly for an interview, we may ask you for your explicit permission to retain your application for up to 12 months.

5. Provision to third parties
As part of our services, we regularly use the services of third parties, such as suppliers and carriers. These may be so-called processors or sub-processors. Other third parties who have or may have access are, for example, our ICT supplier, financial institution or newsletter provider. If engaging third parties results in them having access to personal data, we will agree with these third parties that they will comply with all obligations of the AVG. Naturally, we will only engage third parties whom we can and may assume to be reliable parties who handle personal data adequately. This means, among other things, that these third parties may only process your personal data for the aforementioned purposes.

Naturally, we may also have to provide your personal data to third parties in connection with a legal obligation, such as to our accountant. Please note that if you send us a public message via social media, others may become aware of this message.

6. Processing within the EEA
We will only process personal data within the European Economic Area, except if in the country concerned the level of personal data security guaranteed by the AVG is not undermined and there is sufficient interest in processing outside the European Economic Area.

7. Security
We have taken appropriate organizational and technical measures for the protection of personal data to the extent that these can reasonably be required of us, taking into account the interest to be protected, the state of the art and the costs of the relevant security measures.

We require our employees and any third parties who necessarily have access to the personal data to maintain confidentiality. We further ensure that our employees have received proper and complete instruction on handling personal data and that they are adequately familiar with the responsibilities and obligations of the AVG.

8. Retention periods
In principle, we will not process your personal data for longer than is necessary for the purpose for which it was provided (see in this regard the section 'Purposes of and bases for processing'). Certain data must be kept longer (usually 7 years), because we must comply with legal retention obligations, such as the tax retention obligation.

9. Your rights
Youhave the right to access, rectify, restrict or delete the personal data we hold about you (except of course if this conflicts with any legal obligations). Furthermore, you can object to the processing of all or part of your personal data by us or one of our processors. You also have the right to have us transfer the data you have provided to yourself or directly to another party if you so wish.

10. Complaints
Shouldyou have a complaint about the processing of your personal data, we ask that you contact us about this. Should this not lead to a satisfactory outcome, you always have the right to file a complaint with the Authority for Personal Data; the supervisory authority in the field of privacy. The contact details of the Authority Persoonsgegevens can be found on the website autoriteitpersoonsgegevens.nl.

11. Incidents with personal data
If there is a breach (a so-called data leak) involving your personal data, we will notify you immediately, unless there are compelling reasons, if there is a high probability of negative consequences for your personal privacy and the realization thereof. We aim to do this within 48 hours after we discover this data breach or are informed about it by our (sub) processors. If necessary, we will report a data breach to the Personal Data Authority.

12. Changes
No doubt our privacy policy will change from time to time. The most recent version of the privacy policy is logically the applicable version and can always be found on our website.

13. Social media
When you visit our website, you can easily click through buttons to our social media pages such as Instagram, Facebook and Pinterest. If you visit these pages and leave a public message or otherwise comment here, other visitors may become aware of this. Therefore, we do not recommend posting personal messages here.

Clicking through to the social media pages is enabled by the technology of the respective operators. They then place cookies and may process your personal data. If this happens outside the EEA, however, they undertake to have organized a proper protection of personal data in line with the obligations laid down in the European AVG. We have no influence on this and refer you to the privacy statement of the relevant social media. The information posted by third parties, regardless of whether we have any influence on it, or referred to via hyperlinks, is never the responsibility of our organization.