Privacy as the basis for trust.

Why does Ballast Nedam have a Privacy Statement?

To serve you adequately and carry out our work as best as possible, may require processing your personal data. This applies to our customers, suppliers, employees, visitors of our website and business partners and all other parties whose personal data we process.

This Privacy Statement explains which categories of personal data we process, for what purposes, who has access to your data, how we store your data, to whom we pass on your data and what you can do yourself. Your privacy interest is our priority!

Who is Responsible for the Processing of your Personal Data?

The party who is responsible for the processing of your personal data is:

Ballast Nedam N.V.
Ringwade 71
3439 LM Nieuwegein
030-2853333

The Chief Compliance Officer of Ballast Nedam is our privacy contact person, who can be reached via privacy@ballast-nedam.nl. More information about our organisation can be found on our website.

What Personal Data do we Process?

Ballast Nedam processes your personal data when you contact us or have a (potential) relationship with us. Below you find an overview of the personal data that we process from you:

• First and last name
• Gender
• Address
• E-mail address
• Phone number
• Date of birth
• Citizen Service Number
• Nationality

For which purposes does Ballast Nedam use your Personal Data?

Ballast Nedam processes your personal data solely for promoting efficient and effective business operations and more in particular, for one or more of the following purposes:

• Recruitment: recruitment & selection of new employees and candidates.
• Internal and external provision of information: this inter alia includes sending newsletters and sending information about various activities that Ballast Nedam carries out.
• Conclusion and execution of agreements with employees, customers, consumers, suppliers and business partners: this includes the processing of personal data that is necessary to conclude an agreement and to be able to provide or receive a service.
• Customer involvement, relationship management and marketing: this includes maintaining and promoting contacts with (former) employees, customers, suppliers, business partners, consumers and account management for marketing purposes and market research.
• Health, safety and security: this includes health and safety at work, the protection of company and employee assets and the authentication of the status of employees, investigators, customers, business partners and/or suppliers and access rights.
• Management of buildings and facilities: this includes managing the parking facilities (for example, license plate number registration), providing access to the buildings (e.g., access cards) and monitoring safety using sensors and cameras.
• Complaint's handling: data is collected from people (e.g., customers, employees, residents) who have filed a complaint at a complaints desk.

Ballast Nedam only processes the data that is necessary for the purpose for which they were obtained.

Ballast Nedam only processes personal data from you if we have lawful grounds to do so. The lawful grounds for processing your personal data depend on the type of service used. We process data according to the following lawful grounds:

• Your consent;
• Processing your data is necessary for the execution of an agreement;
• Processing your data is necessary to comply with a legal obligation;
• Processing your data is necessary to protect you against serious threats to your health;
• Processing your data is necessary in the interests of Ballast Nedam, in situations where your interests do not prevail.

How does Ballast Nedam handle your Personal Data?

We handle all personal data carefully, safely and confidentially. To achieve this, Ballast Nedam has drawn up policy documents, specifically on privacy and security, and we always adhere to these policies. As a result, you can rest assured that your privacy and security is guaranteed throughout our entire organisation.

Security

To protect your privacy and the confidentiality of your data, Ballast Nedam takes appropriate technical and organisational measures. Ballast Nedam's security policy is based on the Code for Information Security (ISO27001 and ISO17799). This Code describes the standards and technical and organisational measures important for realising an adequate level of information security. It also offers the best practical method to comply with privacy legislation, such as the General Data Protection Regulation.

We take security measures to prevent misuse of and unauthorised access to personal data. Anyone who can access your personal data via Ballast Nedam has a duty of confidentiality.

The systems in which customer data are stored are only accessible for a select group of employees who require access to perform their duties.

If there is evidence or we suspect that something has gone wrong with protection your personal data, we will immediately report this to the Data Protection Authority. If the violation of your personal data may have unfavourable or adverse consequences for you, we will inform you as soon as possible.

Retention of Personal Data

Ballast Nedam does not retain your data any longer than is necessary for the purposes for which your data are processed and legally permitted. How long certain data is retained depends on the nature of the data and the purposes for which it is processed. The retention period can therefore be different for each purpose. Ballast Nedam has laid this down in specific policies.

Providing Personal Data to Third Parties

We explicitly do not provide your personal data to third parties unless this is necessary in the context of the execution of the agreement, in case it is legally required or if you have given us your consent. For example, such third parties include the Tax Authorities, Pension Funds, the Labour Inspectorate, and other supervisory authorities.

Ballast Nedam may also be obliged to provide personal data to third parties based on laws or regulations, according to a judgment of a competent court, or in case of fraud or misuse. If that is the case, Ballast Nedam will provide its cooperation.

