Privacy and cookies

In brief

• We use your data to answer your question, process your order, provide service and keep our records.
• We do not sell your data. We do not send a newsletter or advertising through this website. You only receive safety notices if you sign up and confirm that sign-up.
• This website counts visits with cookieless, anonymous statistics. There are no advertising or tracking cookies. We only place cookies that are needed for the basket, for logging in and for your own choices.
• Patient data does not belong here. Do not enter it anywhere and do not send it.
• You can view, correct or erase your data. Email info@vcmmedical.nl.

Who is responsible

VCM Medical B.V. is the controller for the processing of your personal data through this website, the webshop, My VCM and our forms.

VCM Medical B.V., Hamersveldseweg 135, 3833 GN Leusden, the Netherlands. Chamber of Commerce (KvK) 97801267, VAT NL868237590B01. Telephone 033 434 50 60 (Mon–Fri 08:30–17:00), email info@vcmmedical.nl.

We have not appointed a data protection officer, because the GDPR does not require us to. For questions about privacy, you can use the address above.

This statement does not apply to websites of others that we link to, such as those of manufacturers.

What we use your data for

Below, for each purpose, you can see which data we use and on what legal basis. How long we keep it is shown in the overview under How long we keep data.

The GDPR permits the use of personal data only with a legal basis (Article 6(1)). We use these four:

• Contract (point b): needed to perform a contract with you, or to prepare a contract at your request, such as a quote or an order.
• Legal obligation (point c): the law requires us to, for example for the tax records or in the case of incidents with medical devices.
• Legitimate interest (point f): we have a business interest that outweighs your privacy interest, for example answering a business question or securing the website. You can object to this (see Your rights).
• Consent (point a): only if we expressly ask for it, for example for safety notices. You can withdraw your consent at any time.

Mandatory fields in a form are needed to be able to handle your question, request or order. Without that data we cannot do so. All other fields are optional.

We usually receive data from you yourself. Sometimes also from your organisation, for example if it names you as a contact person, from the payment provider (the outcome of a payment) and, for an application for a business account, from our customer records in AFAS.

Contact, quote, demo, appointment and procurement file

When you fill in a form, email us or call us.

• Data: name, institution, job title, email address, telephone number and your question or comment. For a quote or procurement file also what you fill in yourself, such as speciality, applications, current system, number of workstations, desired delivery date, tender number or deadline, and optional attachments. If you have a calculation or proposal emailed to you through the Okti calculator or the service contract check, we keep it as a contact request.
• Purpose: answering your question, preparing a quote or proposal, planning a demo or appointment and compiling a procurement file for your tender.
• Legal basis: legitimate interest (f): we want to answer the business question from you and your organisation properly. If you yourself, as a self-employed person or sole trader, want to enter into an agreement with us, the use of your data is needed to prepare that at your request (b).

Each request reaches us as an email with the data filled in, without attachments. Attachments and the request are also stored in the website’s back end. Your confirmation email contains your ticket number, the time we received your request and a few short details from the form (for example the speciality, how serious a fault is, the device or the order number), never your free text or attachments.

Reporting a fault or incident

• Data: name, institution and department, telephone number, email address, brand and type of the device, serial number, location, description, how serious it is, whether the device is out of use, service contract or customer number, and an optional attachment such as a log file or photo. For an incident involving a patient or user, also what happened and what the consequence was, without patient data.
• Purpose: resolving the fault, calling you back, keeping a ticket and keeping our service history. As soon as we establish an incident, we assess whether we have to pass it on.
• Legal basis: performance of a contract (b), for example your service contract, or otherwise our legitimate interest (f) in resolving faults in devices that we supply or maintain quickly and well. For an incident with a medical device also a legal obligation (c), see below.

We do not forward attachments by email. See also Patient data.

Business account and My VCM

• Data on application: name of the organisation, Chamber of Commerce (KvK) number, VAT number, department, country, your name, job title, email address, telephone number and whether a purchase order number is mandatory. Once your account has been opened, the following are added: your password (stored in unreadable form), invoice and delivery address, your orders and order lists.
• Purpose: checking whether your email address is known to us as a customer, creating and managing the account, My VCM, prices and documents that are only for business customers, and ordering on account.
• Legal basis: contract (b) for the account and ordering on account. For checking the application our legitimate interest (f): we want to know whether the applicant belongs to an existing organisation.

