Introduction

This privacy policy explains the ways in which we process your personal data. The term 'personal data' means any information relating to an identified or identifiable natural person. In addition, this policy contains information about your privacy rights and our obligations. The privacy policy is divided into the following sections:

1. Who are we?
2. Which personal data do we process, for what purposes and on what basis do we do this?
3. Who may we share your personal data with?
4. How do we protect your personal data?
5. How long do we retain your personal data?
6. What are your privacy rights and how can you exercise them?
7. Where can you go if you have a complaint or question about the processing of your personal data?

We reserve the right to change this privacy policy. The most recent version of this privacy policy is available on our website. In the event of substantial changes that could significantly affect one or more data subjects, we will endeavor to inform these data subjects directly.

1. Who are we?

We are The Doctor Group BV. In the course of our activities, we may process personal data. Under the applicable data protection legislation – in particular the General Data Protection Regulation (GDPR) – The Doctor Group BV (hereinafter: we, us) qualifies as the controller.

2. Which personal data do we process, for what purposes and on what basis do we do this?

Depending on the relationship you have with us, we process certain personal data.

• If you have ordered a product in our webshop, we refer you to section 2.1 of this privacy policy.
• If you visit our website, we refer you to section 2.2 of this privacy policy.
• If you email us or otherwise contact us, we refer you to section 2.3 of this privacy policy.

In these sections we also always indicate why we process this personal data ('purposes') and on which legal basis we base this. We process your personal data on one or more of the following legal bases:

1. when this is necessary for the performance of a contract to which you are a party or to take pre-contractual steps at your request;
2. when this is necessary to comply with a legal obligation;
3. when this is necessary for the purposes of our legitimate interests or the interests of a third party;
4. with your permission.

When we process your personal data based on your consent, we will ask you for this separately. You may withdraw your consent at any time (see also below in section 6. “What are your privacy rights and how can you exercise them?”). We would like to point out that withdrawing your consent does not affect the lawfulness of the processing of your personal data before the withdrawal of your consent.

When processing is based on the basis of 'legitimate interest', this interest is briefly explained. If you have specific questions about this, you can of course always contact us.

2.1 You have ordered a product in our webshop

When you order a product in our webshop, we may process the following personal data that you provide to us:

• initials, first and last name, title, gender, address details;
• other contact details such as telephone number, e-mail address and fax number;
• Payment details (including bank account number), order information.

Below we indicate for which purposes we process these personal data, with the associated grounds (a/d as described above):

• to be able to offer and provide the agreed services to you, including creating an account with the option to log in and being able to place an order (a, b, c: the interest in being able to offer and provide services);
• to be able to draw up and conclude agreements with you (a, b, c: the interest in being able to offer or purchase services);
• to be able to keep correct administration (a, b, c: the importance of being able to keep correct administration);
• to optimize and personalize your shopping experience (c: the interest in being able to offer you the best possible and personalized shopping experience and d);
• to maintain contact and communicate with you (a, b, c: the importance of bringing our services to the attention of existing customers);
• to send you newsletters and keep you informed of offers (c: the interest of bringing our services to the attention of existing customers, d);
• to be able to send you a review request (d);
• to handle any complaints and disputes, including assessing our legal position, defending it and exercising our rights (a, b and c: to defend rights, to maintain and improve existing relationships through good complaint handling, to improve the quality of the service);
• to comply with our legal obligations (b, c: the interest in being able to comply with these legal obligations).
• If you register for our newsletter, we will use the data required for this or separately provided by you to send you our e-mail newsletter on a regular basis based on your consent. You can unsubscribe from the newsletter at any time by sending a message to us or via a link included for this purpose in the newsletter .

2.2 You visit our website

When you visit our website, we may process your personal data, such as:

• data relating to the operating system, browser used, IP address,
• data relating to the unique identifiers associated with the device used,
• data relating to the internet pages consulted,
• data about products viewed online (including information about products searched for or viewed, purchased or added to an online shopping cart),
• data regarding the time spent on particular parts of the site or an interface site or application, including the date and time of the visit.

Below we indicate for which purposes we process these personal data, with the associated grounds (a/d as described above):

• to optimize and personalize your shopping experience (c: the interest in being able to offer you the best possible and personalized shopping experience and d);
• to personalize your shopping experience based on your account information and search, browsing and purchase history (c: the interest in providing you with the best possible and personalized shopping experience and d);
• to be able to send you personalized advertisements (c: the interest in being able to offer you the best possible and personalized shopping experience and d);
• to be able to perform generic analyses with regard to surfing behaviour on our website(s) (c: the interest in being able to organise our website as well as possible);
• to send you newsletters and keep you informed of offers (c: the interest of bringing our services to the attention of existing customers, d);
• to handle any complaints and disputes, including assessing our legal position, defending it and exercising our rights (a, b and c: to defend rights, to maintain and improve existing relationships through good complaint handling, to improve the quality of the service);
• to comply with our legal obligations (b, c: the interest in being able to comply with these legal obligations).

