This privacy policy explains which personal data WIWO Media processes, why we do so, on what legal basis, how long we keep the data and what rights you have. It applies to customers and prospective customers, visitors to wiwomedia.nl and the customer portal mijnwiwo.nl, people who contact us, job applicants and contacts at our suppliers.
This English version is provided for convenience. In case of any discrepancy, the Dutch version prevails.
Who is responsible
WIWO Media is a trade name of CW Nederland B.V. CW Nederland B.V. is the controller within the meaning of the General Data Protection Regulation (GDPR) for the processing described in this policy.
| Name | CW Nederland B.V., trading as WIWO Media |
| Postal address | PO Box 605, 3200 AN Spijkenisse, the Netherlands |
| Chamber of Commerce (KvK) number | 92544347 |
| Phone | +31 10 340 04 44 |
| Email for privacy matters | privacy@wiwomedia.nl |
Further company details are available at /en/company-details.
When we are a processor rather than a controller
When you use our services, such as a website, mailbox, server or telephony service, you store data in them yourself, for example data about your own customers or website visitors. For that data, you are the controller and we are the processor. We only process that data on your instructions. The arrangements are set out in the data processing agreement. This privacy policy covers the data for which we are the controller ourselves.
What data we process, why and for how long
For each group of people, the tables below show which data we process, for what purpose, on which legal basis under Article 6(1) GDPR and how long we keep it.
Customers
| Data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Name, company name, address, email address, phone number, Chamber of Commerce and VAT number, customer number | Entering into and performing the contract, delivering services, communicating about your services | Performance of a contract (b) | As long as you are a customer, then 2 years for any questions or disputes; 7 years where the data forms part of our financial records |
| Billing and payment data, such as orders, invoices, payments, IBAN and direct debit mandate | Invoicing, payments, collection and financial records | Performance of a contract (b) and legal obligation (c) | 7 years after the end of the financial year (statutory tax retention) |
| Domain name registrant data | Registering and managing domain names with the registry | Performance of a contract (b) | As long as the domain name is registered with us, then 2 years; registries apply their own periods |
| Login and account data for the customer portal and control panel (passwords stored in hashed form) | Access to your account and its security | Performance of a contract (b) | As long as the account exists |
| Correspondence, support tickets and notes | Support and handling of questions, incidents and complaints | Performance of a contract (b) and legitimate interest (f) | 2 years after resolution, or longer while the customer relationship continues and the information is needed to provide the service |
| Usage data and payment arrears | Credit management and debt collection | Legitimate interest (f): collecting amounts owed to us | Until the claim has been paid or settled, then 7 years in our financial records |
| Identity and ordering data where fraud is suspected | Preventing fraud and misuse of our services | Legitimate interest (f) | As long as needed for the investigation, then no more than 2 years |
| Data in reports about misuse of our services | Handling notices about unlawful content (notice and takedown) | Legal obligation (c) and legitimate interest (f) | 2 years after resolution |
Prospective customers and people who contact us
| Data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Name, company name, email address, phone number and your message, via the contact form or by email | Answering your question, preparing a quote | Legitimate interest (f) or steps prior to entering into a contract (b) | 1 year after the last contact if no contract follows |
| Name and phone number in a callback request, with the preferred time and subject | Calling you back | Legitimate interest (f) or steps prior to entering into a contract (b) | 1 year after the last contact if no contract follows |
| Quotes and meeting notes | Preparing and recording an offer | Steps prior to entering into a contract (b) | 1 year after the quote is issued if it is not accepted |
Calling us
| Data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Phone number, date, time and duration of the call (call detail records) | Handling your question, calling back, monitoring our availability, securing our phone system | Legitimate interest (f) | No more than 1 year |
| Call notes | Handling your question or report | Performance of a contract (b) or legitimate interest (f) | As for support tickets |
If we record or transcribe calls, we will tell you at the start of the call.
Visitors to our websites
| Data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| IP address, date and time, requested page, browser data (server logs) | Security, detecting misuse and faults, technical management | Legitimate interest (f) | No more than 3 months, unless needed for an ongoing incident investigation |
| Session and security cookies in the customer portal mijnwiwo.nl | Letting you log in, keeping your shopping cart and securing forms | Performance of a contract (b) and legitimate interest (f) | See the cookie policy |
Wiwomedia.nl sets no cookies. We do not use analytics, tracking or advertising cookies on our websites. See the cookie policy for details.
Job applicants
| Data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Name, contact details, CV, cover letter, portfolio and interview notes | Assessing your application and running the recruitment process | Steps prior to entering into a contract (b) and legitimate interest (f) | 4 weeks after the process ends; with your consent, up to 1 year for possible future vacancies |
If you are hired, your data moves to your personnel file, which is covered by a separate privacy notice for employees.
