Draft: this text has not been legally checked yet.

Privacy notice

This notice explains which personal data LTSD Desk (https://ltsd.molenista.nl) processes, why, and what your rights are.

Controller

Angelista Enterprise B.V., Zeeltsloot 17, 2427 EA Zoetermeer, Nederland, KVK 88867013. Contact: angelista.enterprise@mailbox.org. We have not appointed a data protection officer; we are not required to.

Purposes

Requesting, having signed and keeping supplier's declarations of preferential origin (Implementing Regulation (EU) 2015/2447, Annexes 22-15 and 22-16).

Which data

• User e-mail address (sign-in)
• Name and e-mail address of exporters
• Name, e-mail address and language of suppliers, and the products they supply
• Content of the declaration: signer's name and position, company name and address, place, time and IP address of signing

Legal basis

• Performance of the contract with your organisation: account, login, the service itself and support (GDPR art. 6(1)(b)).
• Legal obligation: invoices and bookkeeping (GDPR art. 6(1)(c), 7-year Dutch tax retention).
• Legitimate interest: security, debugging and business contact with organisations (GDPR art. 6(1)(f)). You can object at any time.

Files you upload

If your files contain personal data of others (for example your clients), we process that data only on your behalf, under our data processing agreement.

Retention

As long as the account exists. We keep signed declarations as long as the customer may need them for a customs audit, or until the customer asks us to delete them.

An account unused for 60 months without a running plan is deleted automatically with all its data.

We keep invoice data for 7 years because the law requires it.

Recipients

We do not sell data. Only these processors work for us, under a data processing agreement:

• OVHcloud SAS, Roubaix, France (hosting of server and database)
• Heinlein Hosting GmbH (mailbox.org), Berlin, Germany (sending and receiving e-mail)
• Mollie B.V., Amsterdam, Netherlands (payments)

All data stays in the European Economic Area.

Your rights

You may access, correct or erase your data, restrict processing, object, and take your data with you (GDPR art. 15 to 21). Write to angelista.enterprise@mailbox.org. We answer within one month. We make no decisions based solely on automated processing.

Contact form

Through the contact form we receive your name, e-mail address and message. We use them only to answer you (GDPR art. 6(1)(f), or (b) if it is about your account). The app does not store the message: it arrives as an e-mail in our mailbox at mailbox.org. We delete it when your question is handled, at the latest after 12 months.

Business outreach

We sometimes contact organisations about a product that fits their work. For this we use business data only: the organisation's name, a generic e-mail address (such as info@), the postal address or the general phone number. We take these from public sources: company registers (KVK, KBO, SIRENE), professional registers and the organisation's website. Legal basis: legitimate interest in offering our services to organisations (GDPR art. 6(1)(f)). We send at most three messages. To hear nothing more, reply STOP or e-mail us: we stop at once and keep only an irreversible hash of your address on a block list, so we do not contact you again. We delete other data at the latest 24 months after the last contact.

Complaints

You can complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens, or to the authority in your own EU country.