Privacy Statement

  1. Introduction

    GUC Agency (listed under the name of GUC Agency B.V. in the Netherlands, and listed under the name of GUC DIFR Agency, UNIPESSOAL LDA, in Portugal) is an advertising agency with offices in Amsterdam and Lisbon (hereinafter referred to as “GUC Agency” or “we”). We process data about persons (“personal data”) in the context of our operations. This privacy statement explains how we make use of personal data. We explain issues including the following:

    –   the personal data that we process for each category of persons;

    –   the purposes for which and the basis on which we process this personal data;

    –   the parties with whom we may share personal data;

    –   how we protect personal data;

    –   the rights of persons whose data we process;

    –   who you can contact about this privacy statement and the manner in which we process your personal data.

  2. Our contact details for each branch

  3. Categories of persons

    We process personal data of the following categories of persons:

    Clients

    Persons who are a client or work for a client (our contact persons)

    Suppliers

    Persons from whom we source products or services or who work for our suppliers

    Job applicants

    Job applicants or persons who are considering seeking a job with GUC Agency

    Employees

    Persons who work for us, including freelancers

    Third parties

    Other persons, such as persons who appear in the advertising material we produce, recipients of newsletters or visitors to our website

  4. The personal data we process

    The personal data we process of each category of persons is listed in the following table.

    Categories of persons
    Personal data we process
    Clients – Forename and surname;
    – Contact details such as business address, telephone numbers and email addresses;
    – Payment details, such as bank account numbers;
    – Other data of which processing is required pursuant to, or is necessary for the purposes of, the application of the relevant legislation and regulations.
    Suppliers – Forename and surname;
    – Contact details such as business address, telephone numbers and email addresses;
    – Payment details, such as bank account numbers;
    – Other data of which processing is required pursuant to, or is necessary for the purposes of, the application of the relevant legislation and regulations.
    Job applicants – Name and address details;
    – Contact details such as telephone numbers and email addresses;
    – Curriculum vitae details, such as information about completed study programmes, courses and internships and past and current employers, where applicable;
    – Other data of which processing is required pursuant to, or is necessary for the purposes of the application of, the relevant legislation and regulations.
    Employees – Name and address details;
    – Contact details such as telephone numbers and email addresses;
    – Date of birth;
    – Payment details such as bank account number;
    – Curriculum vitae details, such as information about completed study programmes, courses and internships and past and current employers, where applicable;
    – Payment details such as bank account number
    – Copy of identity document or passport;
    – Personnel details, such as absence;
    – Other data of which processing is required pursuant to, or is necessary for the purposes of the application of, the relevant legislation and regulations.
    Third parties – Name and address details;
    – Contact details such as telephone numbers and email addresses;
    – Data concerning a visit to our website, such as data collected to update visitor statistics about our website (collected, for example, using Google Analytics and Facebook Pixel);
    – Other data we receive from clients or third parties, or which is available from public sources.
  5. The purposes for which we process this data and the legal basis for this processing

    We may process personal data solely when there is a valid legal basis for doing so. For this reason, we process the aforementioned data above solely when:

    – the processing is necessary for the performance of a contract with the person involved, or to carry out actions on the request of the person involved prior to entering into an agreement, such as the maintenance of contact reports for a client or the completion of a selection procedure (hereinafter referred to as the “performance of the contract”);

    – the processing is necessary to comply with a statutory duty imposed on us, for example the obligation to include a copy or scan of the identity document of each of our employees in our payroll records pursuant to the Wages and Salaries Tax Act (hereinafter referred to as a “statutory duty”);

    – the processing is necessary for the purposes of the legitimate interests of GUC Agency or a third party, for example the use of contact details to send our newsletter (hereinafter referred to as a “legitimate interest”); or

    – the person involved has given consent for the processing (hereinafter referred to as “consent”).

    The purposes for which the personal data of each category of persons is processed are listed below, together with the legal basis for this processing:

    Category
    Purpose
    Basis
    Clients Provision of our products – Performance of the contract
    – Legitimate interest
    Collection of fees and settlement of payments – Performance of the contract
    – Legitimate interest
    Communication with the person involved – Performance of the contract
    – Legitimate interest
    Implementation or application of legislation or regulations – Statutory duty
    – Legitimate interest
    Suppliers Placing orders or procuring services – Performance of the contract
    – Legitimate interest
    Communication with the person involved – Performance of the contract
    – Legitimate interest
    Settlement of payments – Performance of the contract
    – Legitimate interest
    Implementation or application of legislation or regulations – Statutory duty
    – Legitimate interest
    Job applicants Assessment of suitability for position – Performance of the contract
    – Statutory duty
    – Legitimate interest
    Communication with the person involved – Performance of the contract
    – Legitimate interest
    Implementation or application of legislation or regulations – Statutory duty
    – Legitimate interest
    Employees Granting access to our offices or our internal networks, or for the security thereof – Statutory duty
    – Legitimate interest
    Calculation and recording of income and expenditure and settlement of payments – Performance of the contract
    – Statutory duty
    – Legitimate interest
    Implementation or application of legislation or regulations – Performance of the contract
    – Legitimate interest
    Third parties Provision of our products and services to the clients – Performance of the contract
    – Statutory duty
    – Legitimate interest
    Communication with the person involved – Performance of the contract
    – Legitimate interest
    Maintenance of contacts and sending information about GUC Agency's services – Consent
    – Legitimate interest
    Implementation or application of legislation or regulations – Statutory duty
    – Legitimate interest
  6. Parties with whom we may share personal data

    The receiving parties with whom we may share the personal data of each category of persons are listed below.

