Privacy statement

This statement describes what the GreCoM platform at grecomhub.com and the website at grecomhub.com record about you and your company, why, who can see it, how long it is kept, and what you can ask us to do with it. It describes what the platform does today. Where the platform cannot delete something, it says so, and why.

It is written for the people whose data we process: the person who registers and uses an account for a company, applicants on the waiting list, contact persons named in introduction e-mails or documents, contacts at carriers listed in the directory, and visitors to the website.

1. Who is responsible

GreCoM B.V., Stationsplein 45, 3013 AK Rotterdam, the Netherlands. Trade register (KvK) 42043325, VAT NL869447014B01.

GreCoM B.V. is the controller for the processing described in this statement. For anything in it, including a request about your own data, write to privacy@grecomhub.com. General questions about the platform go to support@grecomhub.com.

Where your company is a sole proprietorship or a partnership of natural persons, its name, trade-register number and address are personal data of its owner. This statement then applies to those company details as well.

2. What we record, and why

The lawful basis is given per category. "Contract" means Article 6(1)(b) of the GDPR — the processing is needed to provide the platform to your company under the Terms of Use, or to take steps before doing so at your request. "Legitimate interests" means Article 6(1)(f); the interest is named. "Consent" means Article 6(1)(a).

What	Why	Lawful basis
Your account — your name, business e-mail address, telephone number and job title if you give them, the language you read in, and a one-way hash of your password (we never store the password itself).	To let you in, to confirm your e-mail address, to reach you about your company's entries, matches, introductions and transactions, and to reset your password.	Contract
Your company — legal name, trade name, trade-register number, addresses and the sites it operates from, sector, size band, website, e-mail domain, and the record of our trade-register check, including an extract from the register.	To establish that a real company established in the Netherlands is on the platform, to match on location and sector, and to disclose the company's identity to a counterparty when both have consented.	Contract; legitimate interests in admitting only genuine companies
Residual streams and requirements — what your company has or needs: materials, quantities, properties, analyses, hazard information, legal status, current handling, location, availability, and the free text you write.	This is the substance of the service: review, matching, cards, assessments and introductions.	Contract
Documents you upload — analyses, safety data sheets, certificates, specifications, photographs, and the documents attached to a transaction record such as weighbridge tickets and transport documents.	To let a reviewer assess an entry, to release cleared documents to a counterparty after disclosure, and to give the parties to a transaction a shared record.	Contract
Consents — which version of the Terms of Use and this statement you accepted, each disclosure you consented to and at which level, whether you asked to be named in the introduction e-mail, and the opt-in, per residual stream, for GreCoM's own commercial use.	To record what you agreed to and when, and to be able to prove it.	Contract; Article 7(1) GDPR for proof of consent
Matches, interest, disclosures and introductions — which match was proposed, what each party decided, when consent was given, what was disclosed, the review decisions, and the introduction e-mail.	To run the matching and disclosure process and to keep the evidence of what was released to whom.	Contract; legitimate interests in keeping evidence of disclosures
Outcome declarations and transaction records — what each party declared an introduction led to; the steps, charge lines, documents, discrepancies and disputes the parties record on a transaction record; and the generated summaries.	To give the two parties their shared record, and to let GreCoM evaluate the pilot and design its fee model. GreCoM cannot read the amounts, the file names or the contents of the documents.	Contract; legitimate interests in evaluating the pilot
Indicative introduction fees — for each introduction, the quantity band and what GreCoM's fee would have been under a future fee model. Nothing is charged during the pilot.	To evaluate the pilot and design the fee model.	Legitimate interests in developing the service
Waiting-list applications — name, business e-mail address, company name, country, the side you applied for, job title and telephone number if given, the reason you are waiting, the status of your application, the decisions taken on it with their reasons, and any invitation sent to you.	To hold your application until your company can be admitted, to invite you, and to let you register without re-entering your details.	Pre-contractual steps at your request; legitimate interests in building the network, for applicants established outside the Netherlands
Carriers — the company name, contact details and declared capabilities of transport companies listed in the carrier directory, and the name of the person who made the declaration where the carrier gave it.	To publish a directory participants can consult.	Legitimate interests in informing participants; the carrier's own request to be listed
Notifications and e-mails — the notifications shown to you in the platform and the e-mails sent to you (confirmation, password reset, review results, matches, consent requests, introductions, transaction steps, quarterly availability prompts, invitations).	To tell you what needs your attention. Security and action-required e-mails cannot be switched off.	Contract
Security and operational records — sessions, sign-in attempts, one-time tokens for e-mail confirmation, password reset and invitations, outgoing e-mails, and processed internal events. The IP address from which you sign in or register is stored as a one-way hash, not as the address itself.	To keep your account safe, to limit automated abuse of the registration, sign-in and password-reset forms, and to deliver e-mail.	Legitimate interests in security
Technical server logs — time, requested address and result of each request, with the IP address of the request shortened so that it no longer identifies a single connection, written by the web server and the application.	To protect the platform and to find faults.	Legitimate interests in security
The audit log — who did what, and when: every action on an entry, match, disclosure or transaction, every reading of a company identity or document by GreCoM staff with the reason given, every change to a waiting-list application, and the hashed IP address of the request.	So that GreCoM can show what happened and who did it, to its participants, to its supervisory authority and in a dispute.	Legitimate interests in accountability and in defending legal claims; Article 5(2) GDPR

