Snapshot 34179
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Personal Data
Processing Policy
1/11
Table of
contents
1. Applicability 3
2. Objective 3
3. Legal and staturory framework 3
4. Responsibilities for implementation 3
5. Scope 3
6. Applicability 4
7. Personal data being processed 4
8. Principles for processing personal data 4
9. Security 5
10. Lawfulness of processing 6
11. Data Protection Impact Assessments 7
12. Confidentiality 7
13. Preventing, monitoring and dealing with personal data breaches 8
14. Data subject rights 8
15. Sharing of personal data 10
16. Automated processing 11
17. Worldstream is accessible 11
18. Data protection by design and default 11
19. Policy ownership, review and updates 11
2/11
1. Applicability
This policy applies to Worldstream B.V. (“Worldstream”). Worldstream is a company registered in, and
doing business from, the Netherlands.
2. Objective
The goal of this policy is to document how, when processing personal data, Worldstream:
• Complies with applicable data protection laws;
• Processes personal data only for legitimate purposes;
• Limits access to personal data to only individuals with a legitimate business purpose for such
access; and
• Respects the rights of data subjects.
This data protection policy is intended to provide consistent standards for the processing of personal
data by Worldstream.
3. Legal and statutory framework
As a Dutch company, Worldstream is regulated and most impacted by Dutch law.
4. Responsibilities for implementation
The implementation of this policy is the responsibility of Worldstream management and the Chief
Information Security Officer.
5. Scope
This policy applies to the processing of personal data by Worldstream in the context of commercial
relationships where Worldstream determines the purposes and means of the processing of personal
data. Within this scope, Worldstream acts as controller of personal data processing in the sense of the
GDPR.
This policy may apply to pseudonymous data. Pseudonymous data is data where the personal identifier
has been replaced with another identifier. When Worldstream or parties that it can instruct can obtain
the original identifier, pseudonymous data is personal data and this policy applies.
Worldstream provides its services neutrally: Worldstream does not play an active role in connection
with the Customer’s services that would give Worldstream knowledge of, or control over, information
published by Customers.
This policy does not apply to data that has been rendered anonymous. Data is considered anonymous
when it has been processed in such a way that it is not possible to undo the anonymization.
3/11
6. Applicability
This policy applies when personal data is processed by the following legal persons:
• Worldstream B.V.;
• Worldstream Network B.V.; and
• Greenhouse Datacenters B.V.
(together hereinafter referred to as “Worldstream”).
7. Personal data being processed
The policy concerns the personal data processed by Worldstream in the context of a commercial
relationship between Worldstream and data subjects. This includes relationships where identified or
identifiable natural persons are receiving services from Worldstream or are providing goods or services
to Worldstream.
Worldstream knows what personal data it processes. Worldstream has a data processing register in
place in which Worldstream maintains a record of processing activities under its responsibility.
• Name (First name, inititals, and last name)
• Gender
• Date of birth
• Address
• Phone number
• E-mail addresses
• Signature
• Traffic information (information we process to transmit communications about the network or for
the invoicing of it. For example: internet traffic usage)
• Questions you ask us by e-mail, chat or telephonically
• Complaints you may lodge with us
• Payment information (including details such as bank account or credit card numbers)
• Identification documents (such as ID card/passport details)
Furthermore, Worldstream may process additional personal data in the context of identification and
Know Your Customer checks.
8. Principles for processing personal data
8.1. Lawfulness, fairness and transparency
Worldstream aims to process your personal data fairly in accordance with its legal obligations. We will
do this with the greatest possible transparency to data subjects.
8.2. Proportionality
Taking into account both its own legitimate interests as well as those of data subjects, Worldstream
4/11
will process personal data in such a way that the processing is proportionate to the purpose of the
processing.
8.3. Purposes for processing personal data and purpose limitation
Worldstream shall collect personal data for specified, explicit and legitimate purposes and shall not
process personal data further in a manner that is not compatible with these purposes.