Passing on your Data to Countries outside the European Union.
Ballast Nedam will not pass on your personal data to any company or branch in any country outside the European Union unless a (model) agreement has been concluded or you have signed a declaration in which you have given your consent.

What do we do with your Visitor Data?

General visitor data is registered on the Ballast Nedam websites, such as the most visited pages. With this data, we can further optimise the layout of our website. It can also be used to place more targeted information on the website. This allows us to improve our services further. We also register how visitors navigate through the Ballast Nedam website. This data are only stored and processed internally.

What do we do with Cookies?

Cookies are small files that placed on your computer and are used by websites to function or display the website pages properly. We use cookies to improve your user experience. We use the following types of cookies:

Functional Cookies
These cookies are necessary for the functioning of our website. They keep track of your preferences and remember that you have been on the site before. For example, Google remembers your preference for the search language. This type of cookies does not collect any personal data. We do not need your permission to use these cookies.

We also use 'My Fonts' cookies. My Fonts places fonts on our website. A font contains all characters (capitals, undercast, numbers and punctuation marks) of the scripts and logos found on our website and gives the most optimal experience.

Analytical Cookies
With these cookies we can collect statistics from our website, for example which pages are visited and for how long. In Google Analytics, for example, the number of visitors, location of visitors and the used browser can be measured. This type of cookies does not collect any personal data from you. We do not need your consent to use these cookies.

Tracking Cookies
Tracking cookies allow individual tracking on the website. By tracking the behaviour of visitors on our website, we can improve the experience on our website. Via our website, a cookie is placed from the American company Google as part of the "Analytics" service. We use this service to track and get reports on how visitors use our website. Google can provide this information to third parties if Google is legally obliged to do so or if third parties process the information on behalf of Google. We have no influence on that. The information that Google collects is (as much as possible) anonymised. Your I.P. address is not given. The information is transferred to and stored by Google on servers in the United States.

What are Your Rights?

If Ballast Nedam processes your personal data, you have certain rights that are explained below.

Right of Access to your Personal Data
Are you a Ballast Nedam customer and do you want to see what personal data is known to us? Then you can use your 'Right of Access'. We will ask you to indicate specifically which personal data you would like to receive.

Right to Rectification
You have the right to rectify data if your data are incorrect or incomplete. You also have the right to rectify the data if the data is not relevant to how we process it or have processed your data in violation of legal regulation.

We will inform the third party/parties who have received your information of any rectification, unless this is impossible or requires disproportionate efforts.

Right to Delete Data
You have the right to request us to delete certain data. For example, if your data is no longer required for the purposes for which we received it, if you object to the processing or your data has been processed unlawfully by us. However, we cannot always erase all requested data, because we are or may be obliged to retain certain data from you.

Right to Restriction of Processing
You also have the right to restrict the processing of your data. The right to restriction means that we (temporarily) cannot process your personal data and cannot change it, for example, you dispute the correctness of the data, if you believe that the personal data are no longer necessary for the purposes, or if you believe that the processing of your personal data by Ballast Nedam is unlawful.

Right to Object
You can object to the processing of your personal data by Ballast Nedam if your personal data is used for purposes other than those for which you have given consent, than necessary for the execution of an agreement, than necessary for compliance with a legal obligation or one of the other lawful bases. For example, if you do not want us to use your personal data to send you personalised offers.

Right to Data Portability
If you have provided us with your personal data, you are entitled to data portability in certain cases. This means that we will provide your data to you in a structured, standard and machine-readable manner if requested by you.

How can you exercise your rights?

If you wish to exercise your rights, you can contact us at any time via the contact details stated below or by sending us a letter with your name, address and telephone number. No stamp is required. We will respond to your request within one month.

We ask you to identify yourself based on a valid proof of identity to check whether we provide the personal data to the right person.

Supervision of the Processing of Personal Data

If you believe that the provisions of this Privacy Statement or the General Data Protection Regulation are not or not sufficiently complied with by us, you can report this via privacy@ballast-nedam.nl.

If you suspect that we process your personal data in a manner contrary to the privacy legislation, you have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). This can be done by filling in the complaints form on their website.

Data Breach

If you suspect a data breach, you can report this to our ICT Helpdesk on +31 30 285 35 00.

About this Privacy Statement

Ballast Nedam reserves the right to update this Privacy Statement at any time. The last change was in June 2021. The most recent version can always be found on our website.

If you have any questions or comments about our Privacy Statement, please do not hesitate to contact us via privacy@ballast-nedam.nl.

Nieuwegein, the Netherlands, June 2021