What we do not do. We do not sell personal data. We do not use it for advertising. We do not profile you. No decision with legal or similarly significant effect on you is taken by automated means alone: matches are proposed by rules you can read on the platform's "How it works" page and are decided by a person before you see them.

3. Where the data comes from

Most of it comes from you: at registration, in the forms you complete, in the documents you upload and in the decisions you take on the platform.

We also receive:

an extract from the Dutch trade register (KvK) when a member of GreCoM's staff checks your company;
your company's identity and contact details from your counterparty, when a counterparty names your company in an outcome declaration or on a transaction record;
personal data that another participant includes in an entry or a document — for example the name of a laboratory analyst on an analysis report, or a driver's name on a transport document. Participants are asked to keep such data to the minimum;
a carrier's declared capabilities from the carrier itself or from GreCoM's staff recording what the carrier told them.

4. Who can see it

Other participants. Before a match is published, nothing about your company or your entries is visible to anyone outside GreCoM. When a match is published, the other party sees an anonymised card: sector, a coarse region (North, East, South or West), a quantity band, the material category and intended application, up to three key properties as bands, and flags for declared hazard and possible processing. Your identity, exact location, contact details, free text and documents are released only when both parties have consented to disclosure and GreCoM has approved it, and then to both at the same moment. Your own name and e-mail address are included in the introduction e-mail only if you ticked that option when consenting or set it as your company's default; otherwise the company's general contact details are given. The platform's "Confidentiality" page sets out, field by field, what a counterparty sees at each stage.

After disclosure, your counterparty is responsible for its own use of your identity and contact details, under the confidentiality obligations in the Terms of Use.

Inside GreCoM, access follows the role.

A reviewer sees the technical content of entries and documents in order to assess them, and sees company identities in order to carry out the trade-register check and the disclosure review. A reviewer does not see commercial facts: not which introductions became transactions, not outcome declarations, not indicative fees, not the waiting list.
The commercial team sees the waiting list, outcome declarations, indicative fees and the existence and status of transaction records, and may itself publish a requirement labelled "GreCoM Offer". It does not review entries, decide matches or approve disclosures.
An administrator can see company identities and entries, carries out account closure, erasure and retention decisions, and may approve a disclosure that involves a GreCoM Offer.
No role at GreCoM can read the amounts on a transaction record, the original file names or the contents of documents attached to a transaction, or a generated summary. The permission that would allow it exists in the platform and is granted to nobody.

Every reading of a company identity or a document by a member of staff is written to the audit log with the staff member's name, the time and the reason, and the identity reads are visible to you in your company's own activity record on the platform. Reviewers' internal notes are held in a separate database schema that the participant-facing application cannot read.

Our processors. GreCoM uses two categories of service provider, each under a written data-processing agreement, acting only on GreCoM's instructions:

Hetzner Online GmbH, Germany — hosting of the platform, its database, its file storage and its backups, in a data centre in the European Union;
Our e-mail delivery provider — delivery of the platform's e-mails, from servers in the European Union.

Malware scanning and the removal of metadata from uploaded files run on GreCoM's own server and involve no third party.

Others. GreCoM discloses personal data to a public authority, a court or a party to legal proceedings only where the law requires it or where it is necessary to establish, exercise or defend a legal claim, and to its professional advisers and insurers under a duty of confidentiality. In the event of a transfer of GreCoM's business, the data would be transferred to the successor, with notice to you.

5. Where it is processed

The platform, its database, its file storage and its backups are hosted in the European Union. GreCoM does not transfer personal data to a country outside the European Economic Area and has no intention of doing so. If that ever changes, this statement will say so first and name the safeguard relied on.

6. How long we keep it

The periods below are settings in the platform, not only words in this document. For every record the platform records what is due and when. Where a period runs from "closure", it means the closure of your company's account at your request or by GreCoM under the Terms of Use; an account is never closed for inactivity.