8.4. Data minimization
The data that Worldstream processes will be kept at a level that is adequate, relevant and limited to
what Worldstream needs to process for the purposes for which personal data is being processed.
8.5. Accuracy
Worldstream will strive to maintain personal data accurate. When and where necessary. Worldstream
will keep personal data up to date.
8.6. Storage limitation
Worldstream shall keep personal data no longer than is necessary for the purposes for which it collected
the personal data. Personal data processed in the context of your use of our website is kept for no
longer than a 3 months after your last visit to our website. Personal data processed in the context of an
agreement with Worldstream in which a data subject is involved will be kept for a minimum of two years
and a maximum of seven years in case of information Worldstream needs to store for tax reasons.
When and where necessary, and as possible, Worldstream may anonymise personal data. In this case
this will no longer be personal data and will fall outside the scope of this policy.
8.7. Integrity and confidentiality
Worldstream will process personal data in a way that ensures that the level of protection is
proportionate to the required integrity and confidentiality of the personal data being processed.
9. Security
Worldstream strives to keep in place appropriate technical and organizational measures intended to
protect personal data against unauthorized access or disclosure.
Worldstream will apply the following technical and organizational measures to protect the security of
personal data:
• Access controls: Worldstream has in place procedures and policies as well as physical and technical
controls that limit physical access to its IT systems to Persons who are properly authorized.
Security is vital to Worldstream’s continued success. Worldstream has a clear security policy in place
aimed at ensuring Worldstream’s continued certification and compliance with the relevant legislation.
Worldstream is regularly audited on the basis of the following standards:
- ISO 9001;
- ISO 14001;
5/11
- ISO 27001;
- SOC1 (ISAE3402);
- SOC2 (ISAE3000); and
- PCI-DSS
Worldstream keeps an Information Security Management System in place which has been declared
applicable most recently by means of a policy declaration signed by the directors of Worldstream
Holding B.V. on 31 July 2024.
Worldstream has and maintains its ISO 27001 certification. As part of its certification process,
Worldstream performs and maintains risk analyses and risk inventories. In designing its security
measures, Worldstream puts in place technical and organizational measures appropriate to the
personal data being processed by Worldstream.
Worldstream has a data breach protocol in place in which it documents how Worldstream will deal with
(potential) personal data breaches.
Worldstream registers personal data breaches and strives to implement the learnings from (potential)
personal data breaches in the improvement of its security and other processes.
10. Lawfulness of processing
10.1. Based on consent
Worldstream may request your consent to process certain personal data, which consent you may
withdraw through a link in the electronical messages, by way of a support request, or through the portal
(my.worldstream.nl).
10.2. For the performance of a contract
Worldstream processes personal data to implement that agreement. Worldstream cannot provide
services to you without using your personal data.
The information filled out on the quotation form or digitally through the website or portal (my.
worldstream.nl) is processed for your request for a (new) service.
Personal data is used for administrative purposes such as invoicing and accounting. Worldstream
maintains usage statistics for the services provided to you for the invoicing of the consumption of the
services.
Worldstream requires personal data to enable the provision of services. This may be the enabling of a
data session and personal verification for the purpose of securing a service.
6/11
10.3. For compliance with a legal obligation
Worldstream processes personal data in order to comply with its legal obligations. This can relate to
Worldstream’s obligation to comply with fiscal and administrative legal requirements.
When provided with an order from the relevant competent authority, Worldstream will act Iin
accordance with the law and may have no choice but to provide personal data requested by such
relevant competent authority.
10.4. For protection of a vital interest
Worldstream does not foresee a reason why it should process personal data for the protection of a data
subject’s vital interests.
10.5. For the performance of a task carried out in the public interest or in the exercise of official
authority vested in Worldstream
When performing tasks imposed upon it in the performance of tasks imposed upon Worldstream by law,
Worldstream may need to process personal data. Examples of this include the sharing of vulnerability
data with cybersecurity authorities.
