Privacy Policy & Data Protection Notice

1. Introduction & Data Controller Information

At NorvexaLink ("Company," "we," "us," or "our"), we are committed to upholding the highest standards of data integrity, confidentiality, and commercial privacy. This Privacy Policy details how we collect, process, store, and safeguard your personal data when you visit our website, submit trade enquiries, or engage with our commercial sourcing services.

The designated Data Controller under Regulation (EU) 2016/679 (GDPR) and the Dutch GDPR Implementation Act (Uitvoeringswet AVG) is NorvexaLink, having its registered business office at Voorste Zeedijk 132, 5251 VL Vlijmen, The Netherlands (Telephone: (+31)-(0)63-418 45 48; Email: [email protected] / [email protected]).

2. Categories of Information We Collect

We collect information to facilitate B2B trade coordination, evaluate sourcing feasibility, and maintain digital infrastructure security. We collect:

• Directly Provided Commercial Contact Data: Full name, corporate email address, business telephone number, company name, commercial country/jurisdiction of establishment, category of interest, estimated target volume, and commercial requirements message.
• Technical & Telemetry Data: IP address, browser user-agent string, operating system version, referring URL, timestamp of access, and page request details.
• Anti-Spam Metadata: Form verification strings (`_honey`) and CAPTCHA configurations used to distinguish legitimate corporate trade inquiries from automated bot scrapers.

3. Purposes and Legal Bases for Data Processing (GDPR Article 6)

Under Article 6 of the GDPR, NorvexaLink processes personal data strictly pursuant to lawful grounds:

• Pre-contractual Measures & Contract Performance (Art. 6(1)(b) GDPR): Reviewing commercial requests, calculating freight feasibility, issuing price quotations, drafting proforma invoices, and managing cross-border commercial transactions at your request.
• Legitimate Commercial Interests (Art. 6(1)(f) GDPR): Protecting against spam, cyberattacks, and commercial fraud; verifying counterparty authenticity; maintaining business correspondence; and optimizing website security.
• Compliance with Legal & Fiscal Obligations (Art. 6(1)(c) GDPR): Complying with mandatory Dutch commercial bookkeeping rules, EU customs documentation, and international economic sanctions screening.
• Consent (Art. 6(1)(a) GDPR): Non-essential cookies or direct voluntary subscription to commercial trade updates, which can be withdrawn at any time.

4. Cloud Hosting Infrastructure (Microsoft Azure)

This website and its digital assets are hosted securely on Microsoft Azure in European Union data centers (Western Europe / Netherlands region). Microsoft Azure maintains comprehensive certifications, including ISO/IEC 27001, SOC 1, SOC 2, and SOC 3, and operates in full compliance with the EU GDPR. Data is protected by hardware firewalls, distributed denial-of-service (DDoS) mitigation, and isolated virtual networks.

5. Contact Form Transmission (FormSubmit.co Integration)

To process commercial enquiries smoothly without persistent exposure to public database breaches, our website integrates FormSubmit.co as an encrypted transport mechanism. Form payloads are encrypted in transit using TLS 1.3 and dispatched directly to our corporate email servers via an anonymized cryptographic token (`920b9a0800b827398eda90b88ca315b1`). FormSubmit.co acts strictly as a data processor transmitting your message; it does not sell or lease your enquiry content.

6. Cookies & Tracking Technologies

Our website uses cookies strictly for security, routing, and session integrity. Non-essential analytical cookies are only deployed with your affirmative consent via the Cookie Preferences dialog. You can manage or delete cookies at any time via your browser settings.

7. Data Security Measures

NorvexaLink implements end-to-end 256-bit TLS/SSL encryption for all data exchanged between your web browser and our servers, role-based access controls, anti-autofill and manual typing enforcement on intake forms to prevent credential harvesting, and routine security audits across our Azure perimeter.

8. Data Retention Periods

General commercial enquiries are retained for up to twenty-four (24) months to support ongoing sourcing dialogues. Executed trade contracts and accounting records are retained for a mandatory statutory period of seven (7) years following execution, in strict compliance with Section 2:10 of the Dutch Civil Code (Burgerlijk Wetboek) and Article 52 of the Dutch State Taxes Act (AWR).

9. Your Rights as a Data Subject under the GDPR

You possess full statutory rights under the GDPR, including the Right of Access (Art. 15), Right to Rectification (Art. 16), Right to Erasure (Art. 17), Right to Restriction of Processing (Art. 18), Right to Data Portability (Art. 20), and Right to Object (Art. 21). To exercise your rights, email our Privacy Officer at [email protected].

10. External Links & Social Media Platforms

Our website links to official company presence profiles on corporate social networks (such as LinkedIn) and external logistical registries (Port of Rotterdam customs guides). Third-party sites are governed by their own distinct privacy policies.

11. Children's Privacy Protection

NorvexaLink operates exclusively as a B2B enterprise for business professionals aged 18 and older. We do not knowingly collect personal data from minors under the age of 16.

12. Commercial Communications & Direct Marketing

We do not engage in unsolicited mass electronic marketing. Commercial correspondence is used strictly to respond to specific trade enquiries. You may opt out of bilateral updates at any time by emailing [email protected].

13. International Data Transfers

Where international trade coordination requires communicating cargo parameters outside the European Economic Area, NorvexaLink guarantees adequate protection by executing European Commission Standard Contractual Clauses (SCCs) pursuant to Chapter V of the GDPR.

14. Supervisory Authority (Autoriteit Persoonsgegevens)

You have the statutory right to lodge a formal complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): Postbus 93374, 2509 AJ Den Haag, The Netherlands; Telephone: (+31) - (0)70 - 888 85 00; Website: https://autoriteitpersoonsgegevens.nl.

15. Privacy Policy Updates

We reserve the right to amend this Privacy Policy periodically to reflect technological changes or statutory requirements. Continued use of our website following posted updates constitutes acceptance.

16. Privacy Contact Information