You get access to prices and ordering if your email address is known to us as a customer. In doing so, we link your account to your organisation’s customer number in AFAS. If it is not, an employee will contact you. We never send your password by email; you choose it yourself via a link that is valid for seven days.

Ordering and paying in the webshop

• Data: name, name of your organisation, practice or company, VAT number and Chamber of Commerce (KvK) number (both optional), invoice and delivery address, email address, telephone number, products ordered, comment on the order, chosen payment method, for business orders a purchase order number, and the outcome of the payment. We also record which version of the general terms and conditions applied to your order, when you accepted them and the wording of the checkbox (in which you declare that you order on behalf of a company or institution, or in the course of your profession). If an order does not look like a business order, for example because the organisation name is missing or implausible, we note this on the order so that we can check it before dispatch. We ask for the telephone number for questions about the delivery.
• Purpose: fulfilling your order, delivering, invoicing and processing payments, answering questions about your order and keeping our records.
• Legal basis: contract (b), legal obligation (c) for the tax records, and legitimate interest (f) in being able to handle complaints and disputes and to check that we supply only to companies and institutions.

Our webshop is for businesses and institutions only; we do not supply consumers. With a business account you can order on account. Where the webshop allows it, an organisation can also pay online without an account. When you pay online you are redirected to the payment environment of our payment service provider. You enter your bank details only with your own bank. For delivery, the delivery service we engage receives your name, address and contact details.

Returns

• Data: name, organisation, email address, telephone number, order number, who makes the report, the reason, the products you are sending back and an optional photo.
• Purpose: handling your return shipment and being able to show that we received your report. The confirmation by email with your ticket number serves as proof of receipt.
• Legal basis: contract (b) to handle your return, and legitimate interest (f) in being able to prove the report.

You can read how returns work on Returns and withdrawal. Do not take photos in which people can be recognised.

Records and customer management (AFAS Profit)

• Data: order and invoice data, data of the organisation (name, Chamber of Commerce (KvK) number, VAT number, address) and contact persons. For a webshop order, we also put the name, email address, telephone number, delivery address and your comment on the order in the order data in AFAS.
• Purpose: bookkeeping and invoicing, and managing our customer relationships, for example to follow up a quote or a service contract.
• Legal basis: contract (b), legal obligation (c) for the records, and legitimate interest (f) in managing our business relationships.

If a quote or agreement follows from your request, we add your contact details to our customer file in AFAS Profit. We keep them there for as long as we have a business relationship with your organisation. After that we only keep what the law requires.

Applying for a job

• Data: name, email address, telephone number, place of residence, motivation, the vacancy or your interest, optional attachments such as a CV, and your choice of whether we may keep your data for a year for future vacancies.
• Purpose: assessing your application and keeping in touch with you about the procedure.
• Legal basis: legitimate interest (f): we must be able to assess applications. For keeping it longer for future vacancies we ask for your consent (a). You give it with a tick box that is not ticked in advance, and you can withdraw it at any time.

Your application is visible only to employees involved in recruitment and, for the technical management of the website, the administrators. We do not forward attachments by email.

Safety notices by email

• Data: email address, the brands you choose, your name and institution if you fill them in, and the moment you confirm your sign-up.
• Purpose: sending you messages about the safety of devices of the brands you choose.
• Legal basis: consent (a). You sign up using the form and confirm this with a button in an email (double opt-in). Without confirmation we send nothing.

Every message contains an unsubscribe link. If you unsubscribe, we delete your sign-up and your email address. The notices themselves are in My VCM. We do not send a newsletter. If one is introduced, we will first ask for consent and amend this statement.

Securing the website and preventing misuse

• Data: a hashed identifier of your connection, derived from your IP address but not the IP address itself, with counters for the number of submissions, uploads and login attempts. For a confirmation email, a hashed identifier of the email address. A technical log of the link with AFAS, without access token and without order contents. The hosting provider also records technical server logs, such as IP address, time and the page requested.
• Purpose: preventing spam and misuse of forms, limiting the number of login attempts, tracing faults and keeping the website secure.
• Legal basis: legitimate interest (f): we must secure our systems appropriately (Article 32 GDPR).

