---
title: "Privacy Policy | GDPR & AVG Data Protection | NorvexaLink"
description: "Comprehensive European Union (GDPR / AVG) Privacy Policy for NorvexaLink, an international trading company domiciled in the Netherlands."
canonical: "https://norvexalink.com/privacy"
alternate_markdown: "https://norvexalink.com/privacy.md"
locale: "en_GB"
entity: "NorvexaLink"
country: "The Netherlands"
updated: "2026-10-29"
---

# NorvexaLink Privacy Policy: European Data Protection & GDPR Compliance

NorvexaLink ("Company," "we," "us," or "our") is committed to upholding the highest standards of data integrity, confidentiality, and commercial privacy. This Privacy Policy details how we collect, process, store, and safeguard personal and commercial data in full compliance with Regulation (EU) 2016/679 (the General Data Protection Regulation, or "GDPR") and the Dutch GDPR Implementation Act (*Uitvoeringswet Algemene verordening gegevensbescherming*, or "UAVG").

---

## 1. Designated Data Controller
The designated Data Controller under European data protection legislation is:
- **Legal Entity:** NorvexaLink
- **Commercial Base:** The Netherlands (Kingdom of the Netherlands)
- **Registered Address:** Voorste Zeedijk 132, 5251 VL Vlijmen, The Netherlands
- **Telephone:** (+31)-(0)63-418 45 48
- **Data Protection Officer Email:** privacy@norvexalink.com
- **General Corporate Email:** info@norvexalink.com

## 2. Categories of Information We Collect
We collect information strictly necessary to facilitate B2B trade coordination, evaluate sourcing feasibility, and maintain digital infrastructure security:
1. **Directly Provided Commercial Contact Data:** Full name, corporate email address, business telephone number, company name, commercial country/jurisdiction of establishment, category of interest, estimated target volume, and commercial requirements message.
2. **Technical & Telemetry Data:** IP address, browser user-agent string, operating system version, referring URL, timestamp of access, and page request details.
3. **Anti-Spam Metadata:** Form verification strings (`_honey`) and CAPTCHA configurations used to distinguish legitimate corporate trade inquiries from automated bot scrapers.

## 3. Lawful Bases for Data Processing (GDPR Article 6)
Under Article 6 of the GDPR, NorvexaLink processes personal data strictly pursuant to lawful grounds:
- **Article 6(1)(b) — Pre-Contractual Steps:** Processing is necessary to evaluate trade enquiries, issue price quotations, negotiate supplier matching, and draft commercial proforma contracts at the request of the data subject prior to entering into a contract.
- **Article 6(1)(c) — Legal & Statutory Compliance:** Processing required to fulfill Dutch and European legal obligations, including tax record retention, export control verification, and anti-money laundering (Wwft) screenings.
- **Article 6(1)(f) — Legitimate Interests:** Operating a secure commercial trading platform, mitigating fraud, defending against bot scraping, and managing professional B2B client relationships.
- **Article 6(1)(a) — Explicit Consent:** When a user explicitly opts in or consents to voluntary communications.

## 4. International Data Transfers & Third-Country Safeguards
Whenever personal data is transferred outside the European Economic Area (EEA), NorvexaLink ensures an equivalent level of protection via:
- European Commission Adequacy Decisions (Article 45 GDPR);
- Standard Contractual Clauses (SCCs) approved by the European Commission (Article 46 GDPR);
- Binding Corporate Rules (BCRs) for multinational service providers.

## 5. Data Retention Periods
- **Commercial Enquiry Records:** Retained for two (2) years following initial communication if no active commercial contract results.
- **Contractual & Tax Documentation:** Retained for seven (7) years in compliance with Dutch Civil Code and State Tax Administration (*Belastingdienst*) statutory mandates.
- **Security & Access Server Logs:** Retained for thirty (30) days for intrusion detection and firewall monitoring.

## 6. Your Statutory Rights Under the GDPR
As an EU/EEA data subject, you possess enforceable statutory rights:
1. **Right of Access (Article 15 GDPR)** — Request confirmation and copies of your personal data.
2. **Right to Rectification (Article 16 GDPR)** — Request correction of inaccurate or incomplete personal records.
3. **Right to Erasure / Right to be Forgotten (Article 17 GDPR)** — Request deletion of personal data where retention is no longer legally mandated.
4. **Right to Restriction of Processing (Article 18 GDPR)** — Request temporary suspension of data processing under certain circumstances.
5. **Right to Data Portability (Article 20 GDPR)** — Request machine-readable export of data provided to us.
6. **Right to Object (Article 21 GDPR)** — Object to processing based on legitimate commercial interests.
7. **Right to Lodge a Complaint** — You have the statutory right to lodge a complaint with the Dutch Data Protection Authority (*Autoriteit Persoonsgegevens*):
   - **Address:** Postbus 93374, 2509 AJ Den Haag, The Netherlands
   - **Telephone:** (+31) - (0)70 - 888 85 00
   - **Website:** https://autoriteitpersoonsgegevens.nl

---

## Privacy Officer Contact
- **Department:** NorvexaLink — Data Protection Office
- **Physical Address:** Voorste Zeedijk 132, 5251 VL Vlijmen, The Netherlands
- **Direct Privacy Email:** privacy@norvexalink.com
- **General Inquiries:** info@norvexalink.com
- **Telephone:** (+31)-(0)63-418 45 48