e-influence Privacy Statement

Version dated August 24, 2026

This privacy statement applies to the processing of personal data by e-influence in connection with our websites, services, and business activities, including through:

• e-influence.eu
• e-influence.de
• e-influence.eu

e-influence processes personal data in accordance with the General Data Protection Regulation (GDPR / DSGVO) and, where applicable, additional national privacy and cookie laws within the European Union.

1. Who is responsible for your personal data?

e-influence (“e-influence,” “we,” or “us”), located at Ir. Schiffstraat 290, 7547 RD Enschede (Overijssel), the Netherlands, and registered with the Chamber of Commerce under number 81856237, is the data controller for the personal data processed in connection with our websites and services.

For privacy questions or requests regarding personal data, please contact us at:

legal@e-influence.eu

Data Protection Officer

e-influence has appointed a Data Protection Officer (DPO). This role is filled by Willem, Head of Regulatory Affairs at e-influence. The DPO can be reached at:

legal@e-influence.eu

2. What personal data do we process?

Depending on how you contact us or use our websites or services, we may process the following categories of personal data, among others.

Contact and Communication Information

Such as:

• name
• company name
• function
• Contact Information
• Email address
• phone number
• messages, requests, and business correspondence

Customer, quote, order, and project data

Such as:

• Company and Contact Information
• requests
• quotes
• Projects
• Orders
• Shipping Information
• Project Information
• Customer and Order History
• Information and documents you provide
• other information necessary for us to provide our services

Payment and Financial Information

Such as:

• billing information
• payment status
• Payment Information
• account holder
• bank account number
• Information about payments and refunds
• other information necessary for our financial records

Business correspondence and file information

Such as:

• Emails
• Agreements
• quotes
• Documents
• project communication
• Complaints and Requests
• Communication regarding the performance or termination of a contract
• other information that forms part of a business or administrative file

Website and Technical Information

Such as:

• IP address
• Browser and Device Information
• date and time of visit
• Log data
• Cookie and Consent Information
• Pages Visited
• Technical information about the use of our websites

Marketing Data

Such as:

• name
• Email address
• Company Information
• Marketing Preferences
• Consent Registration or Unsubscribe

3. For what purposes and on what legal grounds do we process personal data?

We process personal data only when there is a valid legal basis for doing so.

Performance or Preparation of a Contract

We process personal data when it is necessary to take steps at your request prior to entering into a contract or to fulfill a contract.

This may include, among other things:

• Requests and Quotes
• Customer Contact
• Orders
• Product and Project Development
• Delivery and Fulfillment
• Billing and Payments
• Customer Service
• Execution and fulfillment of agreements

Legal basis: Article 6(1)(b) of the GDPR.

Legal Obligations

We process personal data when necessary to comply with legal obligations, such as those related to tax, administrative, or accounting matters.

Legal basis: Article 6(1)(c) of the GDPR.

Legitimate Interests

Where necessary, we may process personal data based on our legitimate interests or those of a third party, provided that the interests, fundamental rights, and freedoms of the data subject do not take precedence.

These legitimate interests may include, among other things:

• Proper management of business, customer, project, and file records
• Security of our websites, systems, and business operations
• Preventing and investigating fraud, abuse, and security incidents
• Improving and protecting our services
• business communication with existing and potential business contacts
• Handling of Complaints and Disputes
• Protection of our business interests
• evidence
• establishing, exercising, or defending legal claims

Legal basis: Article 6(1)(f) of the GDPR.

When applying this principle, we assess whether our interests outweigh the interests, rights, and freedoms of the data subject, as required by the GDPR.

Consent

For certain processing activities, we ask for your consent in advance, for example, when it is required by law for certain marketing, analytics, or tracking activities.

Legal basis: Article 6(1)(a) of the GDPR.

Consent that has been given may be withdrawn at any time.

4. Special categories of personal data

As a general rule, we do not request special categories of personal data, such as information regarding health, religion, political views, sexual orientation, or ethnic origin.

If such personal data is nevertheless provided to us, we will process it only to the extent that there is a valid legal basis for doing so.

We ask users not to provide any sensitive personal data unless it is necessary for our services.

