Privacy Statement

Oliehandel Klaas de Boer B.V. (“we”, “us”) generally acts as controller for personal data processed for its own business operations. For specific activities another role may apply and will be explained separately where necessary.

Oliehandel Klaas de Boer B.V.
Korte Lijnbaan 9-11, 8861 NS Harlingen, the Netherlands
Dutch Chamber of Commerce: 39054726 | VAT: NL801816695B01
info@klaasdeboer.nl | +31 (0)517 415647 | www.klaasdeboer.nl 

This notice covers visitors to our website; customers and their contacts; suppliers, carriers, terminals, agents, brokers and other business partners and their contacts; job applicants; and anyone contacting us. A separate internal privacy notice may apply to our employees.

Depending on the relationship and activity, we may process names, job titles, business and where necessary personal contact details; company registration data; bank and payment details where linked to individuals; quotation, order, bunkering, transport, invoice and correspondence records; communication logs; website data including IP addresses, browser information and cookies; and information required for business integrity and sanctions checks. We obtain data from individuals, their employers or principals, business and logistics partners and, where relevant, public registers or lawfully used screening sources. We do not process special-category or criminal-offence data unless a specific legal basis and applicable safeguards are in place.

We process personal data only where a valid legal basis applies under Article 6 GDPR. The table below describes our principal activities. The precise legal basis may differ for individuals who are not themselves parties to a contract, such as employees of a corporate customer. Purpose Legal basis Enquiries, quotations and business communications Contract (where the individual is a contracting party); otherwise legitimate interests in business communication and relationship management. Bunkering, fuel, lubricants and transport deliveries Contract; legitimate interests for communications with customer and logistics staff. Invoicing, accounts and debt collection Legal obligation for tax records; contract or legitimate interests for payments and collection. KYC, sanctions and integrity checks Legal obligation where actually applicable; otherwise legitimate interests in fraud prevention and risk management, subject to a balancing test. ISCC, sustainability, ERE records and audits Legal obligation where applicable; otherwise legitimate interests in compliance evidence, certification and verification. IT security and fraud prevention Legitimate interests in protecting systems, transactions and business information. Recruitment Legitimate interests in recruitment; consent where required for extended retention. Non-essential cookies / optional marketing Consent where legally required; other legal basis only where permitted.

Information necessary to perform a contract, arrange a delivery, issue or process an invoice, or comply with statutory identification, recordkeeping or verification obligations must be supplied where applicable. Without such information we may be unable to establish a business relationship or carry out a transaction. Other information is voluntary unless indicated otherwise.

Where necessary we share information with carriers, bunkering and logistics partners, terminals, storage providers, IT and hosting providers, banks and payment providers, accountants, auditors, insurers, legal advisers, certification and verification bodies, competent regulators and public authorities (including the Dutch Emissions Authority where applicable). For sustainable fuel or ERE transactions, relevant business information may be shared with counterparties and authorised registries. We limit disclosure to what is necessary. We enter into data processing agreements with processors where required. Other recipients may act as independent controllers. We do not sell personal data as a standalone commercial product.

If personal data is transferred outside the European Economic Area, we rely on a valid Chapter V GDPR transfer mechanism, such as an adequacy decision or appropriate safeguards including standard contractual clauses, with supplementary measures where necessary. Information about relevant safeguards or a copy may be requested via our contact address where legally available. Actual transfers and service providers must be checked against our current supplier inventory.

We keep personal data only as long as necessary for the relevant purpose, subject to legal retention duties, pending disputes or legitimate claims. The following periods are starting points and must match our actual retention schedule. 

• Core tax and accounting records, including invoices: generally 7 years, or longer where a special legal period applies.

 • Unsuccessful quotations: normally up to 2 years after the last relevant contact, unless longer retention is necessary.

• General enquiries: normally up to 1 year after closure, unless needed for an ongoing relationship or dispute.

• Job applications: generally deleted within 4 weeks after the procedure, or retained for up to 1 year with consent for future opportunities.

• Contract, delivery, KYC, certification and ERE records: during the relationship and afterwards according to applicable legal, tax, certification and limitation periods; specific periods must be set in an internal retention schedule. Relevant records may be kept longer where necessary and lawful for an ongoing dispute or investigation.  

We implement appropriate technical and organisational measures proportionate to the risks, such as access restrictions, secure connections, authorisation controls, backups, security updates and internal guidance to the extent actually implemented. We assess security incidents and handle notifiable personal data breaches under the GDPR. Specific controls are established and reviewed internally.

Our website may use functional, analytical or other cookies and similar technologies. The actual cookies, purposes, providers and retention periods must be verified through an up-to-date cookie inventory and, where required, a separate cookie notice. Where consent is required for non-essential cookies, we obtain valid prior consent and provide a way to withdraw it. This notice does not replace a required cookie banner.

Subject to applicable law, you may request access, rectification, erasure, restriction, portability and object to processing. You may withdraw consent at any time without affecting processing already lawfully carried out. Where processing relies on legitimate interests, you may object on grounds relating to your particular situation. You may always object to direct marketing. Send requests to info@klaasdeboer.nl. We may verify your identity proportionately. We normally respond within one month; where legally permitted, we may extend this by up to two further months and will inform you in time. Rights are not absolute and legal exceptions may apply. 

This notice assumes that we do not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals. If we do so, we will provide the additional information required by the GDPR. This factual assumption must be confirmed internally.

Please contact info@klaasdeboer.nl with questions or complaints. You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): www.autoriteitpersoonsgegevens.nl. Where applicable, you may seek a judicial remedy before a competent court.

We may update this notice when our processing or applicable law changes. The current version will be made available through our usual information channels. Where required by law, we will inform individuals of material changes. Version 2.0

— document date: 13 October 2026. The document date does not itself prove prior publication or notification.