Privacy statement
1. Who is responsible
Bouwivo (www.bouwivo.nl) is responsible for processing personal data via this website, the customer portal mijn.bouwivo.nl and its own customer administration. Bouwivo is a trade name of Sefa Workx (sole proprietorship, Chamber of Commerce no. 77968832, Ketelven 27, 5464 PS Veghel, the Netherlands); all company details are on Legal information. Send privacy questions to info@bouwivo.nl.
For the data a customer enters in its own Bouwivo environment (the CRM and the B2B ordering portal), that customer is the controller and Bouwivo is the processor. If you are an employee, customer or dealer of a business that uses Bouwivo, please contact that business first about that data. Bouwivo assists that business under the data processing agreement.
2. What data we process
- Company and contact details you enter when ordering: company name, Chamber of Commerce and VAT number, contact name, e-mail address, telephone number and address.
- Account and security data of the customer portal: e-mail address, a hashed form of your password, two-step verification data, sign-in times and a log of important actions.
- Order and payment data: selected modules, amounts, invoices, payment status and Mollie customer and payment references. Bank details are processed by Mollie, not by Bouwivo.
- Communication: e-mails and support requests, and a record of e-mails sent (recipient, subject, time, success – never the content or one-time links).
- Technical data: a hashed form of your IP address to prevent misuse, and technical server logs.
- As processor: the data a customer enters in its Bouwivo environment, such as data of its employees (name, e-mail address, role, sign-in data) and of its customers and dealers (contact, address, quote, order and purchase data). For invitations and password links Bouwivo uses the e-mail address the customer has entered.
3. Purposes and legal bases
- Performance of the contract: creating accounts and environments, sending invitations, implementation, invoicing and support.
- Legal obligation: keeping the accounts (7-year tax retention obligation).
- Legitimate interest: security of the website and the Service, prevention of fraud and misuse, improving the Service with anonymised or aggregated data, and business communication with existing customers.
4. Who we share data with
We share data only with parties needed for our service: Mollie B.V. (payments), our hosting and server provider in the European Union, our e-mail provider (sending invitations, password links, invoices and notifications) and our accountant. Agreements on security and confidentiality are in place with these parties. Data is provided to public authorities where the law requires it. We do not sell data and do not use data for advertising.
5. Transfers outside the EU
The Bouwivo environments and the customer portal run on servers in the European Union. The website loads fonts via Google Fonts; your IP address is passed to Google, which may also process data outside the EU. Google applies the safeguards approved by the European Commission.
6. Retention periods
- Order and invoice data: 7 years due to the tax retention obligation.
- Data of uncompleted orders: 6 months.
- Hashed IP addresses for misuse protection: 24 hours.
- Customer portal account data and the log: as long as the agreement runs and up to 2 years afterwards, unless a longer statutory period applies.
- Data in a Bouwivo environment: until 30 days after the end of the agreement (export period); Bouwivo then deletes the environment and its backups.
7. Cookies and local storage
bouwivo.nl does not use tracking or advertising cookies. The customer portal uses one functional session cookie to keep you signed in. The CRM stores your sign-in session and settings (such as language, display and a draft order list) in your browser. No consent is needed because this storage is strictly necessary for the service you use.
8. Security
The website and the Service work exclusively over an encrypted connection (HTTPS). Every customer has its own isolated environment with its own database. Passwords are stored only in hashed form, two-step verification is mandatory for the main administrator, backups are encrypted and access to data is limited to persons who need it for their work. Despite these measures, no system can guarantee complete security. If you find a vulnerability, please report it via Legal information.
9. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection. Send your request to info@bouwivo.nl; we respond within one month and may ask you to verify your identity. If the request concerns data in the environment of a business that uses Bouwivo, we forward it to that business. If you disagree with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
10. Changes
We may update this privacy statement. The current version is always on this page; we inform customers of important changes by e-mail or in the Service.