Privacy Statement Bilthoven Biologicals BV

This is the Privacy Statement of Bilthoven Biologicals BV (“ BBio ”). This Privacy Statement applies to all persons who have contact with BBio, with the exception of its employees. More specifically, this means that this Privacy Statement applies to:

visitors, customers, applicants, clients, contractors (including self-employed persons and suppliers to the extent that they are natural persons) and other relations of BBio;
visitors to the BBio website (https://www.bbio.nl) or a domain name associated with this domain name.

All these persons together are hereinafter referred to as ‘you’ and ‘your’. The words ‘we’ and ‘us’ refer to BBio. A number of terms are explained in chapter 1. These terms are indicated with a capital letter in the Privacy Statement.

We believe it is very important that your Personal Data is handled with care. We naturally observe all legal rules, including the General Data Protection Regulation (‘GDPR’), and protect your Personal Data carefully and adequately.

We ask you to read this Privacy Statement carefully. For readability, we have divided the Privacy Statement into chapters. Below you will find the table of contents. By clicking on the subject or chapter, you will be taken directly to the chapter.

This Privacy Statement was last modified on and is effective as of March 2025.

GLOSSARY
WE CAN PROCESS THIS PERSONAL DATA FROM YOU
WHY DO WE PROCESS YOUR PERSONAL DATA?
WE PROCESS PERSONAL DATA ON THESE GROUNDS
SHARING PERSONAL DATA WITH THIRD PARTIES
SHARING OF PERSONAL DATA OUTSIDE THE EUROPEAN ECONOMIC AREA
SECURITY
AUTOMATED DECISION-MAKING
RETENTION PERIODS
MINORS ON THE BBIO WEBSITE
YOUR RIGHTS
COOKIES AND COMPARABLE TECHNOLOGIES
CONTACT DETAILS / QUESTIONS / COMPLAINTS / COMMENTS
CHANGES AND APPLICABLE LAW

Glossary

Person concerned
the person to whom the Personal Data being processed relates. In other words: the individual whose personal information is being processed.

Special Personal Data
Special Personal Data are data about a person’s religion or belief, race, ethnic origin, political opinion, health, sex life, trade union membership, health, sexual behavior or orientation, genetic data and biometric data used for the identification of a person.

Third parties
(legal) persons who are not a Data Subject or part of BBio, such as: (legal) persons with whom BBio shares Personal Data on the basis of an agreement. These Third Parties may be processors or (joint) Controllers.

Personal data
any information relating to an identified or identifiable person. In other words, any information that identifies or can be used to identify the Data Subject.

Process
anything that can be done with Personal Data, such as collecting, recording, storing, modifying, retrieving, using, distributing and destroying it.

Data Controller
the party that processes the data of Data Subjects for a specific purpose. In this Privacy Statement, this is BBio.

We can process this personal data from you

Below we explain which Personal Data BBio can Process from you.

Personal data provided by yourself, such as:

your contact details (name, address, city, email address, telephone number);
your gender and date of birth;
data after a telephone call;
data from an email;
payment details;
information from your CV/information about employment history.

Personal data that we have collected from you through a visit to our premises, our websites, newsletters and emails:

information about which device you used to visit our website;
your surfing behaviour on the website, such as:
- which data/web pages you have viewed from us;
- the way you navigate through the website;
- whether you open a newsletter or email and which parts of it you click on;
- the dates and times of your visit to our website;
the operating system you are using;
your browser type and IP address;
your internet provider;
the internet address of the website to which the link is made;
the geolocation ;
the data you have downloaded from the website.
camera images (our information boards at the relevant locations point out the camera surveillance);

Personal data that we have received from other sources, such as:

data available through public sources (such as social media and business websites) and made public by you, such as profile data and name;
data from the Trade Register of the Chamber of Commerce and from the Land Registry, such as the address and name of Data Subjects.

Personal data of applicants.
If you apply for a job, we will process your Personal Data to facilitate the entire application procedure based on our legitimate interests in recruitment and selection. After the procedure, we will delete your personal data as soon as possible, unless we have informed you that we need it for other purposes. The following Personal Data may be processed for the application procedure:

Any Personal Data you provide through our application form, including but not limited to:

full name, email address, telephone number, photo, cover letter, resume, LinkedIn profile, Indeed profile and the vacancy you applied for;
information about you that is shared with us by referees;
statuses, notes and planning regarding your application.

