Privacy and Cookie Policy Xolphin B.V.
This privacy and cookie policy is a translation. In case of a dispute the original Dutch version prevails.
Latest update: April 15, 2026
Xolphin B.V. (hereafter: “Xolphin”) considers the careful handling of personal data to be of great importance.
We carefully process and adequately secure personal data. We comply with the requirements of the General Data Protection Regulation (GDPR). In some cases, Xolphin is a controller for data processing and in other cases a processor or sub-processor of personal data.
In this privacy policy, we explain what personal data we collect and use and for what purpose we do so, in the event that we are the controller. In the event that we are processor or sub-processor for your personal data (e.g. if you have purchased a product from us from one of our suppliers) please refer to the controller's privacy policy (see below).
If you have any questions or would like to know exactly what data we keep about you, please contact us using the contact details which you can also find at the bottom of the privacy and cookie statement.
Processing of data
By using our website and by purchasing products or services you leave us certain (personal) data. In this section, we will explain what data is involved and for what purposes we process that data.
Contact
If you contact us, for example by means of a contact form on the website, an email, or the telephone, then the (personal) data provided by you will be stored. We do so to be able to answer your question, in the execution of, or in preparation for the conclusion of, an agreement. This may concern:
- First and last name
- Department
- Company name
- Email address
- Timestamp
- The order to which the contact relates
- Any additional information you provide to us
- Voice logs
We retain this data so that we can answer the question asked or process the information in the form or email. We retain this information to the extent necessary, but no longer than 2 years if you are not yet a customer of ours. If you purchased a service or product from us in the past, your data will be retained for 7 years. This is because the Webtrust industry standard requires us to retain data from customers who have purchased products or services for 7 years.
Account on our website
For certain parts of this website, you will need to register first. Your username is linked to a password. It's your own responsibility that you choose your password with care and that you handle your password carefully. The employees of Xolphin do not have access to your password. If you have forgotten your password or suspect that it is compromised, you can create a new password through the website.
We retain this data so that you do not have to re-enter it with every order, so that we can contact you for invoicing and payment, and to provide you with an overview of the products you have purchased from us. All this is done in the context of the execution of an agreement you enter into with us. We retain this data for as long as you purchase a product or service from us, or for a maximum of 7 years after the product or service has expired or been withdrawn. The Webtrust industry standard requires us to retain data of customers who have purchased certificates for 7 years. For the data we require for our administration, the statutory tax retention period of 7 years applies.
The information we store in your account is:
- First and last name
- Email address
- Telephone number
- Address details (personal or of the company you work for)
- Optionally, a different billing address
- VAT number and Chamber of Commerce number
- Fax number
- Name and email address of persons authorized to log in to the account
- Payment details
- Invoices
- The issued certificates containing the company details
- Quotes
Placing an order
Your order history is also linked to your account. We need this data to process your order, to pass it on to the supplier, and to assist you afterwards with the use of the product or service. We can also use this to display the status of the order, and you have an overview of all your purchased products and services.
We may use the aggregated data for research & development and product improvement. All this is done within the framework of (improving) the execution of the agreement. We retain this data for as long as you purchase a product or service from us, or for a maximum of 7 years after the product or service has expired or been withdrawn. The Webtrust industry standard requires us to retain data of customers who have purchased certificates for 7 years. For the data we need for our administration, the statutory tax retention period of 7 years applies. We process the following data in your order history:
- Name and address details
- Email address
- Telephone number
- Department
- Contact person
- VAT number and Chamber of Commerce number
- Start date
- Organizational form
- Domain name holder details
When your product is about to expire, we will automatically send you a renewal reminder by email. You can unsubscribe from this by sending us an email.
Support
The products we sell are quite technical. Sometimes you may need some extra support with the installation. In that case, you can contact us so that we can help you substantively. We will ask you to provide us with some technical information so that we can offer you the right support. Are we unable to find a solution by email or telephone? Then we may ask your permission to use Teamviewer. This is a third-party program that allows you to remotely view your screen. By using Teamviewer it is possible that we encounter personal data on your screen. Naturally we will not use this personal data, insofar as this is not necessary to use to provide the requested support. We will not store data we see on your screen. You can revoke your consent at any time. We will then immediately stop using Teamviewer.
