Privacy statement

This is the privacy statement for BBL Company VOF (BBLC), with its registered office at Concourslaan 17, 9727 KC, Groningen, Netherlands, BBL Company VOF is listed in the Dutch business register under number  02085020.

We are strongly committed to protecting your personal data. You can read in this privacy statement how we handle your personal data. BBLC respects your privacy and complies with the General Data Protection Regulation (GDPR) and the Dutch legislation implementing the GDPR. This privacy statement applies to:

  • visitors to our website
  • visitors to our offices and sites
  • suppliers

Why does BBLC use your personal data?

Personal data means all information that says something about you directly or that can be traced back to you as an individual. BBLC only processes the personal data we need to perform our work and only if we have a lawful basis for doing so. BBLC processes personal data on the following lawful bases:

  • where necessary to comply with the law, for example to keep accurate records concerning the location of our infrastructure and the plots involved;
  • where necessary to execute a contract (agreement) between you and BBLC, for example if you are a landowner and we have agreed a right of superficies with you. In such a case we need to record the personal data for the fulfilment of contractual obligations between the parties;
  • where BBLC has a ‘legitimate interest’ (sound reason) in processing your data. For example, we record CCTV footage as part of security measures on our premises and we use IT solutions for the security of our digital environment;
  • where you have given BBLC permission (‘consent’) to process your personal data, like when you consent to the placement of cookies or subscribe to a newsletter when visiting our website, for example. If you have given us consent to process certain personal data, you may withdraw your consent at any time and we will stop processing your data for that specific purpose.

BBLC always adheres to the principle that personal data is to be processed in a manner that is lawful, fair and transparent to you.

Which personal data does BBLC process?

We collect the following information on visitors to our websites:

If you subscribe to our newsletter:

If you subscribe to our newsletter, you only provide your email address, which we need to send you the newsletter. If you no longer wish to receive the newsletter you can unsubscribe.  

If you submit a responsible disclosure: 

If you become aware of a vulnerability or weak spot in an IT system or on this website and wish to report this, you can do this by submitting what’s called a ‘responsible disclosure’ to BBLC. For this we ask you for your name and email address. 

Cookies

Personal data can also be collected by cookies, small text files that are sent to and stored on your computer. BBLC uses cookies on this website. See our cookie statement for detailed information on the use of cookies on the BBLC website. If you do not want to accept cookies from BBLC, you can disable them through your browser. The Help section of your browser will explain how to do this. You can still visit our website even if you disable cookies.

We collect the following information on visitors to our offices and sites:

If you are signed in as a visitor:

If you plan to visit one of our offices or sites, your BBLC contact will first register you in our visitor registration system. We register the following information: your last name and prefixes, your gender, the date and time you will be visiting, the name of your company or organisation, and your email address. 

CCTV

We have CCTV installed in and around our sites and offices. We process CCTV footage to ensure a safe and secure environment for our visitors and staff and to protect property. The recorded images are only used internally and are not shared with third parties, except in the event of an incident or if we are required to do so to comply with a legal obligation.

Site access instruction video:

If you come to perform work at a BBLC office or a BBLC gas supply site, you must first watch a site access instruction video and answer the accompanying questions on safety instructions. This rule also applies to visitors to our gas supply sites. To arrange this, you must first create an account and we will process your email (as your username) and your password. We also ask for your first and last name and your phone number. Once you have viewed the site access instruction video and answered the questions correctly, you will receive a certificate by email. If you are planning to visit a BBLC site where gas is not stored or transmitted, obtaining the certificate is not mandatory, but we recommend that you watch the video nonetheless.
You will receive an email with more information and a link to the instruction video prior to your scheduled visit. This video is on YouTube. To view this video, you must first consent to YouTube placing cookies. See YouTube’s privacy policy for more information.

We collect the following information on suppliers:

To be able to carry out our agreements with you, we conclude a contract with you. This contract includes the signature, full name and job title of the signatory. We also need your contact details for the implementation of the contract; we process the full name, email address and phone number of your contact for this purpose. We may also keep a record of your job title. If you are not yet a supplier and you respond to a request for tender, we also need your contact details so that we can communicate with you in connection with the tender process.

For how long does BBLC keep your data?

BBLC keeps personal data for as long as necessary for the purposes for which this information was collected. In some cases, we are legally required to retain records for a minimum period, such as the fiscal retention periods. We keep visitor data for no longer than six months.

If you have any questions about how long we keep particular data, you can send us an email at [email protected].

How does BBLC secure your data?

BBLC takes appropriate technical and organisational measures to protect personal data against theft, misuse, unauthorised access, disclosure, alteration and/or destruction. These are some examples of the measures we take:

  • We store personal data on computer systems in controlled environments with restricted access.
  • We use encryption and other security technologies to protect data during transmission.
  • We arrange regular security audits and risk assessments.
  • Our staff are instructed on data protection and security protocols.

Third-party processing and sharing your personal data with external parties

Processing of personal data by data processors

BBLC sometimes engages a third party to provide or perform a service. If this party has access to your personal data, the third party is considered to be a data processor. BBLC has implemented the necessary contractual and organisational measures to ensure that the data processor only processes your personal data for the agreed purposes, as clearly set out in the data processing agreement we have concluded with them. 

Sharing your personal data with third parties other than data processors

BBLC only shares your personal data with third parties to comply with legal obligations or after you have given consent for this.

Processing personal data outside the EEA

BBLC aims to only use data processors located in the European Economic Area (EEA). If BBLC decides to transfer personal data for processing by a party located outside the EEA, BBLC will take the necessary data protection and security measures.

What rights do you have as a data subject?

As a data subject, you have the following rights:

  • Right to be informed: you can ask BBLC about which personal data it processes and its reasons for doing so.
  • Right of access: you can ask BBLC to provide you access to your personal data.
  • Right to rectification: if the personal data BBLC holds about you is incorrect and/or incomplete, you can ask BBLC to correct and/or supplement this.
  • Right to be forgotten: you can ask BBLC to delete your personal data, in which case BBLC will assess whether there are grounds for fulfilling your request.
  • Right to restriction of processing: you can ask BBLC to restrict the processing of your personal data, which you may do, for example, if the data is inaccurate or the processing is unlawful.
  • Right to object: you can object to the processing of your personal data due to your specific situation, in which case BBLC will comply with your request unless there are compelling reasons to continue processing your personal data.

If you wish to exercise any of these rights, you can send an email to [email protected]. BBLC will let you know as soon as possible, but in any case within one month, how we have handled your request and, if applicable, provide you with the requested information. Depending on the complexity of your request or the number of requests BBLC receives, BBLC can extend this period by two months, in which case BBLC will inform you of the longer response period.

If you believe that BBLC has not sufficiently addressed your request, you can file a complaint with the Dutch Data Protection Authority.

Changes to this privacy statement

BBLC may amend this privacy statement from time to time and so we advise you to consult it regularly on BBLC’s website to see the latest version. If BBLC amends its privacy statement, we will revise the date at the bottom of the privacy statement.

Contact

For complaints, queries or comments about the use of personal data, you can send us an email at [email protected].

Last updated: 19 August 2025

Responsible Disclosure