Privacy Statement
ACE | APS Competence & Excellence B.V.
Last updated: August 2026
In this Privacy Statement the following terms are defined as follows:
- ACE: ACE | APS Competence & Excellence B.V., a private limited company (besloten vennootschap met beperkte aansprakelijkheid) incorporated under the laws of the Netherlands, with its registered office at Flight Forum 760, 5657 DT Eindhoven, the Netherlands, registered with the Dutch Chamber of Commerce (Kamer van Koophandel) under number 42.07.91.77, including any Affiliates;
- Affiliate: any group company (groepsmaatschappij) as defined in Article 2:24b of the Dutch Civil Code (Burgerlijk Wetboek), and any participating interest (deelneming) as defined in Article 2:24c of the Dutch Civil Code;
- Website: the website of ACE, www.ace-scp.com, and derivative websites developed and administered by ACE;
- Personal Data: any information relating to an identified or identifiable natural person;
- GDPR / AVG: Regulation (EU) 2016/679 (General Data Protection Regulation), known in the Netherlands as the Algemene verordening gegevensbescherming, together with the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming, “UAVG”).
1. Processing of Personal Data
ACE attaches great importance to respecting and protecting your privacy and the confidentiality and security of your Personal Data. ACE processes Personal Data in accordance with the GDPR, the UAVG, and — where cookies and similar techniques are concerned — Article 11.7a of the Dutch Telecommunications Act (Telecommunicatiewet).
In respect of the processing described in this statement, ACE acts as the controller (verwerkingsverantwoordelijke): it determines the purposes and means of the processing.
Where ACE processes Personal Data on behalf of a client — for example data held in a planning or supply chain solution that ACE implements, hosts, or supports — ACE acts as processor (verwerker) and the client is the controller. Such processing is governed by the data processing agreement concluded with that client and not by this Privacy Statement.
ACE does not rely on your visit to the Website as consent to process your Personal Data. Each processing activity described below rests on a specific lawful basis under Article 6 GDPR, identified in section 3. Where consent is the basis, ACE asks for it separately and you may withdraw it at any time.
2. What information
ACE may process the following Personal Data via its Website, including through the contact form, the newsletter form, any other form, and cookies:
- information about your computer or mobile device and your visits to and use of the Website, including your IP address, operating system, browser type, referring page, pages viewed, timestamps, and approximate geographical location;
- information you provide when registering for an ACE service environment or client portal, such as your first name, last name, e-mail address, password, job title, company, and country;
- information you provide when registering for a webinar, workshop, or event, including any dietary or accessibility requirements you choose to tell us;
- any other information that you choose to provide, by any means.
Form fields marked with (*) are strictly necessary for the purpose concerned. If one or more of these fields is not completed, the form cannot be submitted. Other fields are optional and help ACE serve you better.
ACE may process the following Personal Data relating to business contacts at its suppliers, clients, prospective clients, and partners:
- personal contact information provided to us, such as first name, last name, business e-mail address, telephone number, mobile number, job title, and employer;
- correspondence, meeting notes, and project records created in the course of the working relationship.
ACE may process the following Personal Data relating to job applicants:
- your CV and covering letter, application correspondence, and any references you provide.
ACE does not seek to process special categories of Personal Data (Article 9 GDPR) and does not carry out automated decision-making or profiling that produces legal effects for you or otherwise significantly affects you. ACE’s Website and services are directed at business users; ACE does not knowingly collect Personal Data from children.
3. Purposes of processing and lawful basis
ACE may process Personal Data for the following purposes:
| Purpose | Lawful basis (Art. 6(1) GDPR) |
|---|---|
| Managing access to an ACE service environment or client portal | Performance of a contract (b) |
| Proper technical functioning, security, and personalisation of the Website | Legitimate interest (f) for operation and security; consent (a) for analytics and marketing cookies |
| Handling requests for information | Legitimate interest (f), or steps prior to entering into a contract (b) |
| Statistical research and analytics | Consent (a) where cookie-based; legitimate interest (f) where based on aggregated or anonymised data |
| Delivery of ACE services, including invoicing and client relationship management | Performance of a contract (b); legitimate interest (f) where you are a contact person rather than the contracting party |
| Statutory administration and record-keeping | Legal obligation (c) |
| Handling job applications | Steps prior to entering into a contract (b); consent (a) to retain your details beyond the process |
| Sending a newsletter, event invitation, or other information about products or services we think may interest you | Consent (a); or legitimate interest (f) for existing clients receiving information about closely related services, always with a means to opt out |
| Establishing, exercising, or defending legal claims | Legitimate interest (f); legal obligation (c) |
Where ACE relies on legitimate interest, it has weighed that interest against your rights and freedoms. You may request a summary of that balancing test and you may object to the processing — see section 5.