Failure to provide the Personal Data requested by us in your application may put you at a disadvantage compared to other candidates applying for the same position.

Indeed and LinkedIn Privacy Policy
Your Personal Data will also be processed by Indeed on pages where we display a button to ‘Apply with Indeed’, even if you do not use that functionality. Indeed may use cookies. Indeed’s privacy policy applies to the processing of personal data by Indeed:

https://www.indeed.com/legal

Your Personal Data must be processed by LinkedIn and Indeed to enable the functions ‘Apply with LinkedIn’ and ‘Apply with Indeed’. LinkedIn and Indeed may use cookies. You can find their privacy policies on the following websites:

https://www.indeed.com/legal and https://www.linkedin.com/legal/privacy-policy

We process personal data on these grounds

In order to use Personal Data, we need a basis from the GDPR. We use the following grounds:

you have given permission to BBio;
the use is necessary to perform or enter into an agreement with you;
the use is necessary to comply with a legal obligation that applies to BBio;
in emergency situations: the use is necessary to protect a vital interest of you or of another person;
we or a third party have a legitimate interest in the use, unless your rights and freedoms outweigh this.

Why dow we process your personal data?

We Process Personal Data of (employees of) customers and clients for the following purposes:

to verify your identity when we deliver a product or service to you or your employer.
We do this to comply with a legal obligation , based on our legitimate interest to verify the identity of a (potential) customer or to be able to enter into an agreement;
to provide our services and manage our relationship, including our (financial) administration.
We do this based on the execution of the agreement with you, or our legitimate interest and that your employer to execute an agreement with your employer;
for quality, marketing and training purposes, to research, improve and evaluate (the safety of) our services, including by performing checks, statistical analyses and satisfaction surveys, and (further) developing.
We do this on the basis of our legitimate interest, namely to guarantee the safety and continuity of our services and to improve and (further) develop them ;
for the handling of your questions and to deal with complaints.
We do this on the basis of the execution of an agreement with you, a legitimate interest to conclude or execute an agreement with your employer or our interest to provide good and adequate service.

We Process Personal Data of (employees of) contractors (including self-employed persons and suppliers to the extent that they are natural persons) and other relations of BBio for the following purposes:

to be able to purchase your services and manage our relationship, including our (financial) administration.
We do this on the basis of the execution of an agreement with you, a legitimate interest of us and your employer to execute an agreement with your employer or our interest to provide good and adequate service;
for the handling of your questions and to deal with complaints.
We do this on the basis of the execution of an agreement with you, a legitimate interest to conclude or execute an agreement with your employer or our interest to provide good and adequate service ;
for quality and training purposes, to examine and evaluate the products and services provided, including by performing checks and statistical analyses.
We do this on the basis of our legitimate interest, namely to check the safety and continuity of the products and services provided;

We Process Personal Data of (website) visitors for the following purposes:

for marketing/commercial purposes, for example to inform you of news, developments, services and products of BBio.
We do this based on your consent, for example for the newsletter and marketing cookies ;
to manage, secure, adjust and improve our websites.
We do this based on our legitimate interest, namely for the proper functioning of our website;
to monitor the safety of our employees and other persons, including preventing the infection with or spread of the polio virus.
We do this on the basis of a legitimate interest of us, our employees and visitors, to monitor a safe (work)place;
to prevent theft, abuse, vandalism or other criminal behavior, we use camera surveillance and other security measures, such as visitor registration, in our buildings.
We do this based on our legitimate interest and the interest of third parties, to ensure the safety of persons and property.

