Privacy policy
1. Who we are
BNK KAM designs and builds websites, advises on data and automation, develops applications and data systems, makes applications available on subscription, and sells digital products such as ebooks.
| Name | BNK KAM |
| Address | De Nieuwe Erven 3, Unit 15157, 5431 NV Cuijk |
| Chamber of Commerce (KvK) | 94545146 |
| info@bnkkam.com | |
| Website | bnkkam.com |
We supply both business customers and, in the case of digital products, private individuals. No data protection officer has been appointed; that is not mandatory for an organisation of this size and nature. Privacy questions reach us via info@bnkkam.com.
2. When we are the controller and when we are the processor
This distinction determines whom you should approach with a question about your data.
We are the controller for the data we process for ourselves: website visits, contact requests, quotations, orders in our web shop, client administration and invoicing. This policy is about those.
We are the processor where we build or manage a dashboard, data system or application for a business client. The data held in it belong to that client; the client determines the purposes and means and is the controller. We process those data solely in accordance with the client's instructions and on the basis of a data processing agreement. If your data are held in such a system, please approach that organisation; we will refer you on request.
3. What data we process, for what purpose and on what basis
| What we process | For what purpose | Basis |
|---|---|---|
| Name, company name, email address, telephone number, the content of your message | Answering your contact request and following up a request for a quotation | For business contacts: legitimate interest, namely being able to respond to your question and handle your request. For private individuals: taking steps at your request prior to entering into a contract. |
| Email address, name and company name | Sending our newsletter and messages about our own similar services and digital products | Your consent, given when you sign up. If you are a customer, we send you messages about our own similar products and services on the basis of Article 11.7(3) of the Dutch Telecommunications Act and of our legitimate interest. In both cases you can unsubscribe with one click in every message. |
| Name, email address, invoice and address details, order details, order number | Performing your order, delivering the digital product, customer service | Performance of the contract |
| Payment details (via our payment service provider; we do not see full card details) | Handling the payment and any chargebacks | Performance of the contract |
| Invoice and administrative data | Complying with the statutory tax retention obligation | Legal obligation |
| Buyer-linked marker in a delivered digital product | Countering unauthorised distribution | Legitimate interest: protection of our copyright |
| Account data and usage data under a subscription | Granting access, support, security and invoicing | Performance of the contract |
| Log data: IP address, time, error messages | Security, detecting misuse and resolving malfunctions | Legitimate interest: security of our systems |
| What you enter into a feature that works with a language model | Performing that feature, for example summarising, organising or searching your own data | Performance of the contract |
| Website visit statistics | Improving the website | Consent, via the cookie banner |
Direct marketing. We use your data solely for our own services and products and do not provide them to third parties for their marketing. You can unsubscribe in every message and you may object at any time to the use of your data for direct marketing. We then stop that use immediately, without your having to give a reason.
We do not sell your data. We do not take decisions about you based solely on automated processing that produce legal effects or similarly significant effects for you. We do not carry out profiling for advertising purposes.
We do not ask for special categories of personal data and we request that you do not state them in a contact form or an order either.
If you nevertheless provide us with such data where this is not necessary, we ask you not to provide them again, and we may delete those data where we have no legal basis or other necessity for holding them.
4. How long we retain data
| Data | Period | Reason |
|---|---|---|
| Contact request with no follow-up | 6 months | No further necessity |
| Business email correspondence | 2 years after last contact | Record-keeping and follow-up |
| Email address for newsletter and marketing | Until you unsubscribe, thereafter no more than 12 months on an opt-out list | Giving effect to your unsubscription and preventing you from being contacted again |
| Quotations that do not lead to an assignment | 2 years | Evidence and follow-up |
| Invoices and the associated administration | 7 years | Statutory tax retention obligation, Article 52 of the Dutch State Taxes Act |
| Order details for digital products | 7 years | Statutory tax retention obligation and re-delivery requests |
| Account data under a subscription | For the term, thereafter 30 days for export | Performance and transfer |
| Log data | 12 months | Security and incident investigation |
| Analytical statistics | 14 months | Trend analysis |
| Back-ups | In accordance with the regular cycle, no more than 90 days | Recovery after incidents |
Once the period has expired we delete the data or render them irreversibly anonymous. Data in back-ups disappear when that back-up expires in accordance with the cycle; we do not extract them separately from it.
5. With whom we share data
We engage service providers who process data on our behalf. A data processing agreement has been concluded with each of them.
| Party | Role | Processing location |
|---|---|---|
| Shopify International Ltd. | Web shop, hosting and ordering platform | European Economic Area and United States, with standard contractual clauses |
| Payment service provider via Shopify Payments and the payment method you select | Handling of payments | European Economic Area |
| Google Ireland Ltd. | Website statistics via Google Analytics 4, only with your consent | European Economic Area and United States, with standard contractual clauses |
| Email service provider | Sending and receiving messages | European Economic Area |
| European hosting parties | Running and deploying the applications we build and manage; this is where the data of those applications reside | European Economic Area |
| Providers of AI models, including Anthropic (Claude) | Supply, via an application programming interface, the language models with which our smart features work, for example in a dashboard or an application | European Economic Area and United States, with appropriate safeguards |
In addition, we provide data to our accountant and, where legally required, to the Dutch Tax Administration or a competent authority.
