1. Who is responsible?
Commerceyard B.V., Nimrodstraat 13, 5042 WX Tilburg, the Netherlands, Chamber of Commerce number 42070789 and VAT number NL869573044B01, is the controller for the personal data described in this policy. You can contact us at wholesale@commerceyard.nl.
Commerceyard B.V. has not appointed a data protection officer. Privacy questions and requests should therefore be sent directly to the email address above.
2. Scope of this policy
This policy applies to the CommerceYard website and business contacts arising from it. The website is intended for wholesale and distribution partnerships. It has no visitor accounts, online shop, online payments, or sales contracts concluded through the website.
We process information about contact persons at businesses. Business contact details that identify an individual remain personal data under the GDPR.
3. What data do we process?
- Contact form and correspondence: company name, contact name, work email, optional website, optional message, website language, and other information you choose to provide in correspondence.
- CRM data: the content and status of an inquiry, contact history, follow-up notes, marketing preferences, and information needed to manage a potential or existing business relationship in Odoo.
- Technical and security data: IP address, date and time, requested URL, request ID, browser/user-agent, and technical error and security information to the extent logged by Vercel when delivering the website.
- Language preference: your selected website language in the first-party NEXT_LOCALE cookie.
- Marketing data: consent, sending and unsubscribe records, and a minimal suppression record if you object or opt out.
4. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Assessing and answering an inquiry and preparing a possible partnership | Contact form, correspondence, and CRM data | Steps at your request before a contract (GDPR Art. 6(1)(b)) where you act as the potential contracting party; otherwise our legitimate interests in business communication and relationship management (Art. 6(1)(f)). |
| Performing and managing a business relationship | Contact, correspondence, and CRM data | Performance of a contract (Art. 6(1)(b)) or our legitimate interest in communicating with representatives of business partners (Art. 6(1)(f)). |
| Recordkeeping and legal compliance | Business correspondence and data forming part of our records | Compliance with legal obligations (Art. 6(1)(c)), including tax recordkeeping duties. |
| Delivering and securing the website and investigating abuse or faults | Technical log and security data | Our legitimate interest in a secure, reliable, functioning website (Art. 6(1)(f)). |
| Remembering your language choice | NEXT_LOCALE cookie | Our legitimate interest in displaying your chosen language (Art. 6(1)(f)). This cookie is functional and is not used for tracking. |
| Sending relevant direct marketing | Business contact and marketing-preference data | Your consent (Art. 6(1)(a)) or, where the statutory existing-customer exception applies, our legitimate interests (Art. 6(1)(f)). Electronic marketing rules also continue to apply. |
| Establishing, exercising, or defending legal claims | Relevant contact, correspondence, CRM, and log data | Our legitimate interest in legal protection (Art. 6(1)(f)). |
5. Contact, CRM, and direct marketing
The contact form sends your inquiry through Resend to our Microsoft 365 business mailbox. We may then record the inquiry and follow-up in Odoo CRM. The hidden anti-spam field is used only to reject automated submissions.
We send electronic marketing only where legally permitted. New prospects generally require prior, demonstrable consent. The existing-customer exception applies only to our own similar products or services and only with a simple, free opt-out. Submitting the contact form does not itself constitute marketing consent.
You may withdraw consent and object to direct marketing at any time by emailing wholesale@commerceyard.nl or using the opt-out in the message. We will stop marketing and may keep minimal suppression data to respect your choice.
7. Recipients, processors, and international transfers
Where personal data is processed outside the European Economic Area, we use an adequacy decision, European Commission standard contractual clauses, and supplementary safeguards where required. Vercel, Resend, Microsoft, and Odoo publish current processing terms and subprocessor lists. Commerceyard B.V. remains responsible for appropriate vendor review and processing agreements.
- Vercel: hosting, global content delivery, serverless processing of the contact form with Frankfurt, Germany as the primary compute region, security, and technical logging. Vercel may also process data in the United States and other countries.
- Resend (Plus Five Five, Inc.): delivery of contact inquiries by email. Resend processes message content, addresses, and delivery data and may process them in the United States.
- Microsoft 365: receipt, storage, and management of business email. For an EU-provisioned tenant, core content is stored in the EU, with limited international processing under Microsoft's terms.
- Odoo S.A.: CRM and management of prospects and business relationships. Odoo uses hosting and security subprocessors for its cloud services and offers a choice of primary hosting region.
- Authorized staff and, where necessary, professional advisers, public authorities, or parties to a corporate or legal dispute.
8. Retention periods
| Category | Period or criterion |
|---|---|
| Inquiries not resulting in a business relationship, ordinary correspondence, and closed CRM leads | 24 months after the last substantive contact, unless earlier deletion is appropriate or a specific dispute requires longer retention. |
| Active business relationship | For the relationship. Ordinary contact and correspondence data are then deleted or minimized under the period above. |
| Data forming part of legally required business, debtor, creditor, purchase, or sales records | Seven years after the information ceases to have current relevance for the records, or longer where a specific law requires it. |
| Evidence of marketing consent | Up to five years after the last marketing message relying on that consent, so consent can be demonstrated. |
| Marketing suppression list | Minimal data for as long as reasonably necessary to continue honoring an opt-out or objection. |
| Resend email and delivery data | Generally no more than 30 days within the service; after account termination deletion may take up to 90 days under the processor terms. |
| Vercel runtime and security logs | The short period made available by the Vercel plan, no more than 30 days, unless a specific security incident or legal duty requires longer retention. |
| Microsoft 365 and Odoo | Working copies follow the CommerceYard periods above; deleted data may remain temporarily in recovery copies under the controlled settings and provider terms. |
9. Security
We use technical and organizational measures appropriate to the nature and risks of the processing. These include access controls, secure connections, vendor management, data minimization, updates, and incident procedures. No internet service can guarantee absolute security.
Do not send special-category data, passwords, payment details, or other sensitive information through the free-text field unless we have expressly requested it and agreed an appropriate channel in advance.
10. Your privacy rights
Depending on the circumstances, you have rights of access, correction, deletion, restriction, objection, and data portability. Where processing relies on consent, you may withdraw it for the future at any time. You have an unconditional right to object to processing for direct marketing.
Send requests to wholesale@commerceyard.nl and include enough information for us to locate the request and relevant data. We may ask for additional information to verify your identity, but no more than necessary. We normally respond within one month. Legal exceptions may mean we cannot fully comply with every request; if so, we will explain why.
11. Complaints to a supervisory authority
We encourage you to contact us first so we can investigate. You also have the right to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl, or another competent European supervisory authority.
12. No automated decision-making
We do not use personal data obtained through this website for decisions based solely on automated processing that produce legal or similarly significant effects. We do not profile website visitors.
13. Changes and contact
We may update this policy when our website, processing, or the law changes. The current version appears on this page with its last-updated date. We will provide appropriate notice of material changes.
Send questions, requests, or objections to Commerceyard B.V., Nimrodstraat 13, 5042 WX Tilburg, the Netherlands, or wholesale@commerceyard.nl.