10.6. For Worldstream’s legitimate interests
Worldstream may process your personal data when and where Worldstream has a legitimate interest to
do so. Worldstream will process your personal data for the purpose of collecting outstanding amounts
that are unpaid, direct marketing purposes, to prevent fraud, to ensure the network and information
security of Worldstream IT systems.
11. Data Protection Impact Assessments
Where Worldstream wants to start or continue a processing of personal data that is likely to result in
a high risk to the rights and freedoms of data subjects, Worldstream will conduct an assessment of
the impact of the envisaged processing operations on the protection of personal data. This applies in
particular where the envisaged processing is intended to use new information technology.
Such an assessment will in principle be carried out where a processing (or change to the processing) is
likely to result in a high risk to the rights, and freedoms of data subjects.
12. Confidentiality
Natural or legal persons engaged in the processing of personal data by Worldstream shall be require to
enter into confidentiality agreements with Worldstream.
Worldstream maintains an internal policy instructing its staff on how to protect the confidentiality of
information including personal data.
7/11
Third parties, who process personal data on the basis of an agreement with Worldstream shall be
required to impose like obligations on their own employees.
13. Preventing, monitoring and dealing with personal data breaches
The Worldstream personal data breach protocols are published and maintained on the Worldstream
intranet.
14. Data subject rights
As Worldstream, we strive to be transparent about why and how we process personal data of the
individuals working for Worldstream.
14.1. Rights overview and procedure
Under applicable law, any person has the right to ask whether Worldstream processes their personal
data. Worldstream shall respond to such requests in accordance with the law that applies to a possible
processing of that person’s personal data.
Subject to the law that applies, that person may have one or more of the following rights:
(i) the right to request access to their Personal Data;
(ii) the right to request rectification or correction of his/her Personal Data;
(iii) the right to request erasure of his/her Personal Data;
(iv) the right to request restriction of Processing of his/her Personal Data;
(v) the right to request portability of their personal data; and
(vi) the right to object to the Processing of his/her Personal Data.
Whether or not a person has these rights depends on the law that applies to the processing of their
personal data by Worldstream. Where Worldstream processes personal data in the course of its regular
business
Before it takes a request into consideration, Worldstream may require that a person making a request
provides additional information to verify their identity.
Worldstream is entitled to refuse to process a request where Worldstream is not able to verify the identity
of the person making the request.
Worldstream may further deny a request or grant a request in a restricted manner under certain
circumstances. This will take place on the basis of an appraisal of the interests of the person making the
request vis a vis the interests of Worldstream and/or others in accordance with applicable law.
Worldstream will respond promptly to a request in a concise, transparent and intelligible format.
Worldstream will respond within 30 days of receipt of the request in clear, plain language. Worldstream’s
response may take longer in case of an unusual or complex request of when a request is one of many.
8/11
Where Worldstream denies a person’s request, Worldstream will communicate the reason for that
denial to the person making a request. The person making the request shall then also be informed of
his/her right to submit a complaint to the Chief Information Security Officer or to the competent data
protection supervisory authority.
14.2. Right of access to personal data
Where Worldstream has not already provided the information elsewhere, a data subject will have the
right to request that Worldstream provide the following information:
(a) the purposes of the processing;
(b) the categories of personal data being processed;
(c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in
particular recipients in third countries or international organizations;
(d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the
criteria used to determine that period;
(e) the existence of the right to request from the controller rectification or erasure of personal data or
restriction of processing of personal data concerning the data subject or to object to such processing;
(f) the right to lodge a complaint with a supervisory authority;
(g) where the personal data are not collected from the data subject, any available information as to
their source;
(h) the existence of automated decision-making, including profiling.
14.3. Rectification
A data subject has the right to request that Worldstream rectifies or supplements personal information
about the data subject. Worldstream will, taking into account the purposes of the processing, rectify or
supplement any incorrect or incomplete personal data without undue delay.
14.4. Right to be forgotten
Under circumstances a data subject may be entitled to have Worldstream erase personal data
concerning the data subject. Where the data subject has this right, Worldstream may remove, and stop
processing, personal data.
14.5. Right to restriction of Processing
Under circumstances a data subject may have the right request that Worldstream restricts its
processing of personal data concerning that data subject.
If the data subject is entitled to such limitation, Worldstream shall mark the relevant data. Worldstream
shall only process that personal data for certain purposes.
Note that since the main grounds for Worldstream to process personal data are for purposes of carrying
out the contractual relationship with the data subject, Worldstream maintains a legitimate interest
9/11
for the Processing which shall override the restriction request except in those cases where there is no
contractual or statutory ground for the processing of personal data.
14.6. Right to data portability
Under circumstances a data subject may to have Worldstream provide the personal data concerning
the data subject, that provided to Worldstream by the data subject themself, in a structured, commonly
used and machine-readable format for the purpose of transmitting that personal data.
14.7. Right to object
In specific situations a data subject may have the right to object to the Processing of their personal
data by Worldstream. Where Worldstream finds that the data subject is entitled to such a request,
Worldstream will cease processing the data subject’s personal data.
15. Sharing of personal data
When Worldstream engages other entities to process personal data, it does so under appropriate
instructions and as necessary to support and facilitate Worldstream’s purposes for its processing. These
processors will be engaged on the basis of a specific contractual arrangement providing for clear
rights and obligations with regards to the personal data being processed. Processors are instructed to
process the Personal Data only as instructed by Worldstream in a manner consistent with the principles
described in this policy and then solely for the purposes of performing the services specified in the
applicable contract. Worldstream shall ensure that the Processor imposes the same restrictions on
any person acting under its direct authority. Worldstream will promptly enforce its agreements with
processors.
Worldstream may allow personal data to be processed by existing or potential business partners,
suppliers, independent external advisors (e.g., auditors), banks, insurance carriers, and other third
parties when necessary in connection with Worldstream’s business operations, in particular to carry out
Worldstream’s contractual relationships with such third parties. Information can be provided to such
parties as well to comply with applicable laws, communicate with the data subject and third parties,
conduct screenings and respond to and comply with requests and legal demands. Such provision of
information shall also be documented in writing.
As and when required, Worldstream may disclose personal data to third parties:
- In emergency situations where the safety of a data subject may be at risk;
- When and where Worldstream is required to disclose or share personal data pursuant to law;
- When necessary for Worldstream to protect its rights in law.
A data subject has the right to request information from Worldstream about whom personal data has
been provided to. The data subject shall also have the right to be informed of the reasons for sharing
such personal data.
10 / 1 1
16. Automated processing
Except where it is necessary for entering into, or performance of, a contract between Worldstream and
a data subject or is authorised by applicable law to which Worldstream is subject and which also lays
down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests or
where it is based on the data subject’s explicit consent, a data subject will have the right to demand not
to be subjected to a decision based solely on automated processing, including profiling, which produces
legal effects concerning, or similarly significantly affects the data subject.
17. Worldstream is accessible
Worldstream is available to answer your questions or respond to requests. Requests related to data
protection can be submitted through any of the following:
- Telephone at: +31-174-712117
- Online at: my.worldstream.com
- Email at: [email protected]
18. Data protection by design and default
Before it starts processing personal data, Worldstream ensures that the amount and type of data to be
processed is limited to that which is directly relevant and necessary. Worldstream limits the amount of
personal data collected, the extent of their processing, the period of their storage and their accessibility.
These measures are in particular intended to ensure that by default personal data are not made
accessible without the individual’s intervention to an indefinite number of natural persons.
Worldstream applies data-protection principles in an effective manner and integrates the necessary
safeguards into the processing in order to meet the requirements of the GDPR and to protect the rights
of data subjects.
19. Policy ownership, review and updates
The Directors of Worldstream are responsible for this policy. This policy will be reviewed and updated at
least once a year. Each annual review should lead to updates and improvements to this policy based on
learnings from the previous year and the incorporation of customer feedback.
11 / 1 1