    Categories of persons
    Receiving party
    Clients – Persons working at our agency (in particular, those persons at the agency who are involved in the contacts with clients);
    – Suppliers (such as research agencies and sub-processors);
    – Others, with the consent of the person involved, or when there is a statutory duty.
    Suppliers – Persons working at our agency (in particular, those persons at the agency who are involved in placing orders and procuring services);
    – Others, with the consent of the person involved, or when there is a statutory duty.
    Job applicants – Persons working at our agency (in particular, those persons at the agency who are involved in the selection procedure);
    – Others, with the consent of the person involved, or when there is a statutory duty.
    Employees – Persons working at our agency;
    – Pension and other insurers;
    – Parties providing back-office services (such as the parties that maintain our payroll accounts and absence records);
    – Others, with the consent of the person involved, or when there is a statutory duty.
    Third parties – Persons working at our agency;
    – Suppliers (for example, the party that maintains the use statistics for our website);
    – Others, with the consent of the person involved, or when there is a statutory duty.
  7. How we protect your personal data

    1. GUC Agency has implemented technical and organisational measures to protect your personal data from destruction, loss, alteration, unauthorised disclosure and unauthorised access. Persons working at our agency are bound to confidentiality and are required to comply with our instructions for the appropriate protection of your data.
  8. Cookies on our website

    1. Cookies are small text files that websites place on your computer or the peripheral device that you use to visit the website. They are used to collect your personal data and other data. Our website also uses cookies: we use Google Analytics, a service that provides us an insight into the manner in which our website is used. This relates to use statistics such as the numbers of visitors, the pages they visit and the average length of visits. We have concluded a processing agreement with Google to ensure that personal data collected for us within the context of Google Analytics is only used to provide us an insight into the manner in which our website is used. We have also adjusted the configuration of the service so that the data may not be deployed by other Google services and that the last digits of all IP addresses collected within this context are deleted to ensure that they cannot readily be traced to a specific user.
    2. List of cookies
    Cookie and key
    Data
    Purpose/function
    Google Analytics cookie

    • _gid
    • _gat
    • _ga
    We collect data including the following:
    • Number of visits
    • Page displays
    • Bounce percentage
    • Average time of visit
    • Viewing behaviour
    Analytics
    We place this cookie to obtain an insight into the manner in which our website is visited.
    Facebook Pixel cookie We collect data including the following:
    • Visitors
    • Navigation behaviour
    Analytics & Tracking
    We place this cookie to gain an insight into the effectiveness of our advertisements and to generate advertising target groups.
    October session cookie We collect data including the following:
    • None
    Functional
    We place this cookie to guarantee the performance of the website.
  9. Transfer to countries outside the EEA

    1. It is possible that personal data is transferred to a country outside the European Economic Area (EEA) which provides a lower level of protection to personal data than that provided by the legislation in the EEA. It is, for example, possible that we use a supplier of online services that is established outside the EEA (for example, in the United States of America) and that the use of these services involves the transfer of personal data to the supplier.
    2. The countries outside the EEA to which we wish to transfer personal data are listed below, together with the safeguards put in place to guarantee the level of protection in the relevant country.
    Country outside the EEA
    Safeguard
    United States of America Adequacy decision by the European Commission. The party to whom we transfer the personal data has been granted “EU-US Privacy Shield” certification that requires it to comply with European privacy legislation
  10. The time we retain personal data

    1. We do not process your personal data for longer than is necessary for the processing purposes referred to in this privacy statement. This means that your personal data is retained for as long as is necessary to fulfil the relevant purposes. However, some data must be retained for a longer period of time to comply with our statutory retention duties.
  11. Your rights with regard to your personal data

    1. Persons have the following statutory rights with respect to their personal data:
      1. the right to be informed whether or not his/her personal data is being processed and, when his/her data is processed, the right of inspection;
      2. the right to request rectification of this personal data;
      3. the right to request erasure of this personal data;
      4. the right to lodge an objection against the processing of this personal data;
      5. the right to request the restriction of the processing of this personal data;
      6. the right, when consent is required for the processing of this personal data, to withdraw this consent at any time;
      7. the right to receive this personal data or transfer this personal data to an organisation designated by him/her, in a structured, commonly used and machine-readable format, to the extent that he/she has issued the personal data to the controller;
      8. the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him/her or similarly affects him/her;
      9. depending on the country where he/she lives, the right to file a complaint with a supervisory authority that monitors compliance with the regulations for the protection of personal data. In the Netherlands, this is the Dutch Data Protection Authority in The Hague (www.autoriteitpersoonsgegevens.nl).

    2. GUC Agency will deal with a request in connection with the exercise of these rights in the manner as prescribed by law. These rights are not applicable in all circumstances, and the applicable rules provide for the necessary exceptions. We shall explain the reasons why we have not granted a request, where applicable.
  12. Contact details

    1. You can exercise the aforementioned rights by sending an email to privacy@guc.nl. You can also use this email address to lodge a complaint about the manner in which GUC Agency has processed your personal data. If you are dissatisfied with the manner in which we have dealt with your complaint then you can file a complaint with the Dutch Data Protection Authority or, when you reside or work in another country of the EEA, with the supervisory authority in that country.
  13. Amendments to this privacy statement

    1. We may amend this privacy statement. New versions are always published on the website. For this reason, we recommend that you regularly consult this privacy statement to keep up to date with any changes.
    2. This privacy statement was last amended on 21 March 2019.