What	From when	How long	Then
A waiting-list application that is still open	The application, or the last recorded review of it	24 months	Deleted — unless a named member of staff records a reason to keep it longer, which restarts the period. The platform refuses a renewal without a recorded reason.
A waiting-list application that was admitted or rejected	The decision	6 months	Deleted. An admitted applicant's details continue under their account.
A sign-up that never confirmed its e-mail address	The sign-up	24 months	Anonymised
Your company's profile, locations and side profiles	Closure	24 months. While the account is open, kept.	Reduced to a restricted archive — see section 7
The restricted archive	The anonymisation	60 months	Deleted, except the records in section 8
Your own account details	Closure	30 days for the password hash, telephone number, job title and sign-in counters; 24 months for your name and e-mail address	Replaced with neutral values
Residual streams and requirements	The entry being archived, or closure	24 months	Free text removed; the structured record (categories, quantities, values, codes, dates) is kept
Documents attached to an entry	The entry being archived or rejected, or closure	365 days — or longer while a counterparty that received the document less than 24 months ago may still be relying on it	The file is deleted. We keep what kind of document it was, its size, its checksum and who reviewed it.
Matches, interest, consents, disclosures, introductions, review decisions and company checks	The record reaching its end state	7 years	Kept. See section 8.
Outcome declarations, transaction records, their documents and summaries	The record reaching its end state	7 years	Kept, as both parties' record. When a party's company is anonymised, the free text its people wrote is cleared and the original file names are removed; the structure and the files remain available to the other party.
Indicative fee records	The end of the financial year	7 years	Kept
The audit log	The event	7 years	Kept. It is hash-chained and rejects modification by every role in the system, by design.
Sessions	Expiry	30 days	Deleted automatically
One-time tokens (e-mail confirmation, password reset, invitations)	Expiry or use	7 days	Deleted automatically
Sign-in attempts	The attempt	90 days	Deleted automatically
Outgoing e-mails (the copy the platform keeps)	Sending	30 days	Deleted automatically
Notifications in the platform	Creation	12 months	Deleted automatically
Technical server logs	The request	30 days	Overwritten
Backups of the database and file storage	The backup	30 days	Overwritten. Data you asked us to delete may remain in a backup until that backup expires; a restored backup is brought up to date with deletions before it is used.

What is automatic today, and what is not. The short-lived security and operational records — sessions, tokens, sign-in attempts, outgoing e-mails, notifications, processed events — are deleted automatically every day. For every other category the schedule above is configured, and the platform records, for each record, what is due and when; but the automatic deletion itself is run in a reporting mode during the pilot: it reports what it would delete or anonymise, and a person at GreCoM reads and approves the first automatic run before it happens. Until then, deletion and anonymisation are carried out by an administrator, with a record of who did it and why, and a request from you is acted on within one month (section 10). A deletion that is due is never postponed because it was not yet automatic; it is carried out by hand.

Legal holds. Where a record is needed for a dispute, an investigation or a legal obligation, GreCoM can place a hold on it that suspends its period. A hold names the person who placed it and the reason, and is reviewed. An open dispute on a transaction record suspends the anonymisation of either party until the dispute is withdrawn.

7. What "anonymised" means here — and what it does not

When your company's record reaches the end of its period, the platform replaces the identifying fields: the legal name becomes "Anonymous Industrial Participant" with a number; the trade name, trade-register number, website, description and contact details are cleared; the contact person's name and e-mail address are replaced; the location is reduced to one of four regions; and the free text on entries, analyses and consent decisions is cleared. The sector, the size band, quantities, codes and dates stay, because the record of the network is the reason the account existed.

We call the result a restricted archive, not anonymous data. With a few dozen companies across four sectors, a sector and a size and a region can still point at one company, and the record stays linked to introductions whose other party is still active and may remember who you were. So we continue to treat the archive as personal data: access is restricted to the highest internal role, it is excluded from everything participants see and from the matching engine, it feeds no figure that is not aggregated, and it is deleted after a further 60 months.

8. What we cannot delete, and why

Three things survive a deletion request, and you should know this before you make one.

The record of an introduction — that it happened, who consented, at what level, what was disclosed and when, and what each party declared it led to. It is the evidence both parties and GreCoM may need if something is disputed later, and Article 7(1) of the GDPR requires GreCoM to be able to show that consent was given. After your company is anonymised, these records remain, pointing at the anonymous label rather than at you.

The transaction records and documents you shared with a counterparty. A weighbridge ticket or transport document attached to a transaction record is the other party's evidence as much as yours. When your company is anonymised, the free text your people wrote is cleared and the original file names are removed, but the records and the files remain available to the other party for the period above. Summaries generated before anonymisation remain as they were.