Customer satisfaction survey
It is important for us that our customers are satisfied. In order to gather insight into the level of satisfaction among our customers, we conduct customer satisfaction surveys. We will contact you to participate in a customer satisfaction survey through the contact information in your account. We have a legitimate commercial interest in using your information to conduct a customer satisfaction survey. If you do not want us to use your personal data for this purpose? Please send us an email, and we will not contact you for this purpose again.
Reviews
We would like to hear your opinion about our products or services. Sometimes we may ask if it is okay to post your review online. We will then publish your first and last name, the products and/or services you have purchased and the content of your review on our website and on our social media channels. We will only do so after having obtained your prior consent. You can revoke your permission at any time. We will either delete the review or completely anonymize it.
Working at Xolphin
We offer different vacancies on our website and different job boards. When you apply for a vacancy with us, we collect the following personal data:
- Name and address details
- Gender
- Date and country of birth
- Contact information
- Contents of your resume (such as information on study and employment history)
- Content of your cover letter
- Salary indication
- Availability
- Any references provided
We process this data in order to deal with your application, and to prepare the possible conclusion of an employment contract.
We store the application data for a maximum of four weeks after the position has been filled. We store this information so that we can contact you in the event that the vacancy becomes available again within the probationary period. If we are not able to offer you a job at that moment, we can - with your consent – store your application data for another year. You can revoke your consent at any time by sending us an email.
Security
We use strict security procedures, e.g. to prevent unauthorised persons from accessing, personal data so that it cannot be misused, provided, modified or damaged. We use secure connections that encrypts all information sent to and from our server. We also use:
- Physical security through locks on doors and safes, controlled access to buildings and facilities, camera surveillance and secure destruction of paper records
- Technical security using antivirus, encryption and monitoring of systems, servers and data centres
- Certification in accordance with the ISO 27001:2013 and WebTrust standards
Delivery of product or service via suppliers and transfer of personal data
We will not provide your personal data to third parties unless this is necessary in the context of the execution of the agreement you enter into with us, if you have given us permission to do so, if this is legally required, or if we have a legitimate interest in doing so. In the event of suspected fraud or misuse of our website, we may hand over personal data to the competent authorities.
In the context of the agreement, we share your data with the supplier(s) and/or service provider(s) designated by you. When purchasing a product or service on our website, you choose a supplier from whom you wish to receive the product. This supplier needs your personal data to be able to deliver the desired product and thus to execute the agreement (the End User Agreement) that you have entered into with them through us. We arrange the transfer of the (personal) data provided to us in the account to this supplier. If you request a certificate, this data – such as the name of the applicant – may be visible in the certificate provided by the supplier. We do this based on the agreement you enter into with us. The suppliers are independently responsible for your personal data regarding the application and issuance of the product. Specifically, the supplier determines which data we must collect and what must be done with it, and we execute this instruction. For instance, the supplier also determines how long we retain your data, namely 7 years.
It is possible that we use third parties established in a country outside the European Economic Area (‘EEA’) for our services. We only use such a party if one of the following situations applies:
- This recipient is established in a third country that the European Commission has indicated provides an adequate level of data protection (an adequacy decision).
- The recipient of the personal data offers appropriate safeguards (for example, by means of EU standard contractual clauses).
- We have obtained your explicit consent for this.
Our suppliers: Sectigo, DigiCert, and GlobalSign, are global organizations. They use systems worldwide. This means that your personal data will be processed globally, and therefore also outside the EEA. For all these suppliers, that means that your data will be processed in Europe, in Asia or Asia-Pacific, Canada and in the United States. DigiCert and GlobalSign also process your data in the Middle East and Africa. More information about this can be found on the websites of the suppliers. The suppliers have made sure that all their offices handle your (personal) data with care. For more information, please refer to the privacy policy of these companies (see below).