Providing Personal Data to ACE is voluntary, but some data is necessary for ACE to do what you have asked of it, and some is prescribed by law (for example on an invoice).
4. Transfers of Personal Data
ACE does not rent or sell your Personal Data to third parties for their own purposes and does not share it for third-party advertising.
Within ACE, Personal Data is made available to employees strictly on a need-to-know basis.
ACE engages processors — natural or legal persons, public authorities, agencies, or other bodies that process Personal Data on ACE’s behalf — for purposes including:
- hosting of the Website and related databases;
- IT infrastructure, e-mail, and collaboration software;
- CRM, marketing, and event registration tools;
- statistical research and analytics;
- accounting, invoicing, and payroll services.
Each processor is bound by a written data processing agreement meeting the requirements of Article 28 GDPR, obliging it to process Personal Data only on ACE’s instructions, to keep it confidential, to apply appropriate security measures, and to engage sub-processors only under equivalent terms.
ACE may also disclose Personal Data to:
- software vendors and implementation partners, where a project requires it and you have been informed. Where such a party determines its own purpose, it acts as an independent controller, and its own privacy statement applies;
- public authorities, where ACE is legally obliged to disclose;
- professional advisers, a counterparty, and the courts, where necessary to establish, exercise, or defend a legal claim.
Transfers outside the EEA. ACE keeps Personal Data within the European Economic Area wherever it can. Where Personal Data is transferred outside the EEA, ACE relies on an adequacy decision of the European Commission for the country concerned, or on the European Commission’s Standard Contractual Clauses combined with a transfer impact assessment and, where necessary, supplementary technical and organisational measures. You may request an overview of the countries involved and a copy of the relevant safeguards at the contact details in section 13.
Corporate change. ACE may alter its corporate structure, including by change of legal form, merger, acquisition, or the sale of Affiliates. In such transactions Personal Data will be passed on in accordance with this Privacy Statement and applicable data protection law, and you will be informed if the way your Personal Data is handled changes as a result.
5. Your rights
Under the GDPR you have the following rights in respect of your Personal Data.
5.1 Right of access (Art. 15)
You may obtain confirmation of whether ACE processes Personal Data relating to you, a copy of that data, and information about the purposes, recipients, retention periods, and the origin of the data.
5.2 Right to rectification (Art. 16)
You may have inaccurate Personal Data corrected and incomplete Personal Data completed.
5.3 Right to erasure (Art. 17)
You may have your Personal Data deleted where one of the grounds in Article 17 GDPR applies — for instance where the data is no longer necessary for the purpose, or where you withdraw the consent on which the processing rests and there is no other basis for it.
5.4 Right to restriction of processing (Art. 18)
You may have processing limited while, for example, a dispute about the accuracy of the data or about a legitimate interest is being resolved.
5.5 Right to data portability (Art. 20)
Where processing is based on consent or on a contract and is carried out by automated means, you may receive the Personal Data you provided to ACE in a structured, commonly used, machine-readable format, and have it transmitted to another controller.
5.6 Right to object (Art. 21)
You may object to processing based on ACE’s legitimate interest. Where you object to processing for direct marketing purposes, ACE will stop, without exception, free of charge, and without your having to give any reason.
5.7 Right to withdraw consent (Art. 7(3))
Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before it.
5.8 How to exercise these rights
Send your request by e-mail to info@ace-scp.com, or by post to ACE | APS Competence & Excellence B.V., Flight Forum 750, 5657DT Eindhoven, the Netherlands. A dated, signed letter is welcome but not required, and ACE does not ask you to enclose a copy of your identity card.
ACE will respond within one month of receiving your request. Where a request is complex, or where you have made several requests, ACE may extend this period by up to two further months and will inform you within the first month if it does so.
ACE may ask for additional information to confirm your identity, but only where it has reasonable doubt as to who you are. If a document is needed for that purpose, ACE will agree a proportionate method with you — for example a copy with your photograph and citizen service number (BSN) shielded.
Exercising your rights is free of charge. ACE may charge a reasonable fee, or decline to act, only where a request is manifestly unfounded or excessive, and will explain its reasoning.
5.9 Right to lodge a complaint (Art. 77)
If you are dissatisfied with how ACE has handled your Personal Data or your request, you may lodge a complaint with the Dutch supervisory authority:
Autoriteit Persoonsgegevens
Postbus 93374, 2509 AJ Den Haag, the Netherlands
Telephone: 088 – 1805 250
autoriteitpersoonsgegevens.nl
If you live or work in another EU or EEA Member State you may complain to the supervisory authority there instead. You also have the right to an effective judicial remedy (Art. 79 GDPR).
6. Retention
ACE keeps Personal Data no longer than is necessary for the purpose for which it was collected, after which it is deleted or anonymised. The principal periods are:
| Category | Retention |
|---|---|
| Enquiries that do not lead to a relationship | 12 months after the last contact |
| Client and project records | Duration of the relationship, then 7 years |
| Invoicing and accounting data | 7 years from the end of the financial year, per Article 52 of the Dutch State Taxes Act (Algemene wet inzake rijksbelastingen) |
| Newsletter subscriptions | Until you unsubscribe, plus a suppression record so that you are not contacted again |
| Event registrations | 24 months after the event |
| Unsuccessful job applications | 4 weeks after the process closes, or 12 months with your consent |
| Website logs | 12 months; cookie-based analytics data as stated in the Cookie Statement |
Where a longer period is required by law, or is necessary for a live legal claim, ACE retains the data for as long as that requires and no longer.
7. Security
ACE applies appropriate technical and organisational measures to protect Personal Data against loss, misuse, and unauthorised access, having regard to the state of the art, the cost of implementation, and the nature and risks of the processing. These measures include access control on a need-to-know basis, encryption of data in transit and, where appropriate, at rest, logging and monitoring, backups, secured devices, confidentiality obligations for staff and contractors, and periodic review of ACE’s own measures and those of its processors.
No system is entirely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, ACE will notify the Autoriteit Persoonsgegevens within 72 hours of becoming aware of it and will inform you directly where the breach is likely to result in a high risk to you.
8. Anonymous data
ACE may collect non-personal and anonymous data when the Website is visited and may anonymise Personal Data. Data that has been anonymised no longer permits the identification of an individual, is no longer Personal Data, and may be shared with third parties, including for statistical purposes.
The Website uses cookies and comparable techniques to enable the site to function and to improve the browsing experience. Cookies that are strictly necessary for the Website to work are placed without asking, as permitted by Article 11.7a of the Dutch Telecommunications Act. Analytics and marketing cookies are placed only with your prior consent, requested through the banner shown on your first visit. You may withdraw or change that consent at any time via [COOKIE SETTINGS LINK], and you may block or delete cookies through your browser settings.
9. Cookies
Details of the specific cookies used, their purpose, and their lifespan are set out in the Cookie Statement at Cookie Policy
10. Changes
ACE may update this Privacy Statement, for instance where its services, systems, or the applicable law change. The version published on the Website is the current one, and the date below shows when it last changed. Where a change materially affects how your Personal Data is used, ACE will bring it to your attention directly rather than relying on publication alone. Where a change requires your consent, ACE will ask for it.
This Privacy Statement was last updated: August 2026.
11. Miscellaneous
If any provision of this Privacy Statement is wholly or partly annulled by a binding decision, the remaining provisions continue to apply in full. ACE is entitled to modify or replace such a provision with another which, within the limits of the law, has the same effect.
A failure by ACE to insist on strict compliance with any provision of this Privacy Statement shall not be construed as a waiver of that provision.
Nothing in this Privacy Statement limits or excludes any right you have under the GDPR, the UAVG, or other mandatory law.
12. Applicable law and jurisdiction
This Privacy Statement is governed by Dutch law, without prejudice to the mandatory protections available to you under the GDPR and under the law of your country of residence.
Disputes arising from or relating to this Privacy Statement and the processing of Personal Data will be submitted to the competent court in [DISTRICT, e.g. Rechtbank Midden-Nederland], without prejudice to your right under Article 79 GDPR to bring proceedings before the courts of the Member State in which you are habitually resident or in which ACE is established.
13. Contact
If you have any questions or comments about the processing of Personal Data after reading this Privacy Statement, please contact ACE at:
ACE | APS Competence & Excellence B.V.
Flight Forum 760, 5657DT Eindhoven, the Netherlands
E-mail: info@ace-scp.com
Requests for general information about the protection of personal privacy can be addressed to the Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, telephone 088 – 1805 250, autoriteitpersoonsgegevens.nl.