Where your data reside. We deliberately choose European hosting. The applications we build and manage run on infrastructure within the European Economic Area, and the data held in those applications remain there.
Artificial intelligence. Some of our features work with language models that we obtain from a specialised provider via an application programming interface, including Anthropic (Claude). For such a feature, only what is needed for that single operation goes briefly to that provider's environment, after which the answer comes back. The application itself and the data held in it do not travel with it.
For the operation itself, such a provider processes the data solely on our instructions; for that part it acts as a processor. We engage only providers who undertake contractually not to use your data for training, fine-tuning or improving their models. In addition, providers retain the input and the output for a short period in order to counter misuse of their service. At Anthropic that period is currently no more than thirty days, unless a zero-retention arrangement has been agreed with us. We provide the period applicable to each provider on request via info@bnkkam.com.
We do not enter special categories of personal data into an AI feature, and we do not take decisions about you based solely on an AI output.
Transfers outside the European Economic Area. Where a service provider processes outside the EEA, this takes place on the basis of an adequacy decision of the European Commission or, failing that, on the basis of the standard contractual clauses, in both cases supplemented by measures such as encryption. Which service providers and sub-processors we engage, what role they perform, where they process and what basis for transfer applies to each of them is set out on our page Sub-processors and service providers at bnkkam.com. We keep that page up to date and it states the date of the most recent change. If you have a question about it, you can reach us via info@bnkkam.com.
6. Your rights
You have the right to:
- access to the data we process about you;
- rectification of inaccurate or incomplete data;
- erasure, insofar as no retention obligation or other overriding interest stands in the way;
- restriction of processing while a request or objection is pending;
- object to processing based on our legitimate interest, after which we cease that processing unless we have compelling legitimate grounds that override your interests, rights and freedoms;
- object to direct marketing, where no balancing takes place: if you object, we no longer use your data for that purpose;
- portability of data you have provided yourself, in a commonly used, machine-readable format;
- withdrawal of consent, whereby processing carried out before the withdrawal remains lawful.
You can submit a request via info@bnkkam.com. We respond within one month. If your request is complex, we may extend that period by two months; we will inform you of this within the first month. We may ask for additional details in order to establish your identity, and we use those solely for that purpose.
If you disagree with how we handle your data, you may lodge a complaint with the Dutch Data Protection Authority, Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ The Hague, autoriteitpersoonsgegevens.nl.
7. Security
We take appropriate technical and organisational measures, including encrypted connections, access on a need-to-know basis, two-factor authentication on administrator accounts, separated development and production environments, and periodic back-ups.
If you discover a vulnerability, please report it to info@bnkkam.com. We deal with every report and take no legal action against reporters who act carefully and in good faith and who do not disclose the vulnerability before it has been remedied.
Where a personal data breach is likely to result in a risk to the rights and freedoms of data subjects, we report it, where legally required, to the Dutch Data Protection Authority within 72 hours of discovery at the latest.
8. Cookies
Cookies are small text files placed on your device when you visit our website.
8.1 Functional cookies, always active
Necessary for the operation of the website and the web shop. No consent is required for these and you cannot switch them off without the website ceasing to work.
| Cookie | Purpose | Retention period |
|---|---|---|
| Shopify session cookie | Maintaining your session and shopping cart | Session |
| Cookie banner preference | Remembering your cookie choice | 6 months |
| Security cookies | Fraud prevention at checkout | Session up to 30 days |
8.2 Analytical cookies, only with your consent
| Cookie | Purpose | Retention period |
|---|---|---|
| _ga | Distinguishing visitors | 2 years |
| _ga_* | Storing the session state | 2 years |
Google Analytics is activated only after consent. The data collected in that way are processed by Google in accordance with the processor and privacy terms applicable to this service.
8.3 What we do not place
We place no advertising, tracking or social media cookies, and we share no data with advertising networks.
8.4 Managing your choice
On your first visit, the cookie banner asks for consent for analytical cookies. Refusing is just as easy as accepting; if you refuse, we place functional cookies only. You can review your choice at any time by deleting the cookies in your browser and visiting the website again.
You can also manage cookies via your browser: Chrome via Settings, Privacy and security, Cookies. Firefox via Settings, Privacy and security. Safari via Preferences, Privacy. Edge via Settings, Cookies and site permissions.
9. Children
Our services and products are not directed at persons under the age of sixteen. We do not knowingly collect data from children. If you suspect that we have nevertheless done so, please let us know and we will delete them.
10. Changes
We amend this policy where our services or the applicable rules give cause to do so. The current version is always available at bnkkam.com, with a version number and date. In the event of a significant change we inform active customers and subscribers directly.