The audit log, for seven years. It is chained and rejects modification for every role in the system, deliberately: a log that can be edited is not a log. It holds identifiers, action codes, hashed IP addresses, and the reasons GreCoM staff typed when they acted. GreCoM's console warns a member of staff who appears to be typing an e-mail address, a telephone number, an address or a register number into a reason field.

Everything else — your name, your e-mail address, your company's identity, your descriptions, your files — is deleted or anonymised as described above.

9. Security

GreCoM takes the following measures, among others, to protect personal data:

the platform is reached only over an encrypted connection (HTTPS), and the database and file storage are not reachable from the internet;
passwords are stored as one-way hashes; sign-in is rate-limited and an account is locked temporarily after repeated failures; sessions expire;
every uploaded file is scanned for malware and stripped of embedded metadata before anyone can open it, and files are served only through the platform to those entitled to see them;
access inside GreCoM follows the role, and the separation between the reviewing and the commercial role is enforced by the platform and tested automatically;
the audit log is hash-chained and cannot be altered by any role;
reviewers' internal notes live in a separate database schema that the participant-facing application cannot read;
backups are encrypted and stored off the server, inside the European Union;
the platform's software dependencies are checked for known vulnerabilities at every build, and a build with a known vulnerability is refused.

No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to you, GreCoM notifies the Autoriteit Persoonsgegevens within 72 hours of becoming aware of it, and notifies you where the risk is high, as the GDPR requires.

10. Your rights, and how to exercise them

You can ask GreCoM:

for access to the personal data we hold about you, and a copy of it;
to correct data that is inaccurate or incomplete — your account and company details you can also correct yourself on the platform;
to delete your personal data, subject to section 8;
to restrict processing while a request is being handled or a dispute is open;
to object to processing that we base on legitimate interests; we then stop unless we can show compelling grounds that override your interests;
to receive the data you provided to us in a structured, commonly used, machine-readable format, where we process it on the basis of contract or consent;
to withdraw a consent at any time — the opt-in for GreCoM's own commercial use you can withdraw yourself on the stream's overview page; withdrawal does not undo what was lawfully done before it, and a disclosure that has taken place cannot be undone.

The platform does not yet offer a self-service export or a self-service account closure. Write to privacy@grecomhub.com from the e-mail address of your account, or state your name and company so that we can confirm who is asking. We may ask you to confirm your identity. We answer within one month. Where a request is complex or there are many, we may take up to two further months and will tell you so within the first month. Requests are free of charge unless they are manifestly unfounded or excessive. We tell you plainly where a right is limited; the cases in section 8 are the ones we expect.

If you are not satisfied with our answer, you can lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the supervisory authority of the EU member state where you live or work.

11. Cookies and what your browser stores

The website at grecomhub.com sets no cookies at all, and loads no third-party scripts, fonts or analytics. The contact form opens your own e-mail program with the text you typed; the website stores nothing.

The platform at grecomhub.com uses no advertising, analytics or tracking cookies, and no third-party scripts. There is therefore no consent banner, because there is nothing to consent to. Signed in, the platform uses:

one cookie, grecom_sid, which identifies your session. It is sent only over HTTPS, cannot be read by scripts, and ends when you sign out or when the session expires, 12 hours after you signed in. This cookie is strictly necessary and needs no consent;
a security token against cross-site form submission, kept in your browser's session storage and discarded when you close the tab;
a few preferences kept in your browser only and never sent to us as such: your chosen language, your display theme, which of your company's workspaces was active, the step you reached in a form, and whether the welcome message has been shown.

12. GreCoM's own commercial interest

GreCoM develops technologies for processing residual streams and may itself buy or process material. A producer can, per residual stream, allow GreCoM's commercial team to consider that stream for GreCoM's own business. The opt-in is optional and off by default; it is recorded as a consent with its version and date; and it can be changed at any time on the stream's overview page. Without it, GreCoM's commercial team does not see the stream for that purpose, and the stream's data is used only for review and matching. Where GreCoM publishes a requirement of its own, every card and match based on it is labelled "GreCoM Offer".

13. Children

The platform is for companies and their staff. We do not knowingly process data of anyone under 16.

14. Changes to this statement

When the platform changes what it does with personal data, this statement changes with it and carries a new version number and date. The version you accepted at registration is recorded with your account. We tell you about a material change by e-mail and on the platform before it takes effect, and where a change needs your renewed acknowledgement we ask you for it and record the version you acknowledged. Previous versions are available on request.

15. Language

This statement is drawn up in English and translated into Dutch. In the event of any difference in meaning, the English text prevails.

GreCoM B.V. · Stationsplein 45, 3013 AK Rotterdam · KvK 42043325 · VAT NL869447014B01 · privacy@grecomhub.com

Privacy Statement