Customers

Privacy Statement Somogy

Somogy is a trading name of Grudanov Werkmaatschappij B.V., registered office at Van Moerkerkenlaan 11, 9721 TA Groningen, the Netherlands, registered with the Dutch Chamber of Commerce under number 42004919, VAT number NL869244140B01 (hereinafter: “Somogy”).

This is a translation of the Dutch original, provided for ease of reading. In case of any inconsistency between the two language versions, the Dutch text prevails.

This statement describes how Somogy processes personal data when Somogy acts as controller under the GDPR: for visitors of somogy.nl, for (prospective) customers who reach out, and for Somogy’s own customer administration. For personal data Somogy processes on behalf of business customers as a processor (for example the content of hosted mailboxes or WordPress sites), the separate data processing agreement applies.

1. Controller

The controller within the meaning of Article 4(7) GDPR is:

Somogy has no legal obligation to appoint a Data Protection Officer (DPO). Questions, requests and complaints regarding personal data can be directed to the privacy address above.

2. Personal data Somogy processes

Depending on your interaction with Somogy, the following categories of personal data may be processed:

Somogy does not process special categories of personal data (Art. 9 GDPR) or Dutch citizen-service numbers (BSN). Somogy uses no analytics tool, no tracking pixels and no advertising cookies - see also section 9 and the separate cookie statement.

Source of personal data (Art. 14 GDPR). Where Somogy does not receive personal data directly from the data subject, the data originates from Somogy’s business customer in its role as controller (for example contact details of that customer’s end users), or arises from technical use of somogy.nl (for example IP addresses in server-side access logs).

Automated decision-making (Art. 13(2)(f) GDPR). Somogy does not engage in automated decision-making or profiling within the meaning of Article 22 GDPR.

Per processing activity, the following purposes and legal bases apply:

ProcessingPurposeLegal basis (GDPR Art. 6)
Customer administrationPerforming the contract: service delivery, support, account management and communicationArt. 6(1)(b) - performance of a contract
Invoicing and accountingIssuing, sending and archiving invoices, and complying with the Dutch tax retention obligationArt. 6(1)(c) - legal obligation (Art. 52 AWR)
Contact form / leadsResponding to questions and following up on prospective customer contactsArt. 6(1)(f) - legitimate interest (customer acquisition and communication)
Server-side access logsSecurity, abuse detection, debugging and capacity management of somogy.nlArt. 6(1)(f) - legitimate interest (IT security)

For processing based on a legitimate interest, Somogy has performed a balancing test; you may object under Article 21 GDPR (see section 7).

4. Retention periods

Somogy does not retain personal data longer than necessary for the purpose for which it was collected. Specifically:

Data categoryPeriod
Invoices and accounting records7 years after the end of the financial year (Dutch tax retention obligation)
Customer contracts and related correspondence7 years after the end of the contract (statutes of limitation and tax)
Contact form submissions and leads1 year after last contact, unless converted into a customer relationship
Server-side access logs for somogy.nl30 days

The retention periods are recorded in and reviewed annually. For personal data that Somogy processes on behalf of business customers (mailbox content, WordPress content), the periods in the data processing agreement apply.

5. Sharing with third parties and sub-processors

Somogy shares personal data with third parties only where necessary for service delivery or on the basis of a legal obligation. A current and complete list of sub-processors - with country of processing, purpose and DPA link - is published at somogy.nl/partners.

The standing sub-processors for Somogy’s own operations are, at a high level:

Somogy discloses personal data to government authorities only pursuant to a valid, legally binding order.

6. Transfer outside the EEA

Most personal data stays within the European Economic Area. For transfers outside the EEA the following safeguards apply:

7. Your rights

Under the GDPR you have the following rights regarding your personal data:

You can send your request to privacy@somogy.nl. Somogy will respond within the statutory period of one month (extendable by two months for complex requests, Art. 12(3) GDPR). Somogy may ask for additional information to verify your identity.

If you believe Somogy does not handle your personal data correctly, you always have the right to lodge a complaint with the Dutch data protection authority - the Autoriteit Persoonsgegevens - via autoriteitpersoonsgegevens.nl.

8. Security

Somogy takes appropriate technical and organisational measures to protect personal data against loss or unlawful processing, in accordance with Article 32 GDPR. The measures are documented in Annex B (TOM) of the data processing agreement and include, among others: encryption of backups, least-privilege access, MFA on administrative accounts, active patch management and periodic recovery tests.

9. Cookies

Somogy uses only strictly necessary cookies on somogy.nl (such as a session or security cookie). Somogy does not place any analytical, tracking or advertising cookies. Because only strictly necessary cookies are used, no consent banner is required under Article 11.7a of the Dutch Telecommunications Act. See the cookie statement for the full list.

10. Changes

Somogy may amend this privacy statement from time to time, for instance due to new laws and regulations or changes in its service offering. The most recent version is always available on somogy.nl. For material changes affecting existing customers, those customers are also informed directly.

11. Contact

For all questions, requests and complaints regarding personal data:

12. Version