5. How do we collect personal data?

We collect personal data primarily:

• directly from the data subject
• through our websites, forms, and configurators
• via email, phone, and other business communications
• when requesting or using our services
• through orders, payments, and administrative processes

In certain cases, personal data may also come from:

• the organization for which a person works or that a person represents
• business partners or service providers
• publicly available business sources
• other parties when there is a valid legal basis for doing so

When personal data has not been obtained directly from the data subject, we provide the information required by Article 14 of the GDPR to the extent that this disclosure requirement applies.

6. Who has access within e-influence?

Within e-influence, only individuals have access to personal data to the extent necessary for their work.

We strive to limit access to only what is necessary for the relevant function, assignment, or processing.

7. With whom might we share personal data?

We share personal data only when there is a valid basis for doing so and when it is necessary for our services, business operations, legal obligations, or the protection of our rights and interests.

In doing so, we may use third parties in areas such as:

• hosting, infrastructure, IT, and security
• Website and online store functionality
• CRM and Customer Management
• Forms and Configurators
• business communication and email
• payment processing
• Financial and Administrative Services
• Logistics, fulfillment, and shipping
• electronic signature
• marketing and analytics
• design, production, and other services necessary for the execution of assignments
• Accounting, tax, legal, and other professional advisory services

To the extent that a party processes personal data on our behalf, we will enter into an agreement in accordance with Article 28 of the GDPR where required.

Some recipients process personal data for specific purposes as independent data controllers. In that case, that party is responsible for the processing in question.

We do not sell personal data to third parties for their own commercial purposes.

8. International Transfer of Personal Data

Some of the service providers we use may process personal data outside the European Economic Area (EEA).

When personal data is transferred to a country outside the EEA, we ensure that there is a valid legal basis for such a transfer and, where required, appropriate safeguards.

Depending on the situation, this may involve, among other things:

• an adequacy decision by the European Commission
• European Commission's Standard Contractual Clauses
• other appropriate safeguards recognized by the GDPR
• an applicable legal exception where permitted by the GDPR

Information regarding international data transfers and applicable safeguards may be requested, to the extent permitted by the GDPR, via legal@e-influence.eu.

9. Cookies and Similar Technologies

Our websites use cookies and similar technologies.

Essential Technologies

Cookies or similar technologies that are necessary for the functioning, security, or provision of a digital service explicitly requested by the user may be used without prior consent to the extent permitted by applicable law.

Analytics, marketing, and other non-essential technologies

When prior consent is required by law, such cookies or technologies will not be activated until consent has been given via our cookie banner.

This may include, among other things:

• analysis
• measurement
• personalization
• tracking
• Ads and Remarketing

You can view, change, or withdraw your choices via the cookie settings on the relevant website.

An up-to-date overview of the cookies and similar technologies actually used, including their purposes, providers, and retention periods, is available via the cookie settings on the relevant website.

We comply with the GDPR and applicable national regulations within the European Union. In the Netherlands, for example, tracking cookies and certain privacy-sensitive analytical cookies require consent. In Germany, §25 of the TDDDG generally requires consent for the storage of or access to information on the end device, subject to statutory exceptions.

10. Retention Periods

We do not retain personal data longer than is necessary for the purposes for which it is processed, unless a legal obligation or other valid reason requires or permits longer retention.

When determining a retention period, we take into account, among other things:

• the purpose for which the data was collected
• the nature of the customer or business relationship
• Legal, tax, and administrative retention requirements
• contractual obligations
• security and fraud prevention purposes
• Applicable Statutes of Limitations
• Potential complaints, disputes, and legal claims
• the need to be able to demonstrate the performance or fulfillment of a business relationship

The following principles, among others, apply:

• Request and contact information will be retained for as long as necessary to process and follow up on them, if applicable
• Financial and tax data are retained for the applicable statutory retention periods.
• Customer, order, and project records are retained for as long as necessary for the execution and administration of the customer relationship and, thereafter, to the extent that there is a legal or legitimate basis for continued retention.
• Business correspondence and file documents may be retained for as long as necessary for administrative purposes, as evidence, or for the establishment, exercise, or defense of legal claims.
• Marketing data is retained as long as there is a valid basis for doing so.
• Cookies and technical data are retained in accordance with the retention period applicable to the relevant processing

Specific retention periods for tax and accounting data by country

To the extent that we process tax and accounting data, we adhere to the statutory retention periods applicable in the country where the relevant company is incorporated or subject to taxation. This means, among other things, the following.