We collect this data by using cookies and similar techniques. Cookies are small text files that are placed in your browser when a website is visited. Cookies can process personal data. For more information about the use of cookies, please read our cookie policy.

2.3 You email us or otherwise contact us

When you email us or contact us, we may process the following personal data if you provide it to us:

• first and last name, email address, telephone number and/or the content of your email.

Below we indicate for which purposes we process these personal data, with the associated grounds (a/d as described above):

• to answer your questions and provide you with information (b, c: our and your interest in answering your questions, providing you with information and optimising our services);
• to handle any complaints and disputes, including assessing our legal position, defending it and exercising our rights (a, b and c: to defend rights, to maintain and improve existing relationships through good complaint handling, to improve the quality of the service);
• to comply with our legal obligations (b, c: the interest in being able to comply with these legal obligations).

3. With whom may we share your personal data?

We do not provide your personal data to third parties ('recipients' within the meaning of privacy legislation), unless this is necessary for the proper execution of the purposes described in this privacy policy, when this is legally required or when you have given permission for this. The third parties to whom the personal data is made available are obliged to treat your personal data confidentially. If these parties are regarded as 'processors' within the meaning of privacy legislation, we ensure that a processing agreement is concluded with these parties that meets the applicable requirements.

We may share your information with:

• our employees (on a 'need-to-know' basis);
• entities affiliated with us;
• suppliers (e.g. software suppliers, parcel delivery companies and other courier services, accountants, law firms and notary offices, etc.);
• courts and government institutions;
• other parties, such as regulators and other authorities if required by law or with your consent.

Finally, we note that if we go bankrupt, your data may be shared with the trustee appointed in the bankruptcy.

We may transfer your personal data to a recipient in a country outside the European Union that offers a lower level of protection of personal data than European law. In that case, we will ensure that such transfer of personal data is in accordance with the applicable laws and regulations, for example by concluding a model contract drawn up and approved for that purpose by the European Commission and we will assess whether additional measures are necessary to ensure an appropriate level of protection of your personal data.

4. How long do we store your personal data?

We do not retain your personal data in an identifiable form for longer than is necessary to achieve the purposes stated in this privacy policy. More specifically, we use the following retention periods:

• personal data that must be administered on the basis of Article 52 of the General Tax Act (AWR) will be retained for 7 years (from the end of the year in which the data in question have lost their current importance for (tax) business operations) in connection with the tax retention obligation imposed on us under Article 52 paragraph 4 AWR;
• Camera images taken at our locations are automatically overwritten after 30 days.

The specific retention periods mentioned above may be extended if statutory retention obligations apply/become applicable. We may also retain personal data for a longer period if this is necessary for the settlement of incidents and/or legal disputes.

5. How do we protect your personal data?

We have taken technical, organizational and administrative measures to protect your personal data. These measures include the use of firewalls, authentication passwords and limited access. In addition, a security policy has been implemented. For questions about the security of your personal data, or if you suspect or have indications of abuse, you can contact our customer service .

6. What are your privacy rights and how can you exercise them?

When we process your personal data, you as a data subject have certain privacy rights. You have:

• the right to clear information about what we do with your personal data;
• the right to request whether we process personal data about you and, if so, the right to access your personal data and the right to certain information about the processing of your personal data;
• the right to rectify and supplement your personal data if they are incorrect or incomplete;
• the right to have your personal data erased (the 'right to be forgotten');
• the right to restriction of processing of your personal data;
• the right to receive or transmit your personal data to a third party designated by you in a structured, commonly used and machine-readable format (the 'right to data portability');
• the right to object to the processing of your personal data;
• the right to withdraw your consent to the processing of your personal data, where the processing is based on your consent.

We do not use automated decision-making within the meaning of Art. 22 GDPR.

To exercise your rights, you can contact us via our customer service .

In order to prevent us from providing information to the wrong person, we may ask for additional information to verify your identity. In principle, we will inform you within one month of receipt of your request whether we can comply with your request. This period may be extended by two months in specific cases, e.g. when a complex request is involved. We will inform you of such an extension within one month of receipt of your request. Under privacy legislation, we may refuse your request under certain circumstances. If this is the case, we will explain why. More information about your privacy rights can be found on the website of the Dutch Data Protection Authority .

7. Where can you go if you have a complaint or question about the processing of your personal data?

If you have a complaint about the processing of your personal data by us, we will try to resolve this together with you. If this does not lead to the desired result, you have the right to file a complaint with the competent supervisory authority. In the Netherlands, this is the Dutch Data Protection Authority . If you live or work in another country of the European Union, you can file a complaint with the supervisory authority in that country.

If you have any questions about your privacy rights, this privacy policy or the processing of your personal data, please feel free to contact us via our customer service .