This policy explains what personal data we process when you use our business ordering platform at shop.hanjointernational.nl (the "Shop"), why we process it, who we share it with, how long we keep it, and what rights you have. It replaces the previous version of this policy, dated 1 July 2024.
On 29 September 2026 we upgraded our webshop. It now runs at shop.hanjointernational.nl, and visits to the webshop pages of hanjointernational.nl are forwarded there automatically. Existing accounts continue in the new system; section 3A explains what the upgrade means for you.
The Shop is a business-to-business platform: our customers are companies. The people who register, log in and place orders on behalf of those companies are individuals, however, and information about them is personal data. This policy is about that data.
1. Who we are
Hanjo International B.V. ("Hanjo", "we", "us") is the controller of the personal data described in this policy. That means we decide why and how it is processed.
| Company | Hanjo International B.V. |
| Address | Bleiswijkseweg 43, 2712 PB Zoetermeer, the Netherlands |
| Chamber of Commerce (KvK) | 80671497 |
| VAT (BTW) | NL861757336B01 |
| Privacy contact | it@hanjointernational.nl |
We are not required to appoint a Data Protection Officer and have not appointed one. All privacy questions, requests and complaints go to the contact address above and are handled by our management.
2. What this policy covers
This policy covers the Shop at shop.hanjointernational.nl, including registration, your account, the product catalogue, ordering, and the emails we send you in connection with it.
It does not cover our corporate website at hanjointernational.com, nor any third-party website you reach by following a link from the Shop.
3. What personal data we collect
We collect the following categories of data.
- Registration data — company name, Chamber of Commerce and VAT numbers, the name, business email address and telephone number of your contact person, and your invoice and delivery addresses.
- Verification documents — the business licence, trade registration or comparable document you upload so that we can confirm you are a business buyer. We only look at these to verify your registration. Please do not upload a passport or identity card: those may show a citizen service number (BSN), which we are not permitted to process (art. 46 UAVG).
- Account data — your password (stored only as a one-way hash; we never hold it in readable form), your preferred language, the sub-account users you create for colleagues, saved addresses, your wishlist and the contents of your cart.
- Order data — the products, quantities and prices you order, the delivery and invoice addresses used, and the status and history of each order.
- Communication preferences — whether you have subscribed to our newsletter, together with the date, time and IP address at which you gave or withdrew that consent. We keep this specifically so that we can demonstrate consent, as Article 7(1) GDPR requires. When you open a newsletter or click a link in it, that is recorded by our newsletter service (Wix) on our behalf.
- Correspondence — messages you send through the contact form or by email, and a log of the transactional emails we send you (activation, password reset, order confirmation).
- Security data — your IP address, browser user-agent, and the time and outcome of login attempts, password resets and account activations. This is written to a separate security log, not to your customer record.
- Usage data — see section 4 below.
Where the data comes from. Most of this data you give us yourself when you register or use the Shop. Where our sales team opens an account for your company, the company and contact details are provided by your company in the course of our business relationship; we then send an activation email to the contact address provided so that the account holder can set their own password. If you already had an account before the system upgrade of 29 September 2026, see section 3A.
The registration data we ask for is necessary to open an account: if you do not provide it, we cannot create an account for you.
We do not collect special categories of data (such as health, ethnicity or political opinions), and we ask you not to send us any. We do not collect criminal record data.
3A. The system upgrade of 29 September 2026
On 29 September 2026 we replaced our webshop with a new version at shop.hanjointernational.nl. Visits to the webshop pages of hanjointernational.nl are forwarded to the new address. The company responsible for your data stays the same: Hanjo International B.V. Existing accounts continue in the new system, and we process their data for the same purposes and on the same legal bases as before (section 5).
- Kept: your sign-in email address and password, your company details, your addresses and the contents of your shopping cart. You sign in as before.
- Orders placed before the upgrade remain valid and stay in our order and accounting records (section 10), but they are not shown in your account in the new system. Your sales representative can give you information about them.
Your password remains stored only as a one-way hash (section 12); nobody at Hanjo can read it. If you prefer, you can set a new password at any time with "Forgot your password?" on the login page.
The previous version of our webshop is no longer used for ordering. Its database remains with the hosting provider of that version, with access restricted to Hanjo, until 29 September 2027, 12 months after the upgrade, and is then deleted.
4. Usage data and how we record it
When you are logged in, our servers record the significant actions you take in the Shop — signing in and out, adding items to your cart, placing an order, uploading a document. For each of these we store a timestamp, which account and sub-account performed it, the language you were using, the product or category involved where relevant, and a shortened form of your IP address.
This is recorded on our own servers as part of handling your request. It is not collected by cookies, tracking pixels, session recording or third-party analytics.