For the other described purposes, Xolphin is the controller of the processing of your personal data. We, Xolphin, use services of third parties. These third parties process your personal data on our behalf. These include:
- Suppliers of IT services
- ISP and the internet and telephone providers
- Accountant
- Supplier of the accounting software
- Collection agency
We do not allow these service providers to share the data or use it for anything other than providing those services. We have concluded processor agreements with our service providers.
Websites of third parties
When you click on a link from a third-party website (such as Thuiswinkel or NL Digital), the administrators of this website may collect your personal data.
This privacy and cookie policy does not apply to websites of third parties that are connected to this website through links. We cannot guarantee that these third parties will handle your personal data in a reliable or safe manner. We recommend that you read the privacy and cookie policy of these websites before using them.
Use of cookies
We use cookies via our website. A cookie is a small file that is sent with pages from this website and stored by your browser.
We use the cookies to:
- enable functionalities of the website (technical or functional cookies that are stored per session);
- analyze the use of the website and check from which country you are visiting the website, and improve the website based on the information or show you the correct website (analytical cookies that are stored per session).
These cookies collect the following information from you:
- IP address
- Cookie ID
- Website and click behaviour
- Referrer URL
When you visit our website for the first time, we will show a message with an explanation about cookies. To the extent we are obliged, we will ask for your agreement to the use of cookies.
In the table below you will find an overview of the cookies we use.
| Cookie | Type | Purpose | Retention Periods |
|---|---|---|---|
| xolphin_session | Necessary | No description | 1 hour |
| _pk_id.1.0544 | Statistics | Statistics Collects statistics about the user's visits to the website, such as the number of visits, average time spent on the website and which pages were read. | 1 year |
| _pk_ses.1.0544 | Statistics | Used to track the page requests made by the user during the session. | 30 minutes |
| CookieConsent | Necessary | This cookie stores the user's consent status for the current domain. | session |
If you want to know what the cookie service providers do with your personal data, read the privacy statement of the company in question.
Enabling and disabling cookies
You can set your web browser to only accept the storage of cookies if you agree. For more information about this, consult your browser manual. Please note: many websites do not work optimally if cookies are disabled.
Delete cookies
Most cookies have an expiration date. If an expiration date is set, the cookie will be automatically deleted when the expiration date expires. You can also choose to delete the cookies manually before the expiration date has expired. Consult your browser manual for this.
Changes to privacy and cookie statement
We have the right to make changes to this statement. We advise you to consult this statement regularly so that you are aware of these changes.
Changes to privacy and cookie policy
We have the right to make changes to this policy. It is recommended that you check this policy periodically so that you are aware of these changes.
Your rights
You have the following rights:
- Right of access: You have the right to view the personal data that we process about you.
- Right to rectification: You have the right to correct or supplement the personal data that we process about you if it is incorrect or incomplete.
- Right to object: You can object to the processing of your personal data and to direct marketing.
- Right to deletion: You can request us to delete your personal data.
- Right to withdraw your consent: if you have given us consent to process personal data, you can withdraw this consent at any time.
- Right to data portability: if it is technically possible, you have the right to have the personal data that we process about you transferred to a third party.
- Right to limit processing: in some cases you can request us to limit the processing of your personal data (temporarily or permanently).
We will ask you to identify yourself before processing such requests. We will inform you of the decision in writing within four weeks of receiving the request. However, this period may be extended by a maximum of 2 months for reasons related to the specific rights of data subjects or the complexity of the request. If we extend this period, we will inform you in a timely manner.
Submit questions or complaints
You can always direct questions about our privacy and cookie statement, questions about your rights or complaints to administratie@xolphin.nl.
If you feel that we are not helping you in the right way, you have the right to file a complaint with the supervisory authority. For the Netherlands, this is called the https://www.autoriteitpersoonsgegevens.nl/en.
Contact information
Xolphin B.V.
Rogier van der Weydestraat 2
1817 MJ Alkmaar
CoC number: 37101223
Phone number: 088 775 7750
Privacy policies of suppliers:
