Partner portal privacy statement. For SalesControl's restricted B2B area and information under Articles 13 and 14 GDPR. This statement applies to the partner portal, not to the public website salescontrol.eu. It is intended for advisers and other staff of German kitchen studios who are given access.
Language note. This English translation is provided for convenience. The Dutch version (PRIV-PLAT-NL) is the authoritative text; if interpretations differ, the Dutch text prevails.
1. Controller
Controller for the portal: UrbanPanda International B.V., trading as SalesControl, Wierdensestraat 149, 7604 BE Almelo, the Netherlands. Represented by W. A. Hoving. Chamber of Commerce number 63244977. E-mail info@salescontrol.eu. Telephone +31 85 107 0200.
No data protection officer has been appointed; there is no appointment obligation under Article 37 GDPR.
Your employer, the kitchen studio, is responsible for your employment relationship and for what it does with your data. This statement covers only what we process in the portal.
2. Who this statement applies to
It applies to advisers and other staff of a German kitchen studio who have been given access to the partner portal by the studio. User accounts, login credentials and the data of referred enquiries are held in the portal.
Visitors to salescontrol.eu are covered by the separate privacy statement for that website. Dutch consumers whose enquiries you see in the portal are covered by the privacy statement on keukensoverdegrens.nl.
3. Your user account
For each account we record:
- first and last name and role;
- the kitchen studio and branch to which you are assigned;
- business e-mail address and business telephone number;
- the languages in which you provide advice, so that enquiries can be assigned to the appropriate language;
- username, a cryptographic hash of your password and, where enabled, two-factor authentication settings.
Your password itself is not stored and cannot be read by us. We do not need private contact details; please do not enter them.
4. Where we obtained your data
We did not obtain your data directly from you, but from your employer when the studio registered as a partner or when it later created an account for you. Article 14 GDPR requires us to tell you this; we do so here and when you first sign in to the portal.
The studio contractually assures us that it may lawfully provide your data and that it has informed you.
5. Log data
The portal keeps a log so that it remains traceable who handled each enquiry. We record:
- sign-in and sign-out times, IP address and browser;
- which enquiry was opened when and which status was set;
- notes you add to an enquiry, together with your name and the time;
- failed sign-in attempts.
Purpose: access security, traceability of handling and investigation of faults. Legal basis: Article 6(1)(f) GDPR.
6. Performance figures and employee participation
The logs produce figures showing how many enquiries were assigned, how many appointments resulted and how many became orders. We calculate remuneration solely on the average for the entire partner business, not per adviser. We do not rank individual employees or give your employer an assessment of you as a person.
A system from which individual performance can be inferred is nevertheless not neutral under employment law. If your business has a works council, § 87(1)(6) BetrVG gives it co-determination rights when technical systems intended to monitor employee behaviour or performance are introduced or used. Your employer is responsible for obtaining that participation before creating accounts.
What we show your employer: your studio sees the handling of each enquiry and therefore also who handled it. This cannot be separated without losing traceability. How your employer uses this information is its responsibility and is governed by German employment and data-protection law.
7. Consumer enquiry data
The portal contains data of Dutch consumers who submitted an enquiry through our portals: name, telephone number, e-mail address, place of residence, budget indication, timing, any brand preference and preferred language.
For these data, we and your studio are joint controllers under Article 26 GDPR during selection and transfer; your studio is then the sole controller. The allocation of responsibilities is set out in the data-sharing agreement between us and your studio.
Permitted use: arranging the appointment, advising, planning, making an offer and performing any resulting order. Not permitted: adding these data to your own newsletter, mailing or advertising list, uploading them to an advertising account or passing them to third parties. This has been agreed with your employer.
8. Legal bases
- Operating your account and assigning enquiries: Article 6(1)(f) GDPR. This is based on our legitimate interest in performing the partnership with your studio. Without a named contact for each branch and language, an enquiry cannot be assigned meaningfully.
- Logging and access security: Article 6(1)(f) GDPR.
- Consumer enquiry data: Article 6(1)(b) GDPR in conjunction with Article 26 GDPR.
- Statutory retention: Article 6(1)(c) GDPR.
Where national law on employee data under Article 88 GDPR imposes stricter requirements, those requirements also apply in relation to your employer.
9. Recipients and hosting
- Your kitchen studio, as partner and, for enquiry data, as an independent controller.
- DigitalOcean, LLC, 105 Edgeview Drive, Suite 425, Broomfield, CO 80021, USA, is the portal host and a processor under Article 28 GDPR, with servers in the Amsterdam data centre. The data are therefore held in the European Union; the company itself is established in the United States and relies for that situation on its EU-U.S. Data Privacy Framework certification, with the Standard Contractual Clauses as a fallback.
- Namecheap, Inc., Phoenix, USA, where the portal sends e-mails to you; its servers are in the United States and are safeguarded by the Standard Contractual Clauses under Article 46(2)(c) GDPR.
- Public authorities where we are legally required to disclose data.
We do not sell data. Other partner studios cannot see your data or your enquiries.
10. Retention periods
- User account: while your access exists; after the partnership ends or you leave, we deactivate it immediately and delete it after 3 months.
- Log data: 12 months, then deletion.
- Notes on an enquiry: for as long as the enquiry is retained.
- Enquiry data: under the data-sharing agreement, 3 months without an appointment, 12 months after an appointment without an order and, where there is an order, for the statutory periods.
- Accounting records: 7 years under Article 52 of the Dutch Algemene wet inzake rijksbelastingen.
11. Your rights and right to complain
You have the rights set out in Articles 15 to 21 GDPR: access, rectification, erasure, restriction, data portability and objection to processing based on Article 6(1)(f).
A message to info@salescontrol.eu is sufficient; we will respond within one month. If your request concerns your employer, we will forward it within three working days and tell you that we have done so.
You may lodge a complaint under Article 77 GDPR with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), Postbus 93374, 2509 AJ The Hague, or with the data-protection authority of your German federal state.
12. Security and your duties
The portal is available only over an encrypted connection. We take measures under Article 32 GDPR, including personal accounts, tiered role permissions, logging and, where enabled, two-factor authentication.
We expect you not to share your access or use a joint account for several people, not to store enquiry data on private devices or in private mailboxes, and to inform us immediately if your access may have been compromised.
13. No automated decision-making
People decide which enquiry fits which branch and language. There is no automated individual decision-making, including profiling, within the meaning of Article 22 GDPR, and we do not create a profile of you.