Privacy statement

This statement explains which personal data Fijn Mekaniek Nelissen NV processes through this website, for what purpose and on what legal basis, how long we keep it and what your rights are. In doing so we follow the General Data Protection Regulation (GDPR). Cookies and similar technologies are covered in our cookie policy.

Who is responsible

The controller of your personal data is:

Fijn Mekaniek Nelissen NV (naamloze vennootschap, a Belgian public limited company)
Vrijheidweg 3, 3700 Tongeren, Belgium
Enterprise number 0441.159.463 · VAT BE 0441.159.463
Email: info@fijnmekanieknelissen.be · telephone: +32 12 26 38 85

We have not appointed a data protection officer (DPO). If you have a question about this statement or about your data, please email info@fijnmekanieknelissen.be.

Contact and quotation requests

This website has no contact form. When you send us a question or a quotation request by email, we process:

• your name and, if you mention it, the name of your company
• your email address and, if you mention it, your telephone number
• the content of your message
• the technical files you attach, such as a drawing in PDF or STEP

Purpose. To handle your request and to communicate with you about a possible order.

Legal basis. Steps you ask us to take before entering into a contract (Article 6(1)(b) GDPR), and our legitimate interest in answering business enquiries (Article 6(1)(f) GDPR).

How long. If your request does not lead to an order, we keep it for no longer than two years. If it does lead to an order, the statutory retention periods for commercial, accounting and quality records apply.

Your drawings. We only share your drawings with a partner carrying out a finishing treatment you have asked for.

Job application form

When you apply through the website, we process:

• your first name, last name, email address and telephone number
• your municipality, if you enter it
• whether you hold a driving licence and in which category, whether you have your own transport and whether you are willing to work shifts
• your CNC experience and the date from which you are available
• your motivation
• your CV, if you attach one (PDF, DOC, DOCX, ODT, RTF, JPG or PNG, up to 10 MB)
• the box you tick to agree to the use of your data
• your IP address

Purpose. To assess your application, for this vacancy or for a later one.

Legal basis. Steps you ask us to take before entering into a contract (Article 6(1)(b) GDPR), and our legitimate interest in assessing applications, including for a later vacancy (Article 6(1)(f) GDPR).

How long. Up to one year after the end of the selection procedure, after which we delete your data. If you are hired, your application becomes part of your personnel file.

Your CV. Your CV is kept in the same private storage area in Google Cloud Storage and is never publicly accessible. The link we use to open it internally expires after 30 days.

Forwarding by email

What you send through the application form is also forwarded to our company mailbox, through our email provider. That email contains the details you entered and, if you attached a CV, the internal link to it.

Protection against spam and abuse

To stop automated submissions, the application form is protected by:

• a hidden field that only bots fill in, and a minimum time for filling in the form. No personal data is used for this.
• a limit on the number of submissions in quick succession. For this we do not store your IP address itself but a hashed form of it (SHA-256), together with the times of the attempts. This data is deleted no later than 24 hours after the last attempt.

Hosting and server logs

The website runs on Google Cloud and Firebase: Firebase App Hosting (on Cloud Run), the Firestore database, Cloud Storage for files and Secret Manager for confidential settings. Website hosting and the database are located in Google’s europe-west4 region, in the Netherlands.

The web servers log the pages that are requested: your IP address, the time, the page requested and your browser. These logs are kept in Google Cloud Logging for 30 days.

Google acts as our processor: it processes this data on our behalf. Where Google processes data outside the European Economic Area, this is covered by the European Commission’s standard contractual clauses and by Google LLC’s certification under the EU-U.S. Data Privacy Framework.

External content and links

Two parts of the website come from a third party:

• the company film, via youtube-nocookie.com from Google Ireland Limited (YouTube)
• the map on the contact page, with map tiles from the OpenStreetMap Foundation in the United Kingdom. The European Commission has adopted an adequacy decision for the United Kingdom.

They only load with your consent (Article 6(1)(a) GDPR): if you allow external media, or if you choose ‘Load once’ where the film or the map would appear. As soon as they load, these services receive your IP address. You can withdraw your consent at any time in the cookie settings; see our cookie policy for more.

The links to LinkedIn, Facebook and Google Maps are ordinary links. Nothing is sent to those platforms until you click one. After that, their own privacy policies apply.

What we do not do

• no statistics or analysis of your visit
• no advertising or retargeting
• no profiling and no automated decision-making
• no sale of your data

Your rights

You have the right to:

• access your data
• have inaccurate data corrected
• have your data erased
• have the processing restricted
• object to the processing
• receive your data in a commonly used format, or have it transferred to another organisation
• withdraw your consent at any time; for external media, you do this in the cookie settings

To exercise these rights, email info@fijnmekanieknelissen.be. We will reply within one month.

If you are not satisfied with how we handle your data, you can lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be, contact@apd-gba.be.

Security

• CVs are kept in private storage and are never publicly accessible.
• Internal links to CVs expire automatically after 30 days.
• The website’s email password is kept in Google Secret Manager.
• Only authorised accounts have access to the website’s administration area.

Changes

We may update this statement, for example when the website changes. The date at the top shows the latest version.