We do not use analytics cookies, advertising cookies, tracking pixels, social media plugins, session recording or any third-party analytics service on the Shop. We do not track you across other websites, we do not buy or receive profile data about you from third parties, and we do not sell or rent your data. If we ever introduce analytics or marketing technologies that store or read data on your device, we will ask for your consent first and update this policy before doing so.
In this usage data we deliberately do not record mouse movements, keystrokes, the contents of forms you have not submitted, your full IP address, or your raw browser user-agent string.
5. Why we use your data, and on what legal basis
We only process personal data where the GDPR gives us a basis for doing so. The table below sets out each purpose and the basis we rely on.
| Purpose | Data used | Legal basis |
|---|---|---|
| Assessing your registration and confirming that you are a business buyer | Registration data, verification documents | Steps prior to entering into a contract — Art. 6(1)(b) |
| Creating and running your account, including sub-accounts and saved addresses | Account data | Performance of a contract — Art. 6(1)(b) |
| Handling, delivering and invoicing your orders | Order data, addresses, contact details | Performance of a contract — Art. 6(1)(b) |
| Keeping invoices and accounting records | Order and invoice data | Legal obligation — Art. 6(1)(c) (Dutch Tax Act, art. 52 AWR) |
| Food safety traceability: being able to trace which customer received which batch | Order data | Legal obligation — Art. 6(1)(c) (Reg. (EC) 178/2002, art. 18) |
| Protecting the Shop against brute-force attacks, credential stuffing and abuse; investigating incidents | Security data | Legitimate interest — Art. 6(1)(f): keeping our platform and your account secure |
| Understanding how our business customers use the Shop so that we can improve it, and so that our sales team can follow up and advise you relevantly | Usage data, order data | Legitimate interest — Art. 6(1)(f): managing and developing our customer relationships |
| Sending our newsletter and commercial offers by email | Contact details, communication preferences, newsletter open and click statistics | Consent — Art. 6(1)(a) |
| Answering your questions and handling complaints | Correspondence, account and order data | Performance of a contract — Art. 6(1)(b) and legitimate interest — Art. 6(1)(f) |
| Complying with legal requests, and establishing, exercising or defending legal claims | Any of the above, as relevant | Legal obligation — Art. 6(1)(c) and legitimate interest — Art. 6(1)(f) |
Where we rely on legitimate interests, we have weighed our interest against your rights and freedoms and concluded that the processing is proportionate — in particular because it is limited to business use of a platform you log into, because we do not track you elsewhere, and because you can object at any time. You may ask us for a summary of that assessment.
7. Profiling and automated decisions
We build a limited profile of each business account from the order and usage data described above. It tells us things like which product categories an account orders or looks at most, how recently it last ordered or signed in, and whether items were left in a cart. Our sales team uses this to decide who to follow up with and to make the offers we send you relevant to your business.
We do not take decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). In particular, your prices, your credit and payment terms, and whether an order is accepted are never determined by this profile. Those follow from the commercial agreement between your company and ours and are reviewed by our staff.
The profile is built only from data you generate inside the Shop and from your order history with us. It is not combined with data about you from other websites or from data brokers, and it is not shared outside Hanjo.
You can object to this profiling at any time — see section 11. If you do, we stop using your data for it.
9. Transfers outside the EEA
We keep personal data within the European Economic Area wherever we can. Our servers, our database and our ERP system are in the EEA.
The first exception is email. Because we send transactional email through Google Workspace, message content and recipient addresses may be accessed from outside the EEA, including the United States. That transfer is covered by the European Commission's adequacy decision for the EU–US Data Privacy Framework and, in addition, by the Commission's Standard Contractual Clauses. You can ask us for details of the safeguards in place.
The second exception is remote access from China. One of our sales assistants works remotely from China and, in the course of that work, can access customer data in our internal systems. That access counts as a transfer to a country for which the European Commission has not issued an adequacy decision. It takes place under the Commission's Standard Contractual Clauses, informed by an assessment of the level of protection in practice (a transfer impact assessment). The assistant can only see the customers assigned to them.
The third exception is our newsletter service. Our newsletters are sent through Wix.com Ltd., which is established in Israel — a country for which the European Commission has adopted an adequacy decision — and stores data in Ireland and the United States. Where data is processed in the United States, that is covered by the EU–US Data Privacy Framework and the Commission's Standard Contractual Clauses.