We check a form with a hidden field and a timestamp that our server signs. We do not store your IP address itself in the website’s database.

Legal obligations for medical devices

If you report a complaint or incident about a medical device, we may be obliged as distributor to pass it on to the manufacturer and, in the case of a serious risk, to the competent authority. We then pass on the report with the data needed for that, such as your contact details as reporter. The legal basis is a legal obligation (c). We also do so if the law obliges us to provide data to a regulator or other government body.

Patient data: do not enter it and do not send it

This website is not intended for patient data. Do not enter names, patient IDs, dates of birth or other patient data and do not send them in attachments.

Data about someone’s health is special category personal data (Article 9 GDPR). We do not need it to handle a request and do not want to receive it through the website. It sometimes comes along unnoticed, for example in a log file, a screenshot, a photo or a recording that shows a name or patient number. So remove that data or make it unrecognisable before you upload anything. For a fault report you must confirm that it contains no patient data. For a quote and a procurement file, that confirmation applies if you attach a file. In doubt? Call us on 033 434 50 60.

If we nevertheless receive patient data, we do the following:

• we do not use it and do not pass it on beyond what is necessary;
• we delete it as soon as possible from the website, from our mailbox and from other places where it ended up;
• we let you know that it has arrived, so that your institution can assess whether this is a data breach that it has to handle. Your institution is responsible for that data;
• we record what happened and what we did.

If we work on a device on site or remotely, we may have access to systems with patient data. We make arrangements with your institution about that in a data processing agreement. Your institution is then the controller and we process the data only on instruction. That processing falls outside this statement.

How long we keep data

We do not keep data for longer than necessary. We delete requests and attachments automatically after the period ends. For accounts, orders and invoices the periods in the table below apply; we delete or anonymise that data after the period ends.

The email that we receive from a request is kept no longer than the request itself. Deleted data may remain in the daily back-up of the website until that back-up is overwritten. We do not restore deleted data.

Who we share data with

We share data only with parties that we need for that purpose. VCM employees see your data only if that is necessary for their work. We conclude a data processing agreement with parties that process data on our behalf (processors). They may use the data only to provide their service to us.

Besides TeamViewer, we also use VPN for remote support, in the way your institution permits. We do not pass data on to others for their own advertising or sales.

Transfers outside the EEA

We do not knowingly transfer your data to parties outside the European Economic Area. If one of the parties above processes data outside the EEA, this takes place only with an appropriate safeguard under the GDPR, such as an adequacy decision of the European Commission or standard contractual clauses. You can ask us which safeguard applies to a party.

Automated decisions

We do not take decisions based solely on automated processing that significantly affect you (Article 22 GDPR). We do not create profiles of visitors. Whether you get a business account depends on whether your email address is known to us as a customer. If it is not, an employee will contact you. The fact that some prices become visible only after logging in with a business account is an access rule and not profiling.

Your rights

You have these rights:

• Access: you can ask which data we hold about you.
• Rectification: you can have incorrect or incomplete data corrected.
• Erasure: you can ask us to delete your data. This is not possible for data that we are legally required to keep, such as the records of orders.
• Restriction: you can ask us to stop processing temporarily, for example if you dispute its accuracy.
• Objection: you can object to processing that we base on our legitimate interest.
• Portability: you can receive the data that you gave us yourself and that we process on the basis of consent or a contract, in a common file format.
• Withdrawing consent: this is possible at any time. For safety notices via the unsubscribe link in every message, for keeping your job application longer by email. What we already did before that remains lawful.

How to arrange this. Email info@vcmmedical.nl with the subject “Privacy request”. Write what you want and state the email addresses that you have used with us, because we search on those. We may ask you to confirm your identity, preferably by replying from the email address with which you contacted us. We search for your data in the website, our email system and AFAS.

Within one month. We respond as soon as possible and no later than one month after receiving your request. If your request is complex, we may extend that period by at most two months. We will let you know within the first month, with the reason. It costs you nothing, unless a request is manifestly unfounded or excessive.

Do you have a disability and would you like this information in another form? Email us. You can read more about the accessibility of the website on Accessibility.

Making a complaint

Are you not satisfied with how we handle your data? Please contact us first, so that we can resolve it. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), the supervisory authority for privacy law. You can do so via autoriteitpersoonsgegevens.nl.

A complaint about an order or a service is not covered here. You can read more about that in the general terms and conditions.

How we secure data

We take practical measures to protect your data:

• Attachments are kept in a protected folder that cannot be opened directly via the internet. They are given a random file name and we check the type and content. Only authorised employees can open them, and we note this in the file.
• Requests are accessible only to employees with authorisation. Job applications are only for employees involved in recruitment and the administrators of the website.
• We do not store passwords in readable form. The error message when logging in does not reveal whether an account exists, and after several failed attempts logging in is temporarily blocked.
• The access token for the link with AFAS is stored encrypted and does not appear in logs.
• The website sends security headers that, among other things, prevent our pages from being embedded in another website, and is intended to be used only over a secure connection (https).

These are practical measures. We do not hold a certification for information security, such as ISO 27001 or NEN 7510. No system is completely secure. If we find a data breach that poses a risk to your privacy, we report it to the Dutch Data Protection Authority within 72 hours. If the risk to you is high, we will also inform you ourselves.

Target group and minors

Our website and webshop are intended for organisations and professional users, such as care institutions and companies. They are not aimed at consumers or minors. We do not knowingly ask for data from children. Do you think a child has nevertheless given us data? Email us and we will delete it.

Changes

We may amend this statement, for example when we add new features, such as analytics or a newsletter, or when the law changes. At the top of this page you will find the version number and the date of the last change. If the cookie section changes, we will ask you for your choice again.

In brief

• We only place functional and necessary cookies: for the basket, for logging in and for remembering your own choices.
• We do not use cookies for analytics, advertising or tracking your behaviour, and no cookies from other parties.
• We do not use localStorage or sessionStorage for statistics or to track you. One exception: as long as online ordering is not yet open, your browser keeps your request list (only item numbers, names and quantities, no personal data) in localStorage, on your own device only. That list only reaches us when you send the quote form. You can remove it with “Empty the list” or by clearing the website data in your browser. We do not load fonts, maps, videos or scripts from other parties.
• No consent is needed for functional and necessary cookies. We do have to inform you about them. This page does that.

Cookies that we place

A cookie is a small file that a website places in your browser. Below are all the cookies that this website can place. They all come from our own website (first party). Not every cookie is placed on every visit: the basket cookies only if you put something in the basket, and the cookies for logging in only if you log in.

When is consent needed?

Under the Dutch Telecommunications Act (Article 11.7a), we must inform you about cookies and ask for consent, unless a cookie is needed solely to carry out the communication or is strictly necessary to provide the service you request, or has only a minor impact on your privacy. The basket, logging in and remembering a display you have chosen fall under this. That is why we do not ask for consent for the cookies in the table. Consent is needed for cookies for analytics with more than a minor impact on your privacy, for advertising and for tracking your behaviour. We do not place those.

Analytics

We count visits to this website with cookieless, anonymous statistics. These are counters per day and page, with the origin (the website you come from) and the type of device (mobile or computer). We place no cookies for this, store no IP address and no visitor ID, and so cannot link a visit to you. Visits by logged-in staff and by bots are not counted. If we later want to use other analytics, for example with cookies, we will amend this statement before we start, say which data we measure and ask for your consent, unless the law provides an exemption.

Other parties and links

No cookies from other parties are placed on our website. If you choose to pay online in the webshop, you go to the payment environment of our payment service provider. It decides for itself which cookies it places there. That is set out in that party’s privacy or cookie notice. The same applies to websites that we link to, such as those of manufacturers.

Keeping, changing and deleting cookies

We keep your choice in the cookie notice in the cookie vcm_consent: the categories chosen, the time and the version of this statement. That cookie contains no name, ID or IP address and we do not store your choice on our server. After 180 days, or when this cookie notice gets a new version, we ask for your choice again.

You change your choice under Cookie settings, or via “Cookie settings” at the bottom of every page. You can also delete or block cookies in your browser. The basket and logging in then do not work.