--- title: Privacy statement date: 2021-06-25T10:12:42+02:00 author: "info@visited.nl" canonical_url: "https://www.bom.nl/en/privacy-statement" section: Pages --- # Privacy statement This privacy statement applies to the processing of personal data of our external relations by BOM Holding B.V. and its group companies and subsidiaries. ## **Who are we?** We are BOM, i.e. Brabantse Ontwikkelings Maatschappij Holding B.V. (BOM Holding B.V. and its subsidiaries and group companies). More information about BOM can be found on our website. For the structure of BOM, please see [the organisational overview](https://d3d5gk1jdgmand.cloudfront.net/main/Bom-lijst-entiteiten.png). Details of the various group companies of BOM Holding B.V. can be found in [the overview of group companies](https://d3d5gk1jdgmand.cloudfront.net/main/Structuurschema-BOM-Holding-1-januari-2025.pdf). Our mission can be found here: [*Mission & Strategy | Brabantse Ontwikkelings Maatschappij*.](https://www.bom.nl/en/mission-strategy) ##### **General contact details** Goirlese Weg 15 5026 PB Tilburg P.O. Box 3240 5003 DE Tilburg info@bom.nl If you have any questions, complaints or requests regarding the processing of your personal data and/or wish to report a data breach, you may also contact us via [meldpunt\_BOM\_security\_privacy@bom.nl](mailto:meldpunt_BOM_security_privacy@bom.nl). ## **Why are we allowed to process your personal data (legal basis)?** We process your personal data (a) if you have given your consent, (b) if this is necessary to enter into or perform a contract, (c) if this is necessary to comply with a legal obligation, (d) if this is necessary for the conduct of our operations, or (e) if this is necessary for the performance of a task carried out in the public interest. For each processing purpose, we have indicated the applicable legal basis or bases using the letters (a) to (e). If we process personal data on the basis of your consent, you may withdraw that consent at any time. To do so, please contact us using the contact details above. The processing of your personal data up to the moment of withdrawal remains lawful. ## **Why do we process your personal data (processing purposes)?** We process your personal data because it is necessary for our mission. What this entails is explained below. We process your personal data for one or more of the following purposes: - Because you are in contact with us about, or make use of, our products or services, or because you have been invited to or have attended one of our events (a, b, d). - Because you have requested information from us (a) or because you have provided information in the context of research carried out or supported by us in connection with our mission (a, d, e). - Because you are subscribed to one of our newsletters (a, b). - Because we require your data in order to assess whether we can enter into a relationship with you (b, c, d). - Because we require your data to comply with our mutual agreements (b). - Because we require your data for administrative purposes (c, d). - Because we require your data for management information and accountability purposes (d, c). - Because we require your data for audit purposes, for handling irregularities that we have identified, and for internal training purposes (d). - Because you have visited our website (d). - To evaluate and improve our services (d). - Because we require your data for another purpose about which we have informed you separately (compatible use). - Because we require your data for the implementation of a subsidy scheme or other government scheme that we administer (e). - Because we require your data for the purposes of a recruitment procedure (d). - Because we require your data for the purposes of an assessment procedure (d). - To comply with legal and regulatory obligations (c). - For the handling of disputes (d). - To contact you in the context of market research or other research related to our mission (a, d). ## **Which categories of personal data do we process?** - Identifying data, including citizen service number (BSN) - Data relating to your interests, preferences and competencies - Your contact details - Your financial data - Background data, including skills and experience - Data relating to your relationship with your company - Data relating to your activities on our website We only process these data insofar as they are necessary for one or more of the processing purposes described above. ## **Sources of personal data** We obtain personal data from the following sources: - From you, or on your instructions - From agreements and other documentation to which we are both a party - From public sources, such as the Dutch Chamber of Commerce, LinkedIn, Company.info and the insolvency register - From media sources, including printed and electronic media, search engines and AI applications - From websites where you leave information ## **Retention periods** We do not retain your personal data for longer than necessary for the purposes for which they were collected or subsequently processed. For certain processing activities, we apply the following specific retention periods: - Personal data retained for tax purposes: 5, 7 or 10 years - Personal data retained for accounting obligations: 7 or 10 years - Personal data retained under the Dutch Anti-Money Laundering and Anti-Terrorist Financing Act (Wwft): 5 years - Data relating to loans granted and equity participations entered into: 5 or 20 years - CCTV footage: no longer than 4 weeks, unless an incident requires longer retention - Data required for evidentiary purposes: 5 or 20 years - Data relating to job applicants: deleted 4 weeks after completion of the recruitment procedure, unless the applicant enters into our employment or gives consent for longer retention (maximum 1 year) - Data retained for assessment reports of companies: 5 years ## **With whom do we share your personal data?** We only share your personal data where necessary for one of the processing purposes, and only with the following categories of recipients: - (Employees of) group companies within BOM - Shareholders of BOM, including the Ministry of Economic Affairs and/or the Province of North Brabant - The Ministry of Defence (in the context of SecFund and DIANA) - Other Regional Development Agencies (ROMs) and InvestNL - Parties within the start-up ecosystem with whom we cooperate, such as Brainport, Braventure, The Gate and TechLeap - Universities, research institutes and interest organisations in connection with research into the start-up and scale-up landscape, the business climate or local ecosystems - Parties for whom we facilitate applications, such as the Brabant Start-up Fund - Supervisory authorities, such as the Dutch Tax Administration - Processors engaged by us, for example for hosting, monitoring and analytics services - External advisers, such as accountants and lawyers - Parties involved in - agreements entered into with you, or - in projects (EDIH), or - programmes in which you participate (Startup Readiness Programme (SRP), VC Readiness Programme (VCRP), Investor Readiness Programme and related programmes, and the Business Innovation Program Food (BIPF)), or - our products that you use - Parties that we engage to help us make well-considered investment decisions - Parties within the networks of NFIA (Invest in Holland) and RVO (Trade & Innovate NL) with whom further cooperation arrangements have been made in the context of projects, including company visits, events and missions We do not share personal data with recipients outside the European Union. If, in exceptional cases, personal data are shared by us with recipients outside the European Union, we will inform you and ensure that appropriate safeguards are in place in accordance with the General Data Protection Regulation (GDPR). Where companies process your personal data on our behalf, we enter into data processing agreements where required, in order to ensure a level of security and confidentiality comparable to that of BOM. We remain responsible for these processing activities. If our website links to third-party websites, your personal data may be processed by those third parties. For the use of third-party websites, please refer to the privacy statements of those websites. ## **Consequences of not providing personal data** Failure to provide personal data may result in us being unable to provide our services. ## **Automated decision-making** We do not take decisions with (significant) consequences for individuals or for you as an entrepreneur that are based solely on automated processing. This concerns decisions taken by computer programs or systems without human intervention, such as assessment by a BOM employee. ## **How we protect your personal data** We take the protection of your personal data seriously and implement appropriate technical and organisational measures to prevent misuse, loss, unauthorised access, unwanted disclosure and unlawful modification. These measures include, among other things, access controls (MFA), appropriate system and network security measures such as firewalls, encryption and patches, protection of portable devices using appropriate authentication methods, and confidentiality obligations for all employees. If you believe that your personal data are not adequately protected or if you have indications of misuse, or if you have any other questions, please contact us using the contact details above. ## **Cookies** For information about the cookies we use, please refer to our [cookie policy](https://www.bom.nl/cookieverklaring) on our website. ## **What are your rights?** If you have a complaint, question or concern about how we use your personal data, please contact us using the contact details above. If you contact us to exercise your rights, we will respond within one month. In exceptional circumstances, this period may be extended (up to a maximum of three months), in which case we will inform you within one month of the reason for the delay. Please make clear which right you wish to exercise and how you wish to receive the information. In some cases, we may require additional information, such as a copy of your identification document, to verify your identity. #### **Right of access** You have the right to ask which personal data we hold about you. We can provide you with a free copy of these data, but not in all cases, as we must also respect the rights and freedoms of others. #### **Right to rectification** If you believe that your personal data are inaccurate or outdated, you have the right to request correction. #### **Right to object** You have the right to ask us to stop processing your personal data. If we are legally obliged to retain certain personal data, we cannot comply with such a request. #### **Right to restriction of processing** You have the right to request restriction of the processing of your personal data, for example while we are verifying their accuracy. #### **Right to erasure (right to be forgotten)** You have the right to request deletion of your personal data. If we are legally obliged to retain certain personal data, we cannot comply with such a request. #### **Right to withdraw consent** Where processing is based on your consent, you may withdraw that consent at any time. #### **Right to lodge a complaint** If you disagree with the way we process your personal data, you may at any time lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): ## **Changes to the Privacy Statement** BOM may amend, modify or supplement this Privacy Statement for various reasons. We invite you to consult this Privacy Statement regularly to stay informed. This version was adopted in **March 2026**. In some cases, BOM has laid down a more detailed description of the processing of personal data in a separate privacy statement, including: - For the implementation of the Corona Bridging Loan (COL): [*Privacyverklaring-COL-met-aanvulling-VS-en-TOPPS\_10032021.pdf (rom-nederland.nl)*](https://www.rom-nederland.nl/wp-content/uploads/sites/18/2021/03/Privacyverklaring-COL-met-aanvulling-VS-en-TOPPS_10032021.pdf)