We Process Personal Data of applicants for the following purposes:

for the recruitment and selection of new employees.
We do this on the basis of our legitimate interest, namely being able to recruit new employees and being able to determine suitability for a specific position at BBio. In addition, your personal data may be collected for this purpose for the preparation or conclusion of an agreement or on the basis of a legal obligation;
to be able to approach applicants who have not been accepted for another position at BBio for a maximum of one year later. We do
this based on your consent.
to improve our application procedure and to determine and implement policy in the context of, for example, diversity and job satisfaction

We may Process Personal Data of any data subject for the following purposes:

preventing and combating fraud, unauthorized use, and violations of our terms and policies or other harmful or illegal activities.
We do this based on our legitimate interest , a social interest as well as the interest of a (potential) victim, to deal with fraud and other unwanted and unlawful behavior and to report it to the appropriate authorities, such as the police and a supervisory authority;
to comply with a legal obligation that applies to BBio, such as cooperation with supervisory authorities, or to be able to provide information at the request of such authorities or other bodies, such as the police.
We do this on the basis of a legal obligation or a legitimate interest, in order to be able to cooperate with a justified request from a competent authority;
to be able to defend ourselves in (out-of-court) proceedings or to change our business structure.
We do this on the basis of a legitimate interest of ours, to be able to defend ourselves in and out of court and to be able to change our business activities;
for the security of our networks and systems.
We do this based on our legitimate interest, namely promoting IT management and improving its security.

Sharing personal data with third parties

We only share your Personal Data with Third Parties if this is necessary, for example because Third Parties perform work on behalf of BBio, and only for the purposes described in this Privacy Statement. If a Third Party is engaged, BBio will ensure that this Third Party applies the same level of security and confidentiality as the level that we maintain.

BBio may use the following categories of contractors:

IT management;
website management;
website hosting;
e-mail communication;
other contractors/suppliers.

BBio remains responsible for the processing of your personal data. BBio concludes agreements with Third Parties to ensure that your personal data is properly secured.

BBio may share your personal data with a Third Party, such as a potential buyer or seller, through a merger, acquisition or sale of (part of) its organization. Of course, we will inform you about this by e-mail and/or a clearly visible notice on our website and inform those involved about their rights in this situation.

Sharing of personal data outside the European economic area

In principle, we do not transfer your personal data to a country outside the European Economic Area (‘EEA’). If it does happen that we want to process personal data outside the EEA, this will only take place:

if the European Commission has decided that the third country ensures an adequate level of protection; or
if appropriate safeguards are provided and you have enforceable rights and good legal remedies; or
the transfer is necessary for the performance of your agreement with BBio; or
if you have expressly consented to the transfer, after having been informed of the risks involved in the transfer; or
if the transfer is necessary for important reasons of public interest; or
if the transfer is incidental and necessary for compelling interests of BBio and BBio has taken appropriate safeguards and has informed the Dutch Data Protection Authority thereof.

In situations where BBio transfers your Personal Data outside the EEA, we take measures to ensure that your Personal Data remains well protected.

Security

BBio takes the protection and security of your Personal Data very seriously and takes ongoing measures to optimally protect your Personal Data against unlawful use. We have taken the following measures, among others:

only persons authorized to do so have access to Personal Data, whereby as few persons as possible have access to the Personal Data;
All BBio employees have signed a confidentiality agreement, whereby they undertake to maintain complete confidentiality of all information (including Personal Data);
BBio has a data breach policy (protocol) in place to act appropriately and carefully in the event of unexpected data breaches, to minimize the consequences of a data breach and prevent recurrence;
electronic transmission of Personal Data always takes place via a secure connection;
the website is secured via https ;
We ensure that your Personal Data is only shared with Third Parties if we have agreed appropriate security measures with these Third Parties.

In addition, BBio ensures that all its user settings, programs and services are set up from the start of development in such a way that your privacy protection is maximized.

Automated decision-making

BBio can, if necessary, make decisions based on automated processing on matters that can have (significant) consequences for you. This concerns decisions that are made by computer programs or systems, without a person (for example an employee of BBio) being involved. For example: if we suspect fraudulent activities, we can block you from using our websites.

Retention periods

BBio will never retain Personal Data for longer than is necessary for the purpose of the processing. BBio will retain your Personal Data for as long as we deem necessary to provide you with services, enable you to use the website, comply with applicable laws, resolve disputes with parties and otherwise as necessary to enable us to conduct our business.

BBio does not store personal data of applicants for longer than four weeks after completion of the application procedure, unless you have been accepted for the position or you have given permission to store your personal data for a maximum of one year.

The Personal Data will be stored at least for the period that you have an agreement with BBio. For some Personal Data, statutory retention periods apply. BBio fully complies with these statutory retention periods.