Suppliers and business contacts
| Data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Name, job title and business contact details of contact persons | Purchasing, cooperation and communication | Legitimate interest (f) | For the duration of the relationship, then 2 years |
| Invoice and payment data | Financial records | Legal obligation (c) | 7 years |
No selling of data, no profiling with legal effects
We do not sell personal data, and we do not rent it out or trade it. We do not use your data for third party advertising.
We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Where we use automated tools or AI, for example to sort support requests or flag possible fraud, those tools support our staff. A member of staff takes the decision.
Who we share data with
We only share personal data where this is necessary for the purposes above, where you have consented, or where we are legally required to. We enter into a data processing agreement with parties that process data on our behalf. The categories of recipients are:
| Category of recipient | Purpose | Location |
|---|---|---|
| Payment service providers and banks | Processing payments by iDEAL, credit card, SEPA direct debit and bank transfer | EU |
| Accounting software | Financial records | EU |
| Domain registries and parties that process domain registrations | Registering and managing domain names; registrant data may be public or disclosed on request under the registry's rules | Depending on the extension, also outside the EEA |
| Hosting infrastructure | Data centres housing the servers we manage ourselves, and backup storage | EU (Germany) |
| Email and telephony providers | Sending and receiving email, handling phone calls | EU |
| AI support providers | Sorting support requests and drafting replies, which are always reviewed by a member of staff | EU or outside the EEA, with appropriate safeguards |
| Debt collection agencies, bailiffs and lawyers | Collecting unpaid invoices, after a reminder | The Netherlands |
| Accountant and advisers | Audit and advice, bound by confidentiality | The Netherlands |
| Public authorities | Where we are legally required to, for example to the Dutch Tax Administration or in response to a lawful order from the police or judicial authorities | The Netherlands or EU |
For AI support, we limit the data shared to what is necessary. We choose settings and providers under which data is not used to train AI models, to the extent the provider allows this.
Transfers outside the European Economic Area
Our own servers are located in European data centres. In some cases data is processed by a recipient outside the European Economic Area (EEA), for example for AI support or when registering a domain name with a non-European extension. We only do this where appropriate safeguards are in place, such as an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified recipients) or the European Commission's standard contractual clauses, with supplementary measures where needed. You can request a copy or description of these safeguards at privacy@wiwomedia.nl.
How we protect your data
We take appropriate technical and organisational measures to protect personal data against loss and unlawful processing. These include:
- servers we manage ourselves in European data centres, with a firewall and automatic blocking of suspicious login attempts;
- strict separation between customer accounts;
- encrypted connections (TLS) for our websites, the customer portal and email;
- daily backups stored outside the web server;
- daily malware scans and integrity checks of core files;
- 24/7 automated monitoring of our systems;
- access to personal data only for staff who need it for their work, bound by confidentiality.
We will never ask for your password or payment details by email. We only send email from addresses ending in @wiwomedia.nl or @cwnl.eu. If you receive a message that does not meet these criteria, please contact us at +31 10 340 04 44 or info@wiwomedia.nl.
Your rights
You have the following rights:
- Access: you can ask which personal data we process about you.
- Rectification: you can have inaccurate or incomplete data corrected. You can also update much of your data yourself in the customer portal.
- Erasure: you can ask us to delete your data, unless we are required to keep it, for example under statutory tax retention rules.
- Restriction: you can ask us to temporarily restrict processing, for example while the accuracy of the data is being checked.
- Data portability: you can receive the data you provided to us in a commonly used, machine-readable format, or have it sent to another party.
- Objection: you can object to processing based on our legitimate interest. We will then stop, unless we have compelling grounds that override your interests.
- Withdrawing consent: where we process data based on your consent, you can withdraw it at any time. This does not affect processing carried out before the withdrawal.
Send your request to privacy@wiwomedia.nl. We will respond within one month. For complex or numerous requests, this period may be extended by two further months; if so, we will let you know within the first month. To avoid disclosing data to the wrong person, we may ask you to verify your identity. Please never send a copy of your full identity document showing your photo and national identification number; we will tell you what is needed.
Complaints
If you are not satisfied with how we handle your data, please let us know at privacy@wiwomedia.nl and we will work with you to find a solution. You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the supervisory authority in your own EU country.
Changes
We may update this privacy policy, for example when our services or the law change. The date at the top shows when it was last updated. We will notify customers of significant changes by email.
Contact
For questions about this privacy policy or the processing of your data, contact privacy@wiwomedia.nl, or write to CW Nederland B.V., attn. privacy, PO Box 605, 3200 AN Spijkenisse, the Netherlands.