Netherlands

• Basic records (general ledger, accounts receivable and accounts payable, purchase and sales records, and other data relevant to taxation): 7 years, pursuant to Article 52 of the General Tax Act (AWR). The retention period begins at the end of the fiscal year to which the data pertains.
• Real estate data: 10 years.
• Record retention under the One-Stop Shop (OSS) scheme for cross-border EU sales: 10 years.

Germany

• Business records, annual financial statements, inventories, and opening balance sheets (Handelsbücher, Jahresabschlüsse, Inventories, Opening Balance Sheets): 10 years, pursuant to § 257(4) of the German Commercial Code (HGB) and § 147(3) of the German Tax Code (AO).
• Booking records and invoices (Buchungsbelege, Rechnungen), such as invoices and payment receipts: 8 years (effective January 1, 2025; previously 10 years), pursuant to § 147 AO and § 14b Umsatzsteuergesetz (UStG).
• Incoming and outgoing business correspondence (commercial and business letters, including business emails): 6 years, pursuant to § 257(4) of the German Commercial Code (HGB) and § 147 of the German Fiscal Code (AO).

For other EU member states where we are subject to fiscal or administrative retention obligations at any time, we adhere to the statutory retention periods applicable in those countries. These periods can be requested via legal@e-influence.eu.

When personal data is no longer necessary and there is no valid basis for further processing, it will be deleted or anonymized.

11. Your Privacy Rights

Depending on the circumstances and legal requirements, under the GDPR you have the right, among other things, to:

• Access to Personal Data
• Correction of inaccurate or incomplete personal data
• Deletion of Personal Data
• Restriction of Processing
• Objection to Processing
• Data Portability
• Withdrawal of Previously Granted Consent
• Rights Regarding Certain Forms of Automated Decision-Making

These rights are not absolute. Whether a request can be fully granted depends on the applicable legal conditions and any legal obligations or legitimate grounds for further processing. For example, the European Commission confirms that deletion may be requested when data is no longer necessary or is being processed unlawfully; therefore, it is not an unconditional right to have every record deleted upon request.

A privacy request can be submitted via:

legal@e-influence.eu

If we have reasonable doubt about the identity of the requester, we may request additional information necessary to confirm their identity.

We process requests in accordance with the terms and conditions of the GDPR.

12. Objecting to Direct Marketing

If personal data is processed for direct marketing purposes, you have the right to object to such processing.

If you object to the processing of your personal data for direct marketing purposes, we will no longer process your personal data for that purpose.

If a commercial communication includes an option to unsubscribe, you can also use that option.

13. Filing a Complaint with a Regulatory Authority

You have the right to file a complaint with a competent supervisory authority if you believe that the processing of your personal data violates the GDPR.

Under the terms of Article 77 of the GDPR, you may, among other things, contact the supervisory authority of:

• the EU member state where you usually reside
• the EU member state where you work
• or the location where the alleged infringement occurred

In the Netherlands, the Dutch Data Protection Authority is the national privacy regulator for e-influence.

14. Automated Decision-Making and Profiling

As a general rule, we do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you as referred to in Article 22 of the GDPR.

If we engage in such processing in the future, we will provide the information required by law and implement the applicable safeguards.

15. Minors

Our websites and services are primarily aimed at entrepreneurs, organizations, and business users, and are not specifically intended for children.

We do not knowingly collect personal data from children unless there is a valid legal basis for doing so.

If you suspect that we are processing such personal data unlawfully, please contact us at legal@e-influence.eu.

16. Security

We take appropriate technical and organizational measures to protect personal data against, among other things:

• loss or destruction
• unauthorized access
• Unauthorized modification
• Unauthorized Disclosure
• abuse
• other unlawful processing

The measures taken are tailored to, among other things, the nature of the personal data, the processing, and the associated risks.

If you have any information regarding a potential security incident, data breach, or misuse of personal data, please contact us at legal@e-influence.eu.

17. Changes

We may amend this privacy statement if our services, websites, systems, data processing practices, or applicable laws and regulations change.

The most current version is published on our websites. The date at the top of the privacy statement indicates when that version takes effect.