10. How long we keep your data
We do not keep personal data longer than we need it. The periods below apply unless a longer period is required by law or is necessary to establish, exercise or defend a legal claim.
| Data | Kept for |
|---|---|
| Account and contact data | For as long as your account exists. When you close your account, or ask us to, we delete or anonymise it, except for records we are required to keep (see below). |
| Archive of the previous version of our webshop | Until 29 September 2027 (12 months after the system upgrade), then deleted. |
| Registrations that are never completed or are rejected | Removed once the decision is final; uploaded documents from abandoned registrations are cleared automatically. |
| Verification documents (business licence and similar) | Until verification is complete and, after that, for as long as the account exists. |
| Orders, invoices and accounting records | 7 years from the end of the financial year concerned (Dutch Tax Act, art. 52 AWR). |
| Order records needed for food traceability | 7 years, together with the order and accounting records above (Regulation (EC) 178/2002 does not itself set a period). |
| Security and authentication logs (IP, user-agent, login outcomes) | 90 days. |
| Individual usage events | 13 months. |
| The account profile derived from them | 24 months after the account's last activity. |
| Newsletter consent records | For as long as you are subscribed, and 3 years after you unsubscribe, so that we can show the withdrawal was honoured. |
| Correspondence and the transactional email log | 24 months, or longer if it relates to an ongoing matter. |
11. Your rights
Under the GDPR you have the following rights in relation to your personal data.
- Access — to be told whether we process data about you and to receive a copy of it (Art. 15).
- Rectification — to have inaccurate data corrected and incomplete data completed (Art. 16). Most of your account data you can correct yourself in the Shop.
- Erasure — to have your data deleted where we no longer have a basis to keep it (Art. 17). This does not extend to records we are legally required to retain, such as invoices.
- Restriction — to have processing paused while, for example, a dispute about accuracy is resolved (Art. 18).
- Portability — to receive the data you gave us in a structured, commonly used, machine-readable format, and to have it sent to another controller where technically feasible (Art. 20).
- Objection — to object to processing we base on legitimate interests, including the profiling described in section 7 (Art. 21(1)). We will then stop unless we can show compelling legitimate grounds that override your interests.
- Withdrawal of consent — to withdraw consent at any time, as easily as you gave it (Art. 7(3)). Withdrawing does not affect the lawfulness of what we did beforehand.
Direct marketing is different. If you object to your data being used for direct marketing, including any profiling connected to it, we must stop immediately and there is nothing for us to weigh against it (Article 21(2) GDPR). You can unsubscribe at any time using the link in any newsletter, or from the Communication preferences page in your account.
To exercise any of these rights, email it@hanjointernational.nl. We reply within one month; if a request is complex we may extend that by two further months and will tell you if we do. We may ask you for information to confirm who you are, so that we do not disclose your data to someone else. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.
If you are not satisfied with how we handle your data or your request, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the supervisory authority in the EU country where you live or work. We would appreciate the chance to resolve it with you first.
12. How we protect your data
- All traffic to and from the Shop is encrypted with TLS.
- Passwords are stored only as one-way hashes. Nobody at Hanjo can read your password.
- Repeated failed login attempts are rate-limited and temporarily locked out, and we monitor for credential-stuffing patterns.
- Sessions expire after 12 hours (14 days if you tick "Remember me", and never longer than 30 days after you signed in), and changing your password signs out every device.
- Access by our own staff is limited by role, and sales staff can only see the customers assigned to them.
- Security events are logged separately from your customer record and kept for a limited period.
No system is perfectly secure. If you believe your account has been compromised, or if you spot a vulnerability in the Shop, please tell us at it@hanjointernational.nl so we can act on it. Where a data breach is likely to result in a risk to your rights, we notify the Autoriteit Persoonsgegevens within 72 hours and, where the risk is high, we notify you as well.
13. Children
The Shop is a professional trading platform intended for businesses. It is not directed at children and we do not knowingly collect personal data from anyone under 16. If you believe we hold such data, contact us and we will delete it.
14. Changes to this policy
We update this policy when what we do with personal data changes, or when the law requires it. Each version carries a version number and an effective date, shown at the top of this page.
If a change is significant — for example if we start using a new category of data, add a new recipient, or introduce technology that stores data on your device — we will tell you before it takes effect, and where the change relies on your consent we will ask for that consent separately. Continuing to use the Shop does not count as consent.
| Version | Date | What changed |
|---|---|---|
| 2.0 | 29 September 2026 | Revised and expanded version of this policy, issued with the upgrade of our webshop. Sets out legal bases, retention periods, recipients, international transfers, data subject rights, profiling and the complaints route; discloses usage-data recording, newsletter statistics and the "Remember me" storage; explains what the system upgrade means for existing accounts (section 3A). |
| 1.0 | 1 July 2024 | Previous version of this policy. |
15. Contact
Questions about this policy, or about how we handle your data: it@hanjointernational.nl, or write to Hanjo International B.V., Bleiswijkseweg 43, 2712 PB Zoetermeer, the Netherlands.
© Hanjo International B.V. All rights reserved.
See also: Terms and Conditions