1. Who are we?
Crisis Dynamics VOF (hereinafter: “Crisis Dynamics”, “we” or “us”) is a Dutch consultancy specialising in crisis resilience for small and medium-sized enterprises. We help organisations build resilience through crisis simulations and crisis management plans.
Crisis Dynamics VOF is registered with the Netherlands Chamber of Commerce (42017527) and is located at Industrieweg 9, 2254AE Voorschoten, the Netherlands. We are the controller for the personal data we process in the course of our services.
For questions about this privacy policy or about the processing of your personal data, you can contact us via:
Email: info@crisisdynamics.nl
2. Which personal data do we process?
We process the following categories of personal data:
- Contact details: name, email address, telephone number and address
- Professional details: job title and name of the organisation
- Financial and invoicing data: information required to prepare and send invoices
- Simulation content: data that participants enter or provide during crisis simulation exercises
- Communication history: emails and other correspondence in the course of our services
We do not process special categories of personal data (such as health data, political opinions or data on race or ethnic origin), unless this is strictly necessary and we have a valid legal basis for doing so.
3. Purposes and legal bases for processing
We process personal data only for specified purposes and on the basis of one of the legal bases set out in the General Data Protection Regulation (GDPR).
3.1 Performance of the contract
We process data in order to deliver the agreed services, including running crisis simulations, preparing reports and managing the client relationship. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
3.2 Legal obligations
We process financial and invoicing data to comply with legal obligations under tax and accounting legislation. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
3.3 Legitimate interest
We process contact details of business contacts for commercial communication, such as following up on leads and maintaining the client relationship. In doing so, we weigh our interest against the privacy of the data subject. As this concerns business contacts in a B2B context only, we consider this justified. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
4. How do we collect personal data?
We collect personal data in the following ways:
- Through the contact form on our website
- Through direct communication (email and telephone)
- In the course of entering into and performing contracts
- Through data that participants enter themselves during crisis simulation exercises
5. Storage and security of personal data
5.1 Where do we store data?
Personal data is stored in the following locations:
- An internally managed, isolated server that is not connected to the public internet. Data collected during crisis simulation exercises is stored exclusively on this server.
- Cloud storage via EU-based services
- Cloud storage via Google and Microsoft services (see also Article 6 on international transfers)
- Local devices of the partners
- Physical documents, which are kept in a secure location
5.2 Security measures
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss or destruction. These measures include:
- Password protection and access control
- Two-factor authentication (2FA)
- Encryption of data at rest and in transit (HTTPS and disk encryption)
- Access to personal data is restricted to the partners of Crisis Dynamics
Despite these measures, no system can guarantee complete security. In the event of a data breach that is likely to pose a risk to the rights and freedoms of data subjects, we will report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours and, where required, inform the data subjects.
6. International transfers of personal data
Some of the tools we use — including Google Workspace and Microsoft 365 — may process personal data outside the European Economic Area (EEA). These transfers take place on the basis of Standard Contractual Clauses approved by the European Commission, which the relevant service providers have included in their data processing agreements.
Data collected and processed in the course of crisis simulations is stored exclusively on our internally managed, isolated server in the Netherlands and is never transferred to third parties or external systems.
7. Sharing personal data with third parties
We only provide personal data to third parties where this is necessary for the performance of our services or where we are legally required to do so. We share personal data with the following categories of recipients:
- Email and calendar services (Google Workspace, Microsoft 365): for internal communication and planning
- Cloud storage services (Google Drive): for storing documents
- Government authorities or regulators: only where we are legally required to do so
We do not sell personal data to third parties and do not provide it for the commercial purposes of others.
A data processing agreement is in place with service providers that process personal data on our behalf. For Google Workspace and Microsoft 365, these data processing agreements form part of their terms and conditions.
8. Retention periods
We do not keep personal data longer than necessary for the purposes for which it was collected, or for as long as required by law. We apply the following retention periods:
- Financial and invoicing data: 7 years, in accordance with the statutory retention obligation
- Contact details of clients: for the duration of the business relationship and a reasonable period thereafter
- Data collected during crisis simulation exercises: deleted months after completion of the project and delivery of the final report
- Marketing data and lead information: until the data subject objects or unsubscribes
9. Your rights as a data subject
Under the GDPR, you have the following rights with regard to your personal data:
- Right of access: you have the right to know which personal data we process about you
- Right to rectification: you can have incorrect or incomplete data corrected
- Right to erasure: you can request that your data be deleted, insofar as no statutory retention obligation applies
- Right to restriction of processing: in certain cases you can request that processing be temporarily restricted
- Right to data portability: you can request to receive your data in a commonly used format
- Right to object: you can object to processing based on legitimate interest
You can exercise your rights by contacting us via:
- Email: info@crisisdynamics.nl
- Telephone or the contact form on our website
We aim to respond to your request within one month, in line with the period set by the GDPR. In complex cases or where there are multiple requests, this period may be extended by two months; we will inform you of this in good time.
If you believe that we are processing your personal data incorrectly, you have the right to lodge a complaint with the Dutch Data Protection Authority (www.autoriteitpersoonsgegevens.nl).
10. No automated decision-making
We do not use automated decision-making or profiling. All decisions in the course of our services are made by people.
11. Cookies and website
Our website uses functional cookies. These cookies are necessary for the website to function correctly and do not store personal data for tracking or marketing purposes. We do not use analytical or advertising cookies.
Visitors can contact us through the contact form on our website. The data you enter in this form is used solely to respond to your request.
12. Changes to this privacy policy
We may amend this privacy policy from time to time, for example as a result of changes in our services or in applicable laws and regulations. The most recent version of this policy is always available on our website. We recommend that you consult this policy regularly. The date at the top of this document indicates when the policy was last updated.
Crisis Dynamics VOF · Industrieweg 9, 2254 AE Voorschoten · KvK 42017527 · Info@crisisdynamics.nl