Minors ont he bbio website

Although visitors of all ages can visit our websites, we do not want to collect Personal Data from children under the age of 16 without the consent of the parent/guardian. You may therefore only use our website under the supervision of a parent or legal guardian if you are 16 years of age or younger.

Your rights

, which are set out below. You can exercise these rights by submitting your request in writing and addressing it to BBio or by sending an e-mail to info@bbio.nl . BBio will verify your identity before your request can be fulfilled.

BBio will respond to your request as soon as possible, but no later than within one month. Your requests will in principle be processed electronically, unless this is not possible or you request otherwise. BBio will not charge any costs for processing your aforementioned requests, unless your requests are excessive.

Access to Personal Data
You can request access to your Personal Data at any time. This right includes access to which (categories of) Personal Data BBio processes from you, for what purposes this is done, from which source the Personal Data comes and which retention periods are used.

Change Personal Data
You can contact us at any time to supplement or correct your Personal Data. If it unexpectedly turns out that BBio has processed and/or provided incorrect Personal Data of you to Third Parties, BBio will correct this immediately. If BBio has changed your Personal Data, BBio will inform you of this.

Restrict the processing of your Personal Data
If you do not agree with the content of the Personal Data that BBio stores about you, you can in some cases submit a request to temporarily restrict the processing of your Personal Data.

Withdrawal of consent
You can also withdraw your consent for the Processing of your Personal Data at any time. After receiving your letter or email, BBio will immediately cease processing your Personal Data for which you had given consent. However, withdrawing your consent does not affect the processing that has already taken place.

Right to transfer Personal Data (right to data portability )

You can request the Personal Data that BBio stores about you in a structured, commonly used and machine-readable format.

Right to be forgotten
You can submit a request to have your Personal Data deleted.

Right to object
You have the right to object to the processing of your Personal Data by BBio based on the grounds of ‘legitimate interest of BBio or a third party’ and ‘fulfilment of a task in the public interest’. If BBio bases itself on these grounds, BBio will make a balancing of interests with regard to your privacy. In addition, you always have the right to object to direct marketing. The right to object gives you the opportunity to request BBio to make the balancing of interests again.

Right to lodge a complaint / initiate legal proceedings
We are committed to working with you to find a fair resolution if you have a complaint or concern about the Processing of your Personal Data. However, if you believe that we have not been able to assist you with your complaint or concern, you also have the option of filing a complaint with the Dutch supervisory authority, the Dutch Data Protection Authority , or initiating legal proceedings.

Automated decision-making
The right to request not to be subject to a decision based solely on automated processing.

Cookies and comparable technologies

BBio uses cookies and similar techniques on its website. Cookies are small pieces of information that are stored on your computer. These small pieces are recognized on a subsequent visit to the BBio website.

Bbio uses functional, analytical and marketing cookies. We use functional cookies strictly and only for the proper and secure functioning of the website. Analytical cookies are used by Bbio for statistical purposes, for example for measuring visitor numbers. This enables BBio to see how its visitors use the website. This enables BBio to adapt its website to user preferences. These cookies have a minimal privacy impact and the Personal Data that we collect through these cookies are Processed on the basis of our legitimate interest. You can disable these cookies in our cookie banner. Finally, we Process Personal Data through marketing cookies. For this we ask your permission in the cookie banner. You can withdraw your permission by deleting your cookies from your computer.

Below you will find an overview of the cookies we use on our website.

Cookie	Type	Provider	Goal	Retention period
Google Tag	Advertisement	Google	Measuring ad performance	365 days

Contact details / questions / complaints / comments

Our contact details are:
Bilthoven Biologicals BV
Adressed to the communications department

E-mail: info@bbio.nl
Phone number : +3130 – 8004 800

Registered in the trade register of the Chamber of Commerce under number: 53751221.

We trust that you will ensure that your Personal Data is complete, accurate and up to date. We request that you notify us immediately of any changes or inaccuracies in your Personal Data by contacting us.

Changes and applicable law

Our Privacy Statement may need to be updated. The latest version is always available on our website. We will announce any changes to the Privacy Statement via a clearly visible notice on our website.

None of the provisions of this Privacy Statement are intended to create an obligation or agreement between you and BBio. The provisions of this Privacy Statement and all disputes arising from it are governed by Dutch law.