Public Privacy Policy

Non-Powered Asset Control B.V., trading as Connected Load Carrier ("CLC", "we"), part of the Bright Technology Ventures group, KvK 71960147 is committed to protecting your privacy. This Privacy Policy outlines our practices regarding the collection, use, and disclosure of personal data we process when you visit our website www.clc.io (the "Site"), use our platform or app, do business with us as a customer, prospect, supplier or partner, apply for a job, or otherwise contact us. This policy is designed to comply with regulatory standards and reflects our commitment to security, confidentiality and privacy.

1. Information we collect

Depending on your relationship with us, we collect the following categories of personal data:

● Identity and contact data:
name, job title, company, business email address, phone number and postal address.

● Website usage data:
IP address, browser type, device information, access times, pages viewed and referring pages.

● Cookie and tracking data:
data collected through cookies, pixels and similar technologies, as described in our Cookie Policy.

● Account and platform data:
username, login credentials, user role, settings, and records of your activity on our platform or app.

● Customer relationship data:
correspondence, meeting notes, quotes, contracts and CRM records.

● Financial data:
invoicing details, payment records and company bank details.

● Support data:
support tickets and related correspondence.

● Security data:
security logs, audit trails and access records.

● Application data:
CV, motivation letter, references, and notes from interviews and assessments.

● Event and visitor data:
event registrations, dietary requirements where provided, photos and recordings (with consent), and office visitor registration.

● IoT data:
asset tracking and sensor data from our devices, which we process on behalf of our customers (see section 2.4).

We do not intentionally collect special categories of personal data, such as health data. Our services are intended for businesses and are not directed at children under 16.

● Where we get your data.
We mostly collect personal data directly from you. We may also receive it from:

• your employer, when your organisation is our customer, supplier or partner;
• our group entities;
• public sources such as company websites, the Chamber of Commerce register and LinkedIn;
• events and trade fairs;
• recruitment agencies.

● Required data.
Some data is needed to enter into or perform a contract, deliver the platform, or assess a job application. If you do not provide it, we may not be able to provide the service or consider your application. Other data is optional. We indicate this when we collect it.

2. How we use your information and our legal basis

We process personal data only where the General Data Protection Regulation (GDPR) provides a legal basis. The purposes and legal bases depend on your relationship with us.

2.1 Website visitors

● To operate, maintain, and secure the Site. Legal basis: our legitimate interest in a functioning and secure website (Art. 6(1)(f) GDPR).
● To analyse and improve the Site, and to show you relevant advertising, including retargeting. Legal basis: your consent via our cookie consent manager (Art. 6(1)(a) GDPR). See our Cookie Policy.

2.2 Prospects, customers, and business contacts

● To respond to inquiries, demo requests, and quote requests. Legal basis: steps at your request before entering into a contract (Art. 6(1)(b) GDPR) or our legitimate interest in answering questions about our services (Art. 6(1)(f) GDPR).
● To manage our customer relationships, contracts, and accounts, including in our CRM system. Legal basis: our legitimate interest in performing contracts with the organisation you represent (Art. 6(1)(f) GDPR), or performance of a contract where you are the contracting party (Art. 6(1)(b) GDPR).
● To send newsletters and marketing communications. Legal basis: your consent (Art. 6(1)(a) GDPR), withdrawable at any time. Existing customers may receive information about similar services based on our legitimate interest (Art. 6(1)(f) GDPR), with an opt-out in every message.
● To invoice and keep financial records. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

2.3 Platform and app users

● To create and manage user accounts, authenticate users, and provide the platform. Legal basis: our legitimate interest in providing the service contracted by your organisation (Art. 6(1)(f) GDPR), or performance of a contract (Art. 6(1)(b) GDPR).
● To provide customer support. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) or our legitimate interest (Art. 6(1)(f) GDPR).
● To keep security logs and audit trails, and to detect and prevent misuse and security incidents. Legal basis: our legitimate interest in protecting our systems and data (Art. 6(1)(f) GDPR) and our legal obligations under cybersecurity law (Art. 6(1)(c) GDPR).

2.4 Data we process on behalf of our customers

When our customers use our IoT devices and platform, we process asset tracking and sensor data on their behalf as a processor. The customer is the controller and determines the purposes and legal basis. If you are an employee or end-user of one of our customers, please refer to that customer's privacy notice. We process this data only on documented instructions under a data processing agreement.
Where we use such data to improve our products and services, we do so as a controller, in anonymized or aggregated form wherever possible, based on our legitimate interest (Art. 6(1)(f) GDPR) and within the limits of our customer contracts and the EU Data Act.

2.5 Connected product users and security researchers

● To handle data access and sharing requests under the EU Data Act. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
● To provide security updates, handle vulnerability reports, and meet product security reporting obligations. Legal basis: legal obligation (Art. 6(1)(c) GDPR) and our legitimate interest in secure products (Art. 6(1)(f) GDPR).

2.6 Job applicants

● To assess your application and run the recruitment process. Legal basis: steps at your request before entering into a contract (Art. 6(1)(b) GDPR).
● To keep your details for future vacancies. Legal basis: your consent (Art. 6(1)(a) GDPR).

2.7 Suppliers and partners

● To manage supplier and partner relationships, procurement, and due diligence. Legal basis: our legitimate interest in managing our business relationships (Art. 6(1)(f) GDPR), or performance of a contract (Art. 6(1)(b) GDPR).

2.8 Events, social media, and office visits

● To register and manage event and webinar participation. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Photos and recordings: your consent (Art. 6(1)(a) GDPR).
● To operate our LinkedIn company page and analyse page statistics, jointly with LinkedIn. Legal basis: our legitimate interest in communicating about our company (Art. 6(1)(f) GDPR).
● To register visitors and control access to our office. Legal basis: our legitimate interest in the security of our premises (Art. 6(1)(f) GDPR).

2.9 Legal and compliance

● To comply with legal obligations, including tax law, cybersecurity incident reporting, and requests from authorities. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
● To establish, exercise, or defend legal claims. Legal basis: our legitimate interest in protecting our rights (Art. 6(1)(f) GDPR).

Information about how we process the personal data of our own employees is provided in a separate internal privacy notice.

Where we rely on our legitimate interests, we have balanced these against your rights and interests. You have the right to object to such processing at any time (see section 5). You can withdraw consent at any time; this does not affect the lawfulness of processing before withdrawal.

3. How long we keep your data

We keep personal data no longer than necessary for the purposes for which it was collected, unless a longer retention period is required by law.

4. Data Security

We operate an information security management system aligned with ISO/IEC 27001 and implement appropriate technical and organisational measures to protect personal data against unauthorised access, use, disclosure, alteration or destruction. These measures include encryption of personal data in transit and at rest; role-based access controls, so that only authorised personnel can access data; regular security assessments, vulnerability scanning and audits; and confidentiality obligations for our personnel and service providers.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we notify the Autoriteit Persoonsgegevens within 72 hours. Where the risk is high, we also inform you without undue delay.

5. Data sharing and disclosure

We do not sell or rent your personal information to third parties. We may share your information in the following situations:

●   With Service Providers:We may engage third-party service providers to assist us in operating our Site and providing services. These providers are required to protect your information and may not use it for any other purpose.

●   Legal Requirements:We may disclose your information if required to do so by law or in response to valid requests by public authorities.

6. Your rights

Under the GDPR, you have the following rights:

• Access:obtain confirmation of whether we process your personal data, and a copy of it.
• Rectification:have inaccurate or incomplete personal data corrected.
• Erasure:have your personal data deleted, unless we must keep it to meet a legal obligation or to establish, exercise or defend legal claims.
• Restriction:have the processing of your personal data restricted in certain circumstances.
• Data portability:receive personal data you provided to us in a structured, commonly used and machine-readable format, or have it transferred to another controller, where processing is based on consent or contract and is carried out by automated means.
• Objection:object at any time to processing based on our legitimate interests, on grounds relating to your particular situation. You can always object to direct marketing; we will then stop using your data for that purpose.
• Withdrawal of consent:withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise your rights, contact us at info@clc.io. We respond within one month. This period may be extended by two months for complex requests, in which case we will inform you. We may ask you to verify your identity before handling your request.

If your request concerns IoT data we process on behalf of a customer, we will forward it to that customer, as the controller, and assist them in responding.

Right to complain.If you believe we process your personal data unlawfully, you have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (www.autoriteitpersoonsgegevens.nl), or the supervisory authority in your EU country of residence. We would appreciate the opportunity to address your concern first.

7. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The latest version is always available on our Site, with its effective date. If we make material changes, we will inform you in an appropriate way, for example by a notice on our site or by email.

8. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at info@clc.io

Bright Technology Ventures B.V.
Veemarktkade 8 (Office 7202)
5222 AE ‘s-Hertogenbosch
The Netherlands
info@clc.io

This Privacy Policy